Security audit of blockchain smart contract

1.

One of the characteristics of blockchain projects (especially public chains) is open source. Through open source code, to improve the credibility of the project, so that more people can participate. But the open source code also makes it easier for attackers to attack blockchain system. In the past two years, there have been a number of hacker attacks. Recently, the anonymous currency verge (xvg) was attacked again. The attacker locked a vulnerability in the xvg code, which allowed malicious miners to add false timestamps on the block, and then quickly dig out new blocks. In a few hours, the attacker obtained nearly $1.75 million worth of digital currency. Although the subsequent attack was successfully stopped, no one can guarantee whether the attacker will attack again in the future

of course, blockchain developers can also take some measures

one is to use professional code audit services,

the other is to understand the security coding specifications and take preventive measures

the security of cryptographic algorithm

with the development of quantum computer, it will bring a major security threat to the current cryptosystem. Blockchain mainly relies on elliptic curve public key encryption algorithm to generate digital signature for secure transactions. Currently, the most commonly used ECDSA, RSA, DSA, etc. can not withstand quantum attacks in theory, and there will be greater risks. More and more researchers begin to pay attention to cryptographic algorithms that can resist quantum attacks

of course, in addition to changing the algorithm, there is another way to improve the security:

refer to bitcoin's treatment of public key address to rece the potential risk of public key disclosure. As users, especially bitcoin users, the balance after each transaction is stored in a new address to ensure that the public key of the address where bitcoin funds are stored is not leaked

security of consensus mechanism

the current consensus mechanisms include proof of work (POW), proof of stake (POS), delegated proof of stake (dpos), practical Byzantine fault tolerance (pbft), etc

POW faces 51% attack. Because POW depends on computing power, when the attacker has the advantage of computing power, the probability of finding a new block will be greater than that of other nodes. At this time, the attacker has the ability to cancel the existing transaction. It should be noted that even in this case, the attacker can only modify his own transaction, but not the transaction of other users (the attacker does not have the private key of other users)

in POS, attackers can attack successfully only when they hold more than 51% token, which is more difficult than 51% computing power in pow

in pbft, when the malicious nodes are less than 1 / 3 of the total nodes, the system is secure. Generally speaking, any consensus mechanism has its own conditions. As an attacker, we also need to consider that once the attack is successful, the value of the system will return to zero. At this time, the attacker does not get any other valuable return except destruction

for the designers of blockchain projects, they should understand the advantages and disadvantages of each consensus mechanism, so as to select an appropriate consensus mechanism or design a new consensus mechanism according to the needs of the scene

security of smart contract

smart contract has the advantages of low operation cost and low risk of human intervention, but if there are problems in the design of smart contract, it may bring greater losses. In June 2016, the Dao, the most popular funding project of Ethereum, was attacked. The hacker obtained more than 3.5 million Ethereum coins, which later led to the bifurcation of Ethereum into Eth and etc

there are two aspects of the proposed measures:

one is to audit the security of smart contract, and the other is to follow the principle of smart contract security development

the security development principles of smart contract are: to be prepared for possible errors, to ensure that the code can correctly handle the bugs and vulnerabilities; Release smart contracts carefully, do well in function test and security test, and fully consider the boundary; Keep smart contracts simple; Pay attention to the threat intelligence of blockchain and check and update in time; Be clear about the characteristics of blockchain, such as calling external contracts carefully

security of digital wallet

there are three main security risks in digital wallet: first, design defects. At the end of 2014, a user lost hundreds of digital assets e to a serious random number problem (repeated r value). Second, the digital wallet contains malicious code. Third, the loss of assets caused by the loss or damage of computers and mobile phones

there are four main countermeasures:

one is to ensure the randomness of the private key

The second is to check the hash value before installing the software to ensure that the digital wallet software has not been tampered with

The third is to use cold wallet

The fourth is to back up the private key

2. Smart contract can be simply understood as a piece of code written on the blockchain, which is event driven, has dynamic state, obtains multi-party recognition, and can automatically process the information on the chain according to the preset conditions. Once an event triggers the terms in the contract, the code will be executed automatically. The biggest advantage of smart contract is to use program algorithm to replace human arbitration and contract execution
smart contract is a contract that uses computer language instead of legal language to record terms. Once it is written, it can be trusted by users. The terms of the contract cannot be changed, so the contract cannot be changed. If the procere meets the conditions, it will be carried out, and there is no human interference to ensure absolute fairness
three technical features of smart contract
● data transparency
all data on the blockchain are open and transparent, so the data processing of smart contract is also open and transparent, and any party can view its code and data at runtime
● can't tamper
all data of the blockchain itself can't be tampered, so the code of the smart contract deployed on the blockchain and the data generated by the operation can't be tampered, and the node running the smart contract doesn't have to worry about malicious modification of the code and data by other nodes
● permanent operation
the number of nodes supporting the blockchain network often reaches hundreds or even thousands. The failure of some nodes will not lead to the stop of the smart contract, and its reliability is close to permanent operation in theory, which ensures that the smart contract can be as effective as the paper contract at all times.

3. Chongqing jinwowo analyzes the role of smart contract in blockchain technology as follows:
three characteristics of smart contract in blockchain can be summed up:
1) decentralization. It doesn't rely on the centralized server and runs automatically through the network nodes
2) good trust mechanism. The crisis of trust is greatly reced, and it is not necessary to consider whether the participation is trustworthy
3) high degree of autonomy. Once the condition is triggered, the contract will be executed automatically without interference

4. The security of data in Chongqing jinwowo smart contract is as follows:
the data of smart contract can not be deleted or modified, but can only be added. The history of smart contract can be traced, and the cost of tampering with the contract or breach of contract will be very high, because its evil behavior will be forever recorded and widely known.

5. Smart contract security audit ~ if you want to talk about fame, it must be slow FOG's reputation is bigger, but their fees are also more expensive. Chain security and time security are OK. I don't know what the quotation of chain security is, but the quotation of time security is very cheap!

6. Smart contract also means "programmable contract". Bitcoin is a technology application of blockchain.

7. Mining level 13, you can mine in the college, but because the map in Xuanyuan is more difficult to dig, and it takes level 25 to see the location of the ore source, so digging Wujin is relatively better in banquan. And 6 square in Xuanyuan can also dig, but the probability is not very high. Out of 6 high probability, to wait until 27, dig 3P, that is in Xuanyuan out of 6 on a lot