add nice pictures to presentation slides
This commit is contained in:
Binary file not shown.
@@ -27,6 +27,8 @@
|
|||||||
\usepackage{booktabs}
|
\usepackage{booktabs}
|
||||||
\usepackage{url}
|
\usepackage{url}
|
||||||
\usepackage{xcolor}
|
\usepackage{xcolor}
|
||||||
|
\usepackage{graphicx}
|
||||||
|
\graphicspath{ {./} }
|
||||||
|
|
||||||
\definecolor{codegreen}{rgb}{0,0.6,0}
|
\definecolor{codegreen}{rgb}{0,0.6,0}
|
||||||
\definecolor{codegray}{rgb}{0.5,0.5,0.5}
|
\definecolor{codegray}{rgb}{0.5,0.5,0.5}
|
||||||
@@ -110,6 +112,22 @@
|
|||||||
Examples follow, use in production at your own risk ;)
|
Examples follow, use in production at your own risk ;)
|
||||||
\end{frame}
|
\end{frame}
|
||||||
|
|
||||||
|
\begin{frame}[fragile]
|
||||||
|
\frametitle{Why this works}
|
||||||
|
A dynamic array in storage slot $p$ stores its data at continuous addresses starting at $keccak(p)$.
|
||||||
|
|
||||||
|
For example, if the variable $x$ is a dynamic array occupying storage slot 3, $x[o]$ can be found at $keccak(0x3)+o$.
|
||||||
|
|
||||||
|
An attacker can use this information to overwrite any storage slot by finding an appropriate offset value.
|
||||||
|
\end{frame}
|
||||||
|
|
||||||
|
\begin{frame}[fragile]
|
||||||
|
\frametitle{Why this works}
|
||||||
|
|
||||||
|
\includegraphics[width=\textwidth]{storage}
|
||||||
|
|
||||||
|
\end{frame}
|
||||||
|
|
||||||
\subsection[Examples]{Examples}
|
\subsection[Examples]{Examples}
|
||||||
\begin{frame}[fragile]
|
\begin{frame}[fragile]
|
||||||
\frametitle{Unchecked Array Write}
|
\frametitle{Unchecked Array Write}
|
||||||
@@ -194,14 +212,7 @@ contract MyContract {
|
|||||||
\end{lstlisting}
|
\end{lstlisting}
|
||||||
\end{frame}
|
\end{frame}
|
||||||
|
|
||||||
\begin{frame}[fragile]
|
|
||||||
\frametitle{Why this works}
|
|
||||||
A dynamic array in storage slot $p$ stores its data at continuous addresses starting at $keccak(p)$.
|
|
||||||
|
|
||||||
For example, if the variable $x$ is a dynamic array occupying storage slot 3, $x[o]$ can be found at $keccak(0x3)+o$.
|
|
||||||
|
|
||||||
An attacker can use this information to overwrite any storage slot by finding an appropriate offset value.
|
|
||||||
\end{frame}
|
|
||||||
|
|
||||||
\section{Detecting and Exploiting}
|
\section{Detecting and Exploiting}
|
||||||
\subsection[Detecting SWC-124]{Detecting SWC-124}
|
\subsection[Detecting SWC-124]{Detecting SWC-124}
|
||||||
@@ -234,6 +245,13 @@ contract MyContract {
|
|||||||
\end{itemize}
|
\end{itemize}
|
||||||
\end{frame}
|
\end{frame}
|
||||||
|
|
||||||
|
\begin{frame}[fragile]
|
||||||
|
\texttt{\$ slither Bethorde.sol --print variable-order}
|
||||||
|
|
||||||
|
\includegraphics[width=\textwidth]{slither}
|
||||||
|
|
||||||
|
\end{frame}
|
||||||
|
|
||||||
\subsection[Exploiting SWC-124]{Exploiting SWC-124}
|
\subsection[Exploiting SWC-124]{Exploiting SWC-124}
|
||||||
|
|
||||||
% TODO: Exploitation is trivial, should we just go back and explain or should we go into memory layout? Can we handle it in time?
|
% TODO: Exploitation is trivial, should we just go back and explain or should we go into memory layout? Can we handle it in time?
|
||||||
|
|||||||
Binary file not shown.
|
After Width: | Height: | Size: 62 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 55 KiB |
Reference in New Issue
Block a user