TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Smart Contract Security for Pentesters

63 点作者 dyates大约 4 年前

6 条评论

ramimac大约 4 年前
I would highly recommend anyone interested in pentesting smart contracts look at the work Trail of Bits has been putting out: <a href="https:&#x2F;&#x2F;blog.trailofbits.com&#x2F;?s=smart+contract&amp;submit=Search" rel="nofollow">https:&#x2F;&#x2F;blog.trailofbits.com&#x2F;?s=smart+contract&amp;submit=Search</a><p>Start with &quot;246 Findings From our Smart Contract Audits: An Executive Summary&quot; [1]<p>[1] <a href="https:&#x2F;&#x2F;blog.trailofbits.com&#x2F;2019&#x2F;08&#x2F;08&#x2F;246-findings-from-our-smart-contract-audits-an-executive-summary&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.trailofbits.com&#x2F;2019&#x2F;08&#x2F;08&#x2F;246-findings-from-ou...</a>
mratsim大约 4 年前
I&#x27;d like to add that there is a critical shortage of security auditors for smart contracts and blockchain protocols.<p>Projects are willing to spend up to millions to squash away vulnerabilities. For example Balancer opened a bug bounty for their v2 with $2M USD for 1 critical bug:<p><a href="https:&#x2F;&#x2F;docs-v2.balancer.finance&#x2F;core-concepts-1&#x2F;security&#x2F;bug-bounties" rel="nofollow">https:&#x2F;&#x2F;docs-v2.balancer.finance&#x2F;core-concepts-1&#x2F;security&#x2F;bu...</a>
评论 #26890105 未加载
motohagiography大约 4 年前
Naive question: how is looting vulnerable smart contracts even illegal?<p>Without a legal framework of smart contract enforcement, recognition of literally-hypothetical assets as valuable, the public nature of blockchains that would preclude &quot;unauthorized access,&quot; and unlike an exchange holding assets on behalf of customers - smart contracts are effectively leaving money on the ground for anyone clever enough to pick it up.<p>Clearly I haven&#x27;t given it as much thought as the people involved, but it seems like if I&#x27;m not using my abilities full-time to hack and loot smart contracts, I&#x27;m missing the most direct and best possible effort&#x2F;reward application of that kind of skill.
评论 #26889687 未加载
评论 #26890360 未加载
rob-olmos大约 4 年前
I&#x27;ve been interested in any smart contract languages&#x2F;VMs that are somehow more capable of being provably correct&#x2F;secure. The only one I&#x27;ve come across is Kadena, which internally uses the Z3 prover, but I haven&#x27;t looked into the source code in depth or if it&#x27;s able to be applied to custom smart contracts (dApp) as well.<p>Are there other blockchains that are similar? Is there a strict subset and prover for Solidity or other languages? Or things like proven smart contract kernels that can be built on top of? Eg, OpenZeppelin Contracts, but with provers rather than only audits.
评论 #26903533 未加载
评论 #26897670 未加载
ketamine__大约 4 年前
Was the issue with Fei actually a bug?
Anointmous大约 4 年前
I hate the term &quot;pentest&quot;, but apparently people who want lingo over the ability to do anything have won out over the decades. Besides being a meaningless inaccurate shortening of the phrase, an actually &quot;pen test&quot; would be part of putting a pen register on a phone. It just indicates that the newbies who created the term didn&#x27;t know anything before.