{"id":12829,"date":"2023-08-18T11:10:40","date_gmt":"2023-08-18T09:10:40","guid":{"rendered":"https:\/\/affidaty.io\/blog\/?p=12829"},"modified":"2023-08-18T14:54:45","modified_gmt":"2023-08-18T12:54:45","slug":"smart-contracts-security-vulnerabilities","status":"publish","type":"post","link":"https:\/\/affidaty.io\/blog\/en\/2023\/08\/smart-contracts-security-vulnerabilities\/","title":{"rendered":"Security of Smart Contracts"},"content":{"rendered":"\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Economic Impact, Differences from Traditional Code, <strong>Vulnerabilities<\/strong>, and <strong>Security<\/strong> Measures<\/p>\n<\/blockquote>\n\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-introduction\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Smart contracts<\/strong> are revolutionizing the world of decentralized finance (DeFi), but like any new technology, they bring new <strong>security<\/strong> challenges. This article explores the economic impact of <strong>smart contract vulnerabilities<\/strong>, their differences from traditional code, the most dangerous <strong>vulnerabilities<\/strong>, and the necessary <strong>security<\/strong> measures to mitigate risks.<\/p>\n\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-numbers-and-economic-impact-of-smart-contract-vulnerabilities\">Numbers and Economic Impact of <strong>Smart Contract<\/strong> <strong>Vulnerabilities<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">According to the specialized site <a href=\"https:\/\/defillama.com\" target=\"_blank\" rel=\"noreferrer noopener\">DefiLlama<\/a>, the total value locked in decentralized finance protocols is consistently above $40 billion, a value that is relatively low compared to the peaks of over $160 billion reached before the catastrophic Terra\/Luna events and the FTX exchange crash. At the same time, we have witnessed a series of attacks on <strong>smart contracts<\/strong> that have led to the loss of millions of dollars. According to DefiLlama, the cumulative total of such losses amounts to over $6 billion. For example, in July 2023, an attack on Multichain compromised $126 million due to a compromised private key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The month of July 2023, at the time of writing this article, has been particularly prolific. Here&#8217;s a list of hacks from just the first 10 days of the month:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Arcadia: On July 10, 2023, a reentrancy attack through flash loan resulted in losses of $0.46 million.<br><br><\/li>\n\n\n\n<li>Multichain: On July 7, 2023, $126 million was compromised due to a compromised private key using an unknown method.<br><br><\/li>\n\n\n\n<li>RodeoFinance: On July 4, 2023, a reserve logic exploit led to a loss of $0.09 million.<br><br><\/li>\n\n\n\n<li>AzukiDAO: On July 3, 2023, a replay attack resulted in a loss of $0.068 million.<br><br><\/li>\n\n\n\n<li>PolyNetwork: On July 2, 2023, $5 million was compromised due to a compromised private key using an unknown method.<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These incidents highlight the importance of <strong>security<\/strong> in smart contract development and implementation.<\/p>\n\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-smart-contracts-differ-from-traditional-code\">How <strong>Smart Contracts<\/strong> Differ from Traditional Code<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Smart contracts<\/strong> differ from traditional software in various ways. While traditional software runs on a trusted computer and performs tasks based on instructions that users cannot verify, <strong>smart contracts<\/strong> offer a higher level of <strong>security<\/strong>, autonomy, and transparency. The code of a <strong>smart contract<\/strong> is generally visible and verifiable, and the data provided as input to a <strong>smart contract<\/strong> can be verified at any time and cannot be altered during transmission from the user&#8217;s computer to the blockchain network.<\/p>\n\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" src=\"data:image\/gif;base64,R0lGODlhAQABAIAAAAAAAP\/\/\/yH5BAEAAAAALAAAAAABAAEAAAIBRAA7\" data-src=\"https:\/\/affidaty.io\/blog\/wp-content\/uploads\/2023\/08\/Schermata-2023-08-18-alle-11.06.31.png\" alt=\"\" class=\"wp-image-12982 lazyload\"><noscript><img decoding=\"async\" width=\"631\" height=\"604\" src=\"https:\/\/affidaty.io\/blog\/wp-content\/uploads\/2023\/08\/Schermata-2023-08-18-alle-11.06.31.png\" alt=\"\" class=\"wp-image-12982\" srcset=\"https:\/\/affidaty.io\/blog\/wp-content\/uploads\/2023\/08\/Schermata-2023-08-18-alle-11.06.31.png 631w, https:\/\/affidaty.io\/blog\/wp-content\/uploads\/2023\/08\/Schermata-2023-08-18-alle-11.06.31-560x536.png 560w, https:\/\/affidaty.io\/blog\/wp-content\/uploads\/2023\/08\/Schermata-2023-08-18-alle-11.06.31-150x144.png 150w\" sizes=\"(max-width: 631px) 100vw, 631px\" \/><\/noscript><\/figure>\n<\/div>\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-most-dangerous-vulnerabilities-and-recurring-exploits\">The Most Dangerous <strong>Vulnerabilities<\/strong> and Recurring Exploits<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Vulnerabilities<\/strong> in <strong>smart contracts<\/strong> can have devastating consequences. An example is the 2016 attack on TheDao, due to a reentrancy bug, which resulted in the loss of millions of dollars. Other common attacks include protocol logic exploits, attacks on oracle-provided prices through flash loans, and compromise of private keys with privileged roles in the contract.<\/p>\n\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-security-measures-and-audits\"><strong>Security<\/strong> Measures and Audits<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To mitigate risks associated with smart contracts, adopting appropriate <strong>security<\/strong> measures is essential. These include writing secure code without backdoors, minimizing the use of privileged roles, and limiting updates to predefined and specific rules. Additionally, conducting thorough testing and manual and automated code inspections both within the development team and through external project teams is crucial. Despite these essential measures, it&#8217;s important to remember that no code is 100% secure, and even code inspections or external audits cannot completely eliminate the possibility of malfunction. As the old saying in computing goes:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Testing shows the presence of faults, not their absence.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In conclusion, smart contracts represent a revolutionary technology with enormous potential, but it&#8217;s crucial to address the <strong>security<\/strong> challenges they present. Institutions must maintain a high level of vigilance, but even more importantly, building awareness from the ground up through enthusiast and developer communities by sharing best practices is paramount. To this end, we are engaged with the <a href=\"https:\/\/smartcontract.tips\" target=\"_blank\" rel=\"noreferrer noopener\">Smart Contract Tips Italia <\/a>network to promote a culture of <strong>security<\/strong> in the realm of smart contracts. By understanding <strong>vulnerabilities<\/strong>, implementing appropriate <strong>security<\/strong> measures, and conducting regular audits, we can harness the opportunities offered by smart contracts while minimizing risks.<\/p>\n\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Links:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DefiLlama \u2013 <a href=\"https:\/\/defillama.com\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/defillama.com<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Smart Contract Tips Italia \u2013 <a href=\"https:\/\/smartcontract.tips\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/smartcontract.tips<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Smart Contract: minimising risks requires understanding vulnerabilities and implementing appropriate security measures.<\/p>\n","protected":false},"author":193,"featured_media":13068,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jnews-multi-image_gallery":[],"jnews_single_post":{"subtitle":"","format":"standard","video":"","gallery":"","source_name":"","source_url":"","via_name":"","via_url":"","override_template":"0","override":[{"template":"2","single_blog_custom":"","parallax":"1","fullscreen":"0","layout":"right-sidebar","sidebar":"default-sidebar","second_sidebar":"default-sidebar","sticky_sidebar":"1","share_position":"float","share_float_style":"share-normal","show_share_counter":"1","show_view_counter":"1","show_featured":"1","show_post_meta":"1","show_post_author":"1","show_post_author_image":"1","show_post_date":"1","post_date_format":"default","post_date_format_custom":"Y\/m\/d","show_post_category":"1","show_post_reading_time":"1","post_reading_time_wpm":"300","show_zoom_button":"1","zoom_button_out_step":"2","zoom_button_in_step":"3","show_post_tag":"1","show_prev_next_post":"0","show_popup_post":"1","number_popup_post":"1","show_author_box":"1","show_post_related":"1","show_inline_post_related":"0"}],"override_image_size":"0","image_override":[{"single_post_thumbnail_size":"no-crop","single_post_gallery_size":"crop-715"}],"trending_post":"0","trending_post_position":"meta","trending_post_label":"Trending","sponsored_post":"0","sponsored_post_label":"Sponsored by","sponsored_post_name":"","sponsored_post_url":"","sponsored_post_logo_enable":"0","sponsored_post_logo":"","sponsored_post_desc":"","disable_ad":"0"},"jnews_primary_category":{"id":"","hide":""},"jnews_social_meta":{"fb_title":"","fb_description":"","fb_image":"","twitter_title":"","twitter_description":"","twitter_image":""},"footnotes":""},"categories":[525],"tags":[794,170,808,183,177,812],"coauthors":[952],"class_list":["post-12829","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-real-applications-en","tag-ai-eng","tag-blockchain-en","tag-exchange-en","tag-pos-en","tag-smart-contracts-en","tag-trust"],"_links":{"self":[{"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/posts\/12829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/users\/193"}],"replies":[{"embeddable":true,"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/comments?post=12829"}],"version-history":[{"count":0,"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/posts\/12829\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/media\/13068"}],"wp:attachment":[{"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/media?parent=12829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/categories?post=12829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/tags?post=12829"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/affidaty.io\/blog\/wp-json\/wp\/v2\/coauthors?post=12829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}