Security of Smart Contracts

Economic Impact, Differences from Traditional Code, Vulnerabilities, and Security Measures

Introduction

Smart contracts are revolutionizing the world of decentralized finance (DeFi), but like any new technology, they bring new security challenges. This article explores the economic impact of smart contract vulnerabilities, their differences from traditional code, the most dangerous vulnerabilities, and the necessary security measures to mitigate risks.

Numbers and Economic Impact of Smart Contract Vulnerabilities

According to the specialized site DefiLlama, the total value locked in decentralized finance protocols is consistently above $40 billion, a value that is relatively low compared to the peaks of over $160 billion reached before the catastrophic Terra/Luna events and the FTX exchange crash. At the same time, we have witnessed a series of attacks on smart contracts that have led to the loss of millions of dollars. According to DefiLlama, the cumulative total of such losses amounts to over $6 billion. For example, in July 2023, an attack on Multichain compromised $126 million due to a compromised private key.

The month of July 2023, at the time of writing this article, has been particularly prolific. Here’s a list of hacks from just the first 10 days of the month:

• Arcadia: On July 10, 2023, a reentrancy attack through flash loan resulted in losses of $0.46 million.
  
  
• Multichain: On July 7, 2023, $126 million was compromised due to a compromised private key using an unknown method.
  
  
• RodeoFinance: On July 4, 2023, a reserve logic exploit led to a loss of $0.09 million.
  
  
• AzukiDAO: On July 3, 2023, a replay attack resulted in a loss of $0.068 million.
  
  
• PolyNetwork: On July 2, 2023, $5 million was compromised due to a compromised private key using an unknown method.
  

These incidents highlight the importance of security in smart contract development and implementation.

How Smart Contracts Differ from Traditional Code

Smart contracts differ from traditional software in various ways. While traditional software runs on a trusted computer and performs tasks based on instructions that users cannot verify, smart contracts offer a higher level of security, autonomy, and transparency. The code of a smart contract is generally visible and verifiable, and the data provided as input to a smart contract can be verified at any time and cannot be altered during transmission from the user’s computer to the blockchain network.

The Most Dangerous Vulnerabilities and Recurring Exploits

Vulnerabilities in smart contracts can have devastating consequences. An example is the 2016 attack on TheDao, due to a reentrancy bug, which resulted in the loss of millions of dollars. Other common attacks include protocol logic exploits, attacks on oracle-provided prices through flash loans, and compromise of private keys with privileged roles in the contract.

Security Measures and Audits

To mitigate risks associated with smart contracts, adopting appropriate security measures is essential. These include writing secure code without backdoors, minimizing the use of privileged roles, and limiting updates to predefined and specific rules. Additionally, conducting thorough testing and manual and automated code inspections both within the development team and through external project teams is crucial. Despite these essential measures, it’s important to remember that no code is 100% secure, and even code inspections or external audits cannot completely eliminate the possibility of malfunction. As the old saying in computing goes: 

“Testing shows the presence of faults, not their absence.”

In conclusion, smart contracts represent a revolutionary technology with enormous potential, but it’s crucial to address the security challenges they present. Institutions must maintain a high level of vigilance, but even more importantly, building awareness from the ground up through enthusiast and developer communities by sharing best practices is paramount. To this end, we are engaged with the Smart Contract Tips Italia network to promote a culture of security in the realm of smart contracts. By understanding vulnerabilities, implementing appropriate security measures, and conducting regular audits, we can harness the opportunities offered by smart contracts while minimizing risks.

Links: 

DefiLlama – https://defillama.com

Smart Contract Tips Italia – https://smartcontract.tips