Analiza napadov na pametne pogodbe osnovane na okoljih ethereum virtualnega stroja

Gal Gantar; Matevž Pesek

doi:10.31449/upinf.228

Authors

Gal Gantar Univerza v Ljubljani, Fakulteta za računalništvo in informatiko
Matevž Pesek Univerza v Ljubljani, Fakulteta za računalništvo in informatiko

DOI:

https://doi.org/10.31449/upinf.228

Keywords:

binary exploit, cyber security, Ethereum, Solidity

Abstract

Over the past decade, interest in cryptocurrencies has grown significantly. Along with this, there has been an increase in the capital locked in smart contracts, which has simultaneously heightened the risk of attacks. Preventing attacks on smart contracts requires an analysis of coding patterns and the environment in which smart contracts operate. This article examines the security of the Ethereum network and its role in the development of decentralized applications (dApps). We review the use of the Ethereum Virtual Machine (EVM), the Solidity programming language, and the compiler in the construction of smart contracts. Additionally, we describe the security challenges faced by the Ethereum ecosystem and analyze three past attacks on decentralized protocols. The article also presents a concrete example of an attack on a smart contract, exploiting a vulnerability in its implementation. The result of this article is the demonstration of a smart contract that functions correctly under normal use but contains a vulnerability that can be exploited to alter its state without authorization.

Author Biographies

Gal Gantar, Univerza v Ljubljani, Fakulteta za računalništvo in informatiko

Gal Gantar je absolvent dodiplomskega interdisciplinarnega študija računalništva in informatike. Njegovo
raziskovalno delo se osredotoča na kriptografijo, predvsem na dokaze brez razkritja znanja. Prav tako
raziskuje področja umetne inteligence, s posebnim poudarkom na globokem učenju na grafih. Strokovno je aktiven na področju razvoja decentraliziranih protokolov in pametnih pogodb.

Matevž Pesek, Univerza v Ljubljani, Fakulteta za računalništvo in informatiko

Matevž Pesek je docent in raziskovalec na Fakulteti za računalništvo in informatiko Univerze v Ljubljani, kjer je diplomiral (2012) in doktoriral (2018). Od leta 2009 je član Laboratorija za računalniško grafiko in multimedije. Od leta 2024 izvaja predmet Varnost programov.