Blockchain Disasters Nikolay Angelov Blockchain Developer

1 000 000+ BTC 20 000 000 000$ 5 000 000+ ETH 6 500 000 000$

Where is the Problem? Blockchain is Not Aliens secure Human Mistakes

Nikolay Angelov Blockchain Trainer Software Engineer Gamer - FOR THE HORDE! Nikolay@Nikolaytech.com /ghkgk /in/Thedi www.Nikolaytech.com

Mt. Gox 7th February 2014 740,000 Bitcoins - $473 Million

Mt. Gox Started on September 2011 Hot Wallet Leaked Unencrypted Private Key

Mt. Gox Blockchain is Not Aliens secure Human Mistakes

The Parity Wallet Hack Multi-Signature wallet 153,037 ETH Stolen InitWallet Bug

The Parity Wallet Hack

The Parity Wallet Hack

The Parity Wallet Hack

The Parity Wallet Hack Blockchain is Not Aliens secure Human Mistakes

Parity Wallet Freeze Fixed and re-deployed the library contract on July 20th 2017 Using Library to save Gas

Parity Wallet Freeze On November 6th 2017

Parity Wallet Freeze “I’m a newbie and researching over that article. I ended at that contract. I triggered the kill” – devops199

Parity Wallet Freeze

Parity Wallet Freeze 587 wallets 513,774 ETH Locked

Parity Wallet Freeze Blockchain is Not Aliens secure Human Mistakes

The Dao 17th June 2016 3 600 000 ETH Stolen Leads to Fork

The Dao contract Dao { mapping (address => uint) public balances; Stores Balance contract Dao { mapping (address => uint) public balances; function deposit() public payable { balances[msg.sender] += msg.value; } function withdraw() public { require(balances[msg.sender] > 0); if (!msg.sender.call.value(balances[msg.sender])()) revert(); balances[msg.sender] = 0; Checks Balance Tries to send the money Reduces Balance

The Dao Hacker Abused Fallback contract Hacker { Holds Dao Address contract Hacker { Dao private daoContract; function() external payable { if (daoContract.balance >= msg.value) { daoContract.withdraw(); } Calls Withdraw() Again

The Dao Dao Contract Hacker Contract Balance = 10; daoContract; DrainDao() Withdraw() daoContract.Withdraw() Checks Balance Sends Money Fallback Function Sets Balance to Zero Checks Dao Balance daoContract.Withdraw()

The Dao Blockchain is Not Aliens secure Human Mistakes

Where is the Problem? Human Mistakes

“Everyone here is a target for attack. Be paranoid.” Martin Swende ETH Foundation Security lead

General Philosophy Prepare for failure Rollout carefully Keep Contracts simple

Read Best practices Consensys Best Practices Ethernaut – Be a hacker https://consensys.github.io/smart-contract-best-practices/general_philosophy/ Ethernaut – Be a hacker https://ethernaut.zeppelin.solutions/

Thanks! Nikolay Angelov Any questions? Find me @ Nikolay@Nikolaytech.com www.Nikolaytech.com /ghkgk Any questions? /in/Thedi