智慧合約於分散式金融應用之漏洞攻擊解析與解決方案

Analysis and Solution of Exploiting Vulnerabilities of Smart Contracts in Decentralized Financial Applications

徐宛萱(Wan-Shiuan Hsu) ； 林詠章(Iuon-Chang Lin)

《資訊安全通訊》 27卷2期 (2021/05) Pp. 23-40

摘要

分散式金融於2020年後半年開始蓬勃發展，資安事件也相繼爆發，主要多與程式碼安全相關。目前各項分散式金融（DeFi）協議的技術尚未成熟，在不同應用層面的潛在風險可能在安全審計時無法被發現，未來更多結合不同協議漏洞的未知攻擊也必然會發生。本論文欲利用目前各類常見DeFi應用可能產生之漏洞進行攻擊解析，包含閃電貸、預言機、治理項目等應用，針對Unstoppable、Naive Receiver、Truster、Side Entrance、The Rewarder、Selfie、Compromised及Puppet等八種可能漏洞進行攻擊解析，進而提供智慧合約安全之撰寫或解決方式，使分散式金融項目佈署於乙太坊後能由源頭之程式碼進行安全控管，從根本減緩來自外部的攻擊。

關鍵字

智慧合約安全 ； 重入攻擊 ； 區塊鏈安全

並列摘要

Decentralized finance began to flourish after June 2020, and security incidents also broke out one after another, mostly related to code security. At present, the technology of various decentralized finance (DeFi) protocols is not yet mature, and potential risks at different application levels may not be discovered during security audits. In the future, more unknown attacks that combine different protocol vulnerabilities will inevitably occur. This paper intends to use various common DeFi applications such as flash loans, oracles, and governance projects to analyze the following vulnerabilities in a total of eight attack processes: Unstoppable, Naive Receiver, Truster, Side Entrance, The Rewarder, Selfie, Compromised, and Puppet. It also provides smart contract security writing or resolution methods for the analysis and solution of various attack vulnerabilities, so that distributed financial applications can be safely controlled by the source code after they are deployed on Ethereum, and fundamentally slow down external attacks.

並列關鍵字

Smart Contract Security ； Reentrancy ； Blockchain Security

參考文獻

L. Gudgeon, D. Perez, D. Harz, B. Livshits, and A. Gervais, "The decentralized financial crisis," in 2020 Crypto Valley Conference on Blockchain Technology (CVCBT) , 2020, pp. 1-15: IEEE.

Y. Chen and C. J. J. o. B. V. I. Bellavitis, "Blockchain disruption and decentralized finance: The rise of decentralized business models," ScienceDirect, vol. 13, p. e00151, 2020.

Defi Pulse 網站. Available: https://defipulse.com/.

Salami, Iwa. "Decentralised Finance: The Case for a Holistic Approach to Regulating the Crypto Industry." Journal of International Banking and Financial Law 35.7 (2020) : 496-499.

Bitcoin, Ethereum Avg. Transaction Fee historical chart. Available: https://bitinfocharts.com/comparison/transactionfees-btc-eth.html#6m.