This In this blog post, we will discuss the findings from our research into the storage corruption bug that was recently discovered. After After conducting a thorough analysis, we found that the issue was not as severe as we initially thought. We determined that only a small percentage of the affected contracts could be exploited, and in most cases, only by the owner. The exploit would only cause an UI breakage and not the contract logic, meaning that it is possible to fix these exploitable contracts/dapps without needing to update the contract.
Following To automate the process for verifying all contracts in the etherscan database, we developed a modified version of the Solidity compiler that automatically detects the conditions which will trigger an error. This This led to the number of potentially vulnerable contracts being reduced to 167, which we then manually inspected for possible storage corruption. It It turned out that only 10 of these contracts were at risk of exploitation.
We managed to contact the majority of contract developers/owners and found that seven of these contracts can only be exploited by the owner. They are permitted to modify certain parameters beyond their permissible range or unlock a locked contract. The The two other contracts that were discovered to be exploitable for non-privileged user did not offer any benefits or only affected UI.
Why Why is the storage corruption bug not more widespread?
Let’s take a look at what we mean by “exploitable”:
The Storage corruption bug can be exploited if it is possible to modify a variable stored in a way that is not possible without the bug. This modification will have consequences for the behavior of the smart contract and its usage. We We do not consider the following situations to be exploitable as examples of a contract not being enforceable:
- The Regular means could allow the same account to overwrite the variable in the exact same contract state.
- The Overwrite can only be done at build time. (Note that we did not check if it had been overwritten at that point).
- The Override can only be triggered in rare situations when the contract logic has been broken (e.g. 32-bit counter increments once per block).
- Variables You can overwrite any items that are not part of the smart contract or appear non-critical but may still be part the public interface.
So This is why it is only possible to exploit the bug in so few cases or is it universally exploitable?
It It is a combination of the following factors that increases and greatly reduces the chances of being exploited.
- Since They are seldom used and small types can only be of benefit in rare situations.
- Small Types must be stored next to each other. A single large type between them will not cause an error.
- State Variables are often assigned in a sequential fashion, eliminating second-assignment fraud.
- The Combination of “address” And “bool” This is more common in the remaining cases. But, here, the address variable usually is an “owner” That is where it comes from message.sender Therefore, they are not exploitable. Even If the owner cannot be changed, the flag can often still be set by the owner through other means.
How To fix the affected contracts
The vast majority of exploitable contract are not available to the administrator, contract owner or developer. This is especially true if the function allows for changing the owner. The Exploit allows for further escalation in privileges for the owner. To To prevent the owner of the exploit from being taken advantage of, a
