or
or
By clicking below, you agree to our terms of service.
Sign in with Wallet
New to HackMD? Sign up
| Syntax | Example | Reference | |
|---|---|---|---|
| # Header | Header | 基本排版 | |
| - Unordered List |
|
||
| 1. Ordered List |
|
||
| - [ ] Todo List |
|
||
| > Blockquote | Blockquote |
||
| **Bold font** | Bold font | ||
| *Italics font* | Italics font | ||
| ~~Strikethrough~~ | |||
| 19^th^ | 19th | ||
| H~2~O | H2O | ||
| ++Inserted text++ | Inserted text | ||
| ==Marked text== | Marked text | ||
| [link text](https:// "title") | Link | ||
|  | Image | ||
| `Code` | Code |
在筆記中貼入程式碼 | |
| ```javascript var i = 0; ``` |
|
||
| :smile: |  |
Emoji list | |
| {%youtube youtube_id %} | Externals | ||
| $L^aT_eX$ | LaTeX | ||
| :::info This is a alert area. ::: |
This is a alert area. |
On a scale of 0-10, how likely is it that you would recommend HackMD to your friends, family or business associates?
Please give us some advice and help us improve HackMD.
Syncing
xxxxxxxxxx-
Any changes
Be notified of any changes
-
Mention me
Be notified of mention me
-
Unsubscribe
Subscribe金錢樂高遊戲的潛在風險：從 DeFi 攻擊事件簿中可以學到什麼？ - Charles
tags:
COSCUP2020入門TR413-1歡迎來到 https://hackmd.io/@coscup/2020 共筆
- The image file may be corrupted
- The server hosting the image is unavailable
- The image path is incorrect
- The image format is not supported
Learn More →點擊本頁上方的 開始用 Markdown 一起寫筆記！
手機版請點選上方 按鈕展開議程列表。
Slides
DeFi x Security
了解原理後防止再次發生 secuirty issue
Type1: Re-entrancy Attack
smart contact's race confition issue
variable handle problem
How to defense?
可以使用現有的 library
Type2: Flash Loan
相關的 document 不夠完備
Flash lender and borrower
AAVE protocol
案例
bZx hack
Flash attacker will be the new normal
因為可以快速且可以獲得大量的資金，所以攻擊變得容易
How to defense?
因為 Flash Loan 不是 bug，而是邏輯上的問題
避免單一 tx 內，大量資金操作後被revert掉所造成的價差
Type3: Front Running
競爭交易順序
Class of Front Running
Priority Gas Auction
拍賣競標 Gas Price 的行為
Arbitrage market price
Bot profit
參考論文
MEV
Miner-extractable value
What if MEV > block reard?
挖礦獎勵變少，交易手續價值提高
How to defense
要從 protocol 方面下手
要更動 protocol 沒有這麼快，
但還是可以從 commit-reveal 下手。（可以使用既有的 library）
Summary
樂高疊下去有可能有新的風險
Permissionless 下的安全隱憂：