Photo: ShutterstockSmart Contracts May Have Weaknesses. This Tool Helps Find Them
NRI Secure Technologies released a blockchain security monitoring service that includes a tool by ConsenSys Diligence allowing users to scan smart contracts for vulnerabilities.
November 21, 2018 at 10:30 AM
3 minute read
The original version of this story was published on Legal Tech News
Even smart contracts can be made to look foolish. Case in point: The Japan-based NRI Secure Technologies has rolled out a blockchain security monitoring service, and one of the first tools in its belt is Mythril, a smart contract security diagnosis and analysis tool proffered by ConsenSys Diligence.
Mythril was specifically designed to review smart contracts hosted on Ethereum, a blockchain-based distributive computing platform that found itself with a problem last month after hackers breached a smart contract associated with its adult entertainment offering SpankChain and absconded with $38,000.
That raises… well, several questions, really— but the most important of which may be: Can smart contracts be secured faster than they are being accepted into the mainstream? NRI sure seems to hope so.
“In the blockchain space, the smart contract is getting popular now. We wanted to launch this new service before smart contracts becomes common in blockchain space,” Teruhiro Tagomori, a security engineer at NRI, said in an email.
Smart contracts allow for an agreement to be automatically executed by a program operating on a decentralized network where all parties involved can see what's happening. They have an obvious utility in transactions related to real estate or securities settlements, but are only as secure as their least flagrant bug.
The hackers behind the SpankChain attack, for example, took advantage of a “reentrancy bug” in the smart contract that allowed them to call back into the payment channel multiple times.
“I do not think a smart contract itself has high security,” Tagomori said.
The idea behind Mythril is relatively straightforward: the product scans a smart contract and detects security risks before bad actors can, like finding and patching a hole in the roof before a storm clears the horizon.
In the case of Ethereum, it's more in the vein of patching 8,000 roofs daily, only instead of rain you're dealing with integer overflows (a type of bug that occurs when an integer exceeding the number of bytes allowed by a system's data type is placed into a computer memory).
Tagomori urges smart contract users to consider the differences between blockchain tech and more traditional web applications when thinking about security. For example, in addition to scanning all possible paths of the underlying program, one of the things that Mythril evaluates is the bytecode of the blockchain. Bytecode is the language of Ethereum, a code that is processed by a program and takes the place of source code in a smart contract.
“They need to know those [differences] well and prepare some mechanism like circuit breakers based on the premise that some vulnerabilities will be found after deploying smart contracts on public blockchain,” Tagomori said.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View All
Big Tech and Internet Companies Slammed With Consumer Class Actions in December
Where Do Web-Tracking Class Actions Belong? 8th Circuit Weighs the Issue
NLRB Bans 'Captive Audience' Meetings, Yanking Away Platform Employers Used to Combat Unionizing
Judge Splits Couple's Potential Recoupment of Punitive Damages Against eBay's Harassment Campaign
4 minute readTrending Stories
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250
