References of "Ferreira Torres, Christof 50014996"
     in
Bookmark and Share    
Full Text
Peer Reviewed
See detailConFuzzius: A Data Dependency-Aware Hybrid Fuzzer for Smart Contracts
Ferreira Torres, Christof UL; Iannillo, Antonio Ken UL; Gervais, Arthur et al

in European Symposium on Security and Privacy, Vienna 7-11 September 2021 (2021, September)

Smart contracts are Turing-complete programs that are executed across a blockchain. Unlike traditional programs, once deployed, they cannot be modified. As smart contracts carry more value, they become ... [more ▼]

Smart contracts are Turing-complete programs that are executed across a blockchain. Unlike traditional programs, once deployed, they cannot be modified. As smart contracts carry more value, they become more of an exciting target for attackers. Over the last years, they suffered from exploits costing millions of dollars due to simple programming mistakes. As a result, a variety of tools for detecting bugs have been proposed. Most of these tools rely on symbolic execution, which may yield false positives due to over-approximation. Recently, many fuzzers have been proposed to detect bugs in smart contracts. However, these tend to be more effective in finding shallow bugs and less effective in finding bugs that lie deep in the execution, therefore achieving low code coverage and many false negatives. An alternative that has proven to achieve good results in traditional programs is hybrid fuzzing, a combination of symbolic execution and fuzzing. In this work, we study hybrid fuzzing on smart contracts and present ConFuzzius, the first hybrid fuzzer for smart contracts. ConFuzzius uses evolutionary fuzzing to exercise shallow parts of a smart contract and constraint solving to generate inputs that satisfy complex conditions that prevent evolutionary fuzzing from exploring deeper parts. Moreover, ConFuzzius leverages dynamic data dependency analysis to efficiently generate sequences of transactions that are more likely to result in contract states in which bugs may be hidden. We evaluate the effectiveness of ConFuzzius by comparing it with state-of-the-art symbolic execution tools and fuzzers for smart contracts. Our evaluation on a curated dataset of 128 contracts and a dataset of 21K real-world contracts shows that our hybrid approach detects more bugs than state-of-the-art tools (up to 23%) and that it outperforms existing tools in terms of code coverage (up to 69%). We also demonstrate that data dependency analysis can boost bug detection up to 18%. [less ▲]

Detailed reference viewed: 33 (3 UL)
Full Text
Peer Reviewed
See detailHigh-Frequency Trading on Decentralized On-Chain Exchanges
Zhou, Liyi; Qin, Kaihua; Ferreira Torres, Christof UL et al

in IEEE Symposium on Security and Privacy, 23-27 May 2021 (2021)

Decentralized exchanges (DEXs) allow parties to participate in financial markets while retaining full custody of their funds. However, the transparency of blockchain-based DEX in combination with the ... [more ▼]

Decentralized exchanges (DEXs) allow parties to participate in financial markets while retaining full custody of their funds. However, the transparency of blockchain-based DEX in combination with the latency for transactions to be processed, makes market-manipulation feasible. For instance, adversaries could perform front-running — the practice of exploiting (typically non-public) information that may change the price of an asset for financial gain. In this work we formalize, analytically exposit and empirically evaluate an augmented variant of front- running: sandwich attacks, which involve front- and back-running victim transactions on a blockchain-based DEX. We quantify the probability of an adversarial trader being able to undertake the attack, based on the relative positioning of a transaction within a blockchain block. We find that a single adversarial trader can earn a daily revenue of over several thousand USD when performing sandwich attacks on one particular DEX — Uniswap, an exchange with over 5M USD daily trading volume by June 2020. In addition to a single-adversary game, we simulate the outcome of sandwich attacks under multiple competing adversaries, to account for the real-world trading environment. [less ▲]

Detailed reference viewed: 39 (1 UL)
Full Text
Peer Reviewed
See detailFrontrunner Jones and the Raiders of the Dark Forest: An Empirical Study of Frontrunning on the Ethereum Blockchain
Ferreira Torres, Christof UL; Camino, Ramiro; State, Radu UL

in USENIX Security Symposium, Virtual 11-13 August 2021 (2021)

Ethereum prospered the inception of a plethora of smart contract applications, ranging from gambling games to decentralized finance. However, Ethereum is also considered a highly adversarial environment ... [more ▼]

Ethereum prospered the inception of a plethora of smart contract applications, ranging from gambling games to decentralized finance. However, Ethereum is also considered a highly adversarial environment, where vulnerable smart contracts will eventually be exploited. Recently, Ethereum's pool of pending transaction has become a far more aggressive environment. In the hope of making some profit, attackers continuously monitor the transaction pool and try to frontrun their victims' transactions by either displacing or suppressing them, or strategically inserting their transactions. This paper aims to shed some light into what is known as a dark forest and uncover these predators' actions. We present a methodology to efficiently measure the three types of frontrunning: displacement, insertion, and suppression. We perform a large-scale analysis on more than 11M blocks and identify almost 200K attacks with an accumulated profit of 18.41M USD for the attackers, providing evidence that frontrunning is both, lucrative and a prevalent issue. [less ▲]

Detailed reference viewed: 103 (0 UL)
Full Text
Peer Reviewed
See detailThe Eye of Horus: Spotting and Analyzing Attacks on Ethereum Smart Contracts
Ferreira Torres, Christof UL; Iannillo, Antonio Ken UL; Gervais, Arthur et al

in International Conference on Financial Cryptography and Data Security, Grenada 1-5 March 2021 (2021)

Detailed reference viewed: 38 (5 UL)
Full Text
Peer Reviewed
See detailA Data Science Approach for Honeypot Detection in Ethereum
Camino, Ramiro Daniel UL; Ferreira Torres, Christof UL; Baden, Mathis UL et al

in 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC) (2020, August 17)

Detailed reference viewed: 60 (3 UL)
Full Text
Peer Reviewed
See detailTowards Usable Protection Against Honeypots
Ferreira Torres, Christof UL; Steichen, Mathis UL; State, Radu UL

in IEEE International Conference on Blockchain and Cryptocurrency, Toronto, Canada 3-6 May 2020 (2020)

The Ethereum blockchain enables the execution of so-called smart contracts. These are programs that facilitate the automated transfer of funds according to a given business logic without the participants ... [more ▼]

The Ethereum blockchain enables the execution of so-called smart contracts. These are programs that facilitate the automated transfer of funds according to a given business logic without the participants requiring to trust one another. However, recently attackers started using smart contracts to lure users into traps by deploying contracts that pretend to give away funds but in fact contain hidden traps. This new type of scam is commonly referred to as honeypots. In this paper, we propose a system that aims to protect users from falling into these traps. The system consists of a plugin for MetaMask and a back-end service that continuously scans the Ethereum blockchain for honeypots. Whenever a user is about to perform a transaction through MetaMask, our plugin sends a request to the back-end and warns the user if the target contract is a honeypot. [less ▲]

Detailed reference viewed: 67 (4 UL)
Full Text
Peer Reviewed
See detailÆGIS: Shielding Vulnerable Smart Contracts Against Attacks
Ferreira Torres, Christof UL; Steichen, Mathis UL; Norvill, Robert UL et al

in Proceedings of the 15th ACM Asia Conference on Computer and Communications Security (ASIA CCS ’20), October 5–9, 2020, Taipei, Taiwan (2020)

In recent years, smart contracts have suffered major exploits, cost- ing millions of dollars. Unlike traditional programs, smart contracts are deployed on a blockchain. As such, they cannot be modified ... [more ▼]

In recent years, smart contracts have suffered major exploits, cost- ing millions of dollars. Unlike traditional programs, smart contracts are deployed on a blockchain. As such, they cannot be modified once deployed. Though various tools have been proposed to detect vulnerable smart contracts, the majority fails to protect vulnera- ble contracts that have already been deployed on the blockchain. Only very few solutions have been proposed so far to tackle the issue of post-deployment. However, these solutions suffer from low precision and are not generic enough to prevent any type of attack. In this work, we introduce ÆGIS, a dynamic analysis tool that protects smart contracts from being exploited during runtime. Its capability of detecting new vulnerabilities can easily be extended through so-called attack patterns. These patterns are written in a domain-specific language that is tailored to the execution model of Ethereum smart contracts. The language enables the description of malicious control and data flows. In addition, we propose a novel mechanism to streamline and speed up the process of managing attack patterns. Patterns are voted upon and stored via a smart contract, thus leveraging the benefits of tamper-resistance and transparency provided by the blockchain. We compare ÆGIS to current state-of-the-art tools and demonstrate that our solution achieves higher precision in detecting attacks. Finally, we perform a large-scale analysis on the first 4.5 million blocks of the Ethereum blockchain, thereby confirming the occurrences of well reported and yet unreported attacks in the wild. [less ▲]

Detailed reference viewed: 214 (9 UL)
Full Text
Peer Reviewed
See detailWhispering Botnet Command and Control Instructions
Steichen, Mathis UL; Ferreira Torres, Christof UL; Fiz Pontiveros, Beltran UL et al

in 2nd Crypto Valley Conference on Blockchain Technology, Zug 24-26 June 2019 (2019, June 25)

Detailed reference viewed: 122 (0 UL)
Full Text
Peer Reviewed
See detailThe Art of The Scam: Demystifying Honeypots in Ethereum Smart Contracts
Ferreira Torres, Christof UL; Steichen, Mathis UL; State, Radu UL

in USENIX Security Symposium, Santa Clara, 14-16 August 2019 (2019)

Modern blockchains, such as Ethereum, enable the execution of so-called smart contracts - programs that are executed across a decentralised network of nodes. As smart contracts become more popular and ... [more ▼]

Modern blockchains, such as Ethereum, enable the execution of so-called smart contracts - programs that are executed across a decentralised network of nodes. As smart contracts become more popular and carry more value, they become more of an interesting target for attackers. In the past few years, several smart contracts have been exploited by attackers. However, a new trend towards a more proactive approach seems to be on the rise, where attackers do not search for vulnerable contracts anymore. Instead, they try to lure their victims into traps by deploying seemingly vulnerable contracts that contain hidden traps. This new type of contracts is commonly referred to as honeypots. In this paper, we present the first systematic analysis of honeypot smart contracts, by investigating their prevalence, behaviour and impact on the Ethereum blockchain. We develop a taxonomy of honeypot techniques and use this to build HoneyBadger - a tool that employs symbolic execution and well defined heuristics to expose honeypots. We perform a large-scale analysis on more than 2 million smart contracts and show that our tool not only achieves high precision, but is also highly efficient. We identify 690 honeypot smart contracts as well as 240 victims in the wild, with an accumulated profit of more than $90,000 for the honeypot creators. Our manual validation shows that 87% of the reported contracts are indeed honeypots. [less ▲]

Detailed reference viewed: 146 (13 UL)
Full Text
Peer Reviewed
See detailÆGIS: Smart Shielding of Smart Contracts
Ferreira Torres, Christof UL; Steichen, Mathis UL; Norvill, Robert UL et al

Poster (2019)

In recent years, smart contracts have suffered major exploits, losing millions of dollars. Unlike traditional programs, smart contracts cannot be updated once deployed. Though various tools were pro ... [more ▼]

In recent years, smart contracts have suffered major exploits, losing millions of dollars. Unlike traditional programs, smart contracts cannot be updated once deployed. Though various tools were pro- posed to detect vulnerable smart contracts, they all fail to protect contracts that have already been deployed on the blockchain. More- over, they focus on vulnerabilities, but do not address scams (e.g., honeypots). In this work, we introduce ÆGIS, a tool that shields smart contracts and users on the blockchain from being exploited. To this end, ÆGIS reverts transactions in real-time based on pat- tern matching. These patterns encode the detection of malicious transactions that trigger exploits or scams. New patterns are voted upon and stored via a smart contract, thus leveraging the benefits of tamper-resistance and transparency provided by blockchain. By allowing its protection to be updated, the smart contract acts as a smart shield. [less ▲]

Detailed reference viewed: 43 (4 UL)
Full Text
Peer Reviewed
See detailOsiris: Hunting for Integer Bugs in Ethereum Smart Contracts
Ferreira Torres, Christof UL; Schütte, Julian; State, Radu UL

in 34th Annual Computer Security Applications Conference (ACSAC ’18), San Juan, Puerto Rico, USA, December 3-7, 2018 (2018, December)

The capability of executing so-called smart contracts in a decentralised manner is one of the compelling features of modern blockchains. Smart contracts are fully fledged programs which cannot be changed ... [more ▼]

The capability of executing so-called smart contracts in a decentralised manner is one of the compelling features of modern blockchains. Smart contracts are fully fledged programs which cannot be changed once deployed to the blockchain. They typically implement the business logic of distributed apps and carry billions of dollars worth of coins. In that respect, it is imperative that smart contracts are correct and have no vulnerabilities or bugs. However, research has identified different classes of vulnerabilities in smart contracts, some of which led to prominent multi-million dollar fraud cases. In this paper we focus on vulnerabilities related to integer bugs, a class of bugs that is particularly difficult to avoid due to some characteristics of the Ethereum Virtual Machine and the Solidity programming language. In this paper we introduce Osiris – a framework that combines symbolic execution and taint analysis, in order to accurately find integer bugs in Ethereum smart contracts. Osiris detects a greater range of bugs than existing tools, while providing a better specificity of its detection. We have evaluated its performance on a large experimental dataset containing more than 1.2 million smart contracts. We found that 42,108 contracts contain integer bugs. Be- sides being able to identify several vulnerabilities that have been reported in the past few months, we were also able to identify a yet unknown critical vulnerability in a couple of smart contracts that are currently deployed on the Ethereum blockchain. [less ▲]

Detailed reference viewed: 410 (19 UL)
Full Text
Peer Reviewed
See detailInvestigating Fingerprinters and Fingerprinting-Alike Behaviour of Android Applications
Ferreira Torres, Christof UL; Jonker, Hugo

in 23rd European Symposium on Research in Computer Security, Barcelona, Spain, September 3-7, 2018 (2018)

Detailed reference viewed: 108 (6 UL)
Full Text
Peer Reviewed
See detailTackling the IFP Problem with the Preference-Based Genetic Algorithm
Nielsen, Sune Steinbjorn UL; Ferreira Torres, Christof UL; Danoy, Grégoire UL et al

in Proceedings of the Genetic and Evolutionary Computation Conference 2016 (2016)

Detailed reference viewed: 177 (28 UL)
Full Text
Peer Reviewed
See detailThe Fréchet/Manhattan distance and the trajectory anonymisation problem
Ferreira Torres, Christof UL; Trujillo Rasua, Rolando UL

in Proceedings of Data and Applications Security and Privacy - 30th Annual IFIP WG 11.3 Conference (DBSec 2016) (2016)

Detailed reference viewed: 120 (10 UL)
Full Text
Peer Reviewed
See detailPreference-Based Genetic Algorithm for Solving the Bio-Inspired NK Landscape Benchmark
Ferreira Torres, Christof UL; Nielsen, Sune Steinbjorn UL; Danoy, Grégoire UL et al

in 7th European Symposium on Computational Intelligence and Mathematics (ESCIM) (2015, October)

Detailed reference viewed: 132 (28 UL)
Full Text
Peer Reviewed
See detailFP-Block: Usable Web Privacy by Controlling Browser Fingerprinting
Ferreira Torres, Christof UL; Jonker, Hugo; Mauw, Sjouke UL

in Pernul, Günther; Y A Ryan, Peter; Weippl, Edgar (Eds.) Computer Security -- ESORICS 2015 (2015)

Online tracking of users is used for benign goals, such as detecting fraudulent logins, but also to invade user privacy. We posit that for non-oppressed users, tracking within one website does not have a ... [more ▼]

Online tracking of users is used for benign goals, such as detecting fraudulent logins, but also to invade user privacy. We posit that for non-oppressed users, tracking within one website does not have a substantial negative impact on privacy, while it enables legitimate benefits. In contrast, cross-domain tracking negatively impacts user privacy, while being of little benefit to the user. Existing methods to counter fingerprint-based tracking treat cross-domain tracking and regular tracking the same. This often results in hampering or disabling desired functionality, such as embedded videos. By distinguishing between regular and cross-domain tracking, more desired functionality can be preserved. We have developed a prototype tool, FP-Block, that counters cross-domain fingerprint-based tracking while still allowing regular tracking. FP-Block ensures that any embedded party will see a different, unrelatable fingerprint for each site on which it is embedded. Thus, the user’s fingerprint can no longer be tracked across the web, while desired functionality is better preserved compared to existing methods. [less ▲]

Detailed reference viewed: 336 (5 UL)