The number of smart contract applications deployed each day in the Ethereum Blockchain is increasing every day. Fascinated by the security aspect of the newly proposed Blockchain technology. More people are trying to deploy new smart contracts in the mainnet and most of them start holding millions of dollars in the near future. However, can Ethereum smart contracts be hacked?
Ethereum smart contracts can be hacked if the deployed contract holds a vulnerability in its source code. In most cases, the impact of this hack tends to be financial losses. However, in some cases, it could reach full control over the contract.
Most of the biggest hacks that happened in the Blockchain market were due to the exploitation of a critical vulnerability in a smart contract. Therefore, in this blog post, we are going to explain in detail what are the main causes behind Ethereum smart contract hacks. Moreover, we are going to discuss some of the most known attacks that can target smart contracts. In addition, you are going to see some reel hack events that happened in the history of Ethereum smart contracts.
Like any program developed by humans, Ethereum smart contract could be vulnerable and might be hacked. The only difference here is that smart contracts can be hackable for eternity and there is nothing that can be done to fix that. This is actually the result of the immunity aspect of Blockchain smart contracts.
The second difference from the classic applications is the fact that the impact of smart contract hacks is a direct financial loss. Usually, in classic apps, the hacker tries to either get his hands on the credit cards or database and try to sell them on the Darkweb. Contrarily to classic apps smart contract hacks generally give the attacker the ability to directly withdraw the money to his wallet.
With all those disadvantages, the smart contract hacks are all traced and everyone could know who did what and when which is not always the case in classic apps. Therefore, once the attacker uses that money to buy something, he will be known and arrested.
Unfortunately, this does not mean it is always the case. New techniques are rising in the Blockchain technology to remove this ability to trace transactions, and it is actually being used by attackers to cover their tracks.
Ethereum smart contract hacks could happen due to multiple reasons. To my best knowledge, Ethereum smart contract could be hacked by either exploiting a vulnerability in the smart contract code or stealing the private keys of the contract’s owner.
In this blog post, we are going to focus more on the first technique, as it is the reason behind multiple hacks that happened in the history of Ethereum smart contracts.
Contrarily to classic applications, exploiting an Ethereum smart contract does not require technical knowledge. Most attacks could be performed by just holding a wallet with as little funds as possible to pay for the attack transaction and knowing how to interact with a smart contract. This actually increases the number of attackers for the Ethereum smart contract, which increase also the risk of possible attacks.
Most vulnerabilities that can be discovered in a smart contract could be used to drain money from it. However, in this blog post, we are going to focus on the most critical and popular ones that were actually used in some known attacks against Ethereum smart contracts.
The first vulnerability and the most popular one that can be used to hack smart contracts if they are vulnerable to it is Reentrancy. The reentrancy vulnerability happens when the Ethereum smart contract sends the money to another address before it changes its stats. In others words, it happens when the developer does not follow the standard Checks-Effects-Interactions Pattern. If successfully exploited, this vulnerability could drain all the smart contract funds.
The reentrancy vulnerability was the reason behind multiple Ethereum smart contract hacks. The most popular attack that uses this vulnerability was the famous DAO attack, which was the main reason behind Ethereum’s most known hard fork.
Unprotected dangerous functions could also be the reason behind an Ethereum smart contract hack. One of the most destructive attacks that happened against smart contracts was the famous parity Multi-sig wallet attack. In this hack, the attacker called a function that was supposed to be protected and only called by the owner of the smart contract.
This function allowed him to reinitiate the wallet smart contract to make him the new owner of the smart contract. Then, the attacker called the self-destruct function to drain all the money from that smart contract. To get more technical details about what actually did happen in terms of called function and all that stuff, I highly recommend taking a look at the blog post written by Openzeppelin team here.
In most cases, recovering stolen funds is not possible as transactions in Blockchain technology are not reversible. In some cases, a hard fork of the Blockchain could be performed to recover the stolen money. However, this is not always possible and could only be performed on newly or immature Blockchain, and it requires the okay of a big part of the Blockchain community.
Unfortunately, even this solution is not efficient as it allows recovering Ethereum cryptocurrency only and not the user’s other tokens.
You should keep in mind that anything made by humans is prone to errors. Therefore, smart contracts could also be vulnerable and could easily be exploited at any moment. The vulnerabilities and the attacks mentioned in this blog post are only some of the most popular. However, there are many other vulnerabilities that can be exploited to either steal money or simply block the smart contract from correctly working.
Therefore, if you are a developer performing a smart contract audit is necessary to secure your smart contract. Combining static and dynamic automated and manual tests are necessary to successfully detect those vulnerabilities before going to the production environment.
If you are a user of smart contract technology, think about asking for expert advice about what smart contracts you want to use before doing so. This will not make you 100% secure but, it will help you at least avoid malicious smart contracts.
I am a Cyber Security Expert, I have worked with many companies around the globe to secure their applications and their networks. I am certified OSCP and OSCE which are the most recognized and hard technical certifications in the industry of cybersecurity. I am also a Certifed Ethical hacker (CEH). I hope you enjoy my articles :).
The only things that truly do not change in a smart contract even with proxies concepts are state variables. However, not carefully using them in a smart contract could lead ...
Undoubtedly, ChatGPT stands out as one of the most remarkable inventions of 2021. Its wide-ranging capabilities and applications have opened up endless possibilities for human interaction and problem-solving. Furthermore, certain [...]
Post comments (0)