Understanding Overflow and Underflow Attacks on Smart Contracts
One of the best outcomes of blockchain is smart contracts, a computer protocol that facilitates, verifies, and sometimes implements a contract or negotiation. Some exciting uses of smart contracts are record keeping in healthcare, real estate, and property ownership, insurance, and voting systems.
Despite the preference for smart contracts, one cannot claim that it is a fully secure system. Any unexpected and unwanted elements in a smart contract can have enormous consequences. For example, a bug in a smart contract may trigger it to perform unintended tasks. This may lead to huge losses for the parties under the agreement and unwanted penalties.
Objects of a Smart Contract
These are the two or more parties using the smart contract. They use digital signatures to either agree or disagree with the terms of the agreement.
- The subject of the contract
This refers to the object that the negotiating parties are agreeing upon. These terms could be, for instance, a house, digital assets, cryptocurrency, and so on.
- Terms of the contract
These are the requirements and terms expected from each party. Additionally, this segment outlines the rules of conduct, rewards, and penalties for any misconduct while executing the agreement.
Smart contracts are majorly associated with cryptocurrencies such as Bitcoin and Ethereum. Banks and major financial organizations have been slow and cautious to accept the use of blockchain. With inventions like Quorum – from the Ethereum blockchain – which uses smart contracts while providing privacy, they are slowly becoming prominent.
The moment a smart contract is set in the blockchain and deployed, it cannot be altered or updated with security patches. As a result, developers are encouraged to ensure that the contract has robust security strategies before deployment. This, in turn, prevents any potential exploitation of vulnerabilities at a later time.
Overflow and Underflow Attacks
Overflow and underflow attacks are often classified as integer overflows. Simply put, these are errors that allow a program to revert to the start, or recalibrate.
For instance, when we turned over the new millennium, a lot of programs experienced recalibration. They were set to represent years with the prefix of 19-, such as 1994 was represented as 94. When it turned to 2000, a lot of these programs reverted to 1900 rather than go up to 2000.
Underflow attacks are more likely to occur as opposed to overflow. This is simply because underflow attacks are simpler to carry out, and achieving the tokens required for an overflow is too difficult.
Overflow Error Attacks
An overflow error attack on a smart contract occurs when more value is provided than the maximum value. When this happens, it circles back to zero, and this feature can be exploited by repeatedly invoking the feature that increases the value.
Underflow Error Attacks
This error attack operates in the exact opposite of the overflow error. Instead of exceeding the maximum value, an underflow error occurs when you go below the minimum amount. This triggers the system to bring you right back up to maximum value instead of reverting to zero.
Impact of Overflow and Underflow Attacks
Underflow errors are more likely to occur as opposed to overflows, and the outcome can be disastrous. If a program lacks the feature that checks for underflow and overflow, an attacker can get more tokens than they own. They can also get a maxed-out balance, which is essentially stealing.
These error attacks can cause the whole system to break because the amount of tokens being maxed out is not the same as the tokens in the system.
An excellent example of underflow attacks is the Proof of Weak Hands Coin, a Ponzi scheme that grew into over a million dollars. The developers failed to secure the system with defenses against overflow and underflow attacks. This then allowed a hacker to access 2000 Ether, which was valued at 2.3 million dollars.
Mitigation of Overflow and Underflow Attacks
The most recommended method of mitigating overflow and underflow attacks is the use of Open Zeppelin SafeMath Library. This checks for overflow and underflow and throws an error if any such activity is spotted on a contract.
Smart contract technology has been beneficial for parties forming agreements without the need for a middleman. It has been used in business, finance, gaming, insurance, among other sectors. Since these sectors involve flows of money and currency, the technology has also attracted hackers to exploit its weaknesses. Analysts predict that smart contracts will revolutionize what we consider normal, like banking. They even have the potential to make voting fair and secure, but the security issue cannot be ignored. Underflows and overflows constitute a significant threat to smart contracts, and their mitigation will help build trust in the use of smart contracts.