Smart Contract Security 101: What and Why

The presentation is about the smart contract security.

Transcript

1. SMART CONTRACT SECURITY 101 What and Why Why Web3 is getting hacked?
2. Krunal Savaliya ABOUT ME Security Engineer - AppSec at Micron Technology by Day Researcher by Night 4+ years of experience in Application Security Play piano sometimes
3. AGENDA Blockchain Fundamentals 1 Ethereum Architecture 2 What are Smart Contracts 3 Why Smart Contract Security Matters 4 Real-World Exploits & Vulnerabilities 5 Key Takeaways 6 References & Resources 7
4. WHAT IS BLOCKCHAIN? Distributed Digital Ledger that records transactions across multiple computers. No central authority Cryptographically secured Everyone holds a copy
5. CORE PROPERTIES OF BLOCKCHAIN No single point of failure Thousands of nodes Hard to censor Decentralization Hash-linked blocks History cannot be changed Requires consensus Immutability Public transactions Full audit trail Anyone can verify Transparncy
7. ETHEREUM PROTOCOL Create Turing complete blockchain allow users to perform functions via code. Build applications such as DeFi, DAOs, NFTs, etc. ether → currency Ethereum → Protocol
8. ETHEREUM VIRTUAL MACHINE (EVM) Decentralized virtual machine Executes smart contracts Deterministic execution Isolated environment
9. Proof Of Stake (PoS) Consensus & Gas Fees Miner/Validators: stake 32 ETH to participate in block production. They will get selected randomly to validate blocks. Gas Fees: It measures computational work required to complete transaction on ethereum. Validators earn gas fees in ETH.
10. WHAT ARE SMART CONTRACTS? Self-executing programs when predefined conditions are met. Deployed and run on blockchain Handle real value - cryptocurrencies, tokens, NFTs and other digital assets. Immutable once deployed - code cannot be change.
11. WHY THEY ARE DANGEROUS? Code is public Code is immutable Directly manages money Adversarial Environment
12. WHY SMART CONTRACT SECURITY MATTERS?
14. Access Control & Infrastructure Issues $3.6B Total Losses (2025) Across DeFi/Crypto Space 134+ Total Security Incidents 83% losses only from these issues Source: CredShields 2025 Report*
15. Where are Vulnerabilities.....
16. Smart Contract Vulnerabilities Understanding the Attack Surface
17. Malicious Contract calls external vulnerable contract External contract calls back State not updated yet Funds drained REENTRANCY ATTACK 1. Attacker deposits funds → 2. Calls withdraw → 3. Contract sends ETH → 4. Attacker's fallback triggers → 5. Re-enters withdraw → 6. Balance not yet updated → 7. Repeat until drained
18. THE INFAMOUS DAO HACK (2016) In 2016, decentralized investment fund based on smart contract got hacked. 3.6M ETH stolen ($60M at that time) - 5.6% of all ETH in circulation Vulnerability: Reentrancy in `withdraw` function Hard fork in ETH and ETH Classic
19. HOW TO FIX REENTRNACY? Follow CEI Pattern, a.Checks b.Effects c.Interaction Use OpenZeppelin’s reentrancyguard contract Use modifier as reentrancy guard
20. Solidity has fixed size integers INTEGER OVERFLOW & UNDERFLOW Overflow `uint8: 255 + 1 = 0` → Wraps to min Underflow `uint8: 0 - 1 = 255` → Wraps to max
21. TRUEBIT PROTOCOL HACK (JAN, 2026) Decentralized off-chain computation marketplace Native token TRU, for minting and burning (with ETH) $26.44M stolen No Overflow Protection Attacker called → getPurchasePrice() with large input → ETH to mint TRU tokens → returns 0 → mint() → attacker received → TRU tokens → paid 0 ETH to contract → Immediately → burn() → received ETH
22. HOW TO FIX UNDERFLOW/OVERFLOW? Use Solidity version 0.8+ (built-in automatic checks) Use SafeMath lib (pre-0.8)
23. Missing or improper access control leads to, Privileged functions access Minting tokens Draining funds 58% of hacks in 2025 → Access control issue. ACCESS CONTROL VULNERABILITY
24. PARITY WALLET FREEZE (2017) Library contract was not initialized Anyone could own library Self-destruct allowed Funds frozen - deleted the library 500k ETH loss
25. HOW TO FIX ACCESS CONTROL VULNERABILITY? Implement Role-Based Access Control (RBAC) Use Established Libraries (Ownable / AccessControl) from Openzepplin Multi-Signature Authorization for Critical Actions Secure Initialization & Ownership Patterns
26. KEY TAKEAWAYS Smart contracts are fundamentally different from Web2 High stakes, zero margin for error Access control is critical Security is a design principle Defense in Depth wins
27. References & Resources https://masteringethereum.xyz/ https://www.evm.codes/ https://ethereum.org/content/whitepaper/whitepaper-pdf/Ethereum_Whitepaper_- _Buterin_2014.pdf https://docs.soliditylang.org/en/v0.8.30/ https://blog.chain.link/reentrancy-attacks-and-the-dao-hack/ https://rekt.news/truebit-rekt https://www.openzeppelin.com/news/parity-wallet-hack-reloaded https://updraft.cyfrin.io/
28. THANK YOU Hack the Planet!!!