Angriffsvektoren für Smart Contracts

Das Ziel dieses Repositories ist es, alle möglichen Schwachstellen von Smart Contracts sowie Ressourcen zu deren Erlernen zusammenzutragen.

Du kannst gern einen Pull Request einreichen, von kleinen Korrekturen bis hin zu Dokumentationen oder Tools, die du hinzufügen möchtest.

Liste der Schwachstellen

• Access Control
  • Authentication With tx.origin
  • Default Visibility
  • Signature Verification
  • Unprotected Ether Withdrawal
  • Unprotected SELFDESTRUCT Instruction
  • Missed Modifier
  • Incorrect Modifier Names
  • Overpowered Roles
• Account Existence Check for low level calls
• Arbitrary Jumps with Function Variables
• Assert Violation
• Bypass Contract Size Check
• Code With No Effects
• Complex Modifiers
• DOS
  • Unexpected Revert
  • Block Gas Limit
  • External Calls without Gas Stipends
• Dirty Higher Order Bits
• Entropy Illusion / Insecure Randomness
• Experimental Language Features
• External Contract Referencing
• Flash Loan Attacks
• Floating Point Arithmetic
• Frontend (Off Chain) Attacks_Attacks.md>)
  • Short Address Attack_Attacks.md/>)
• Force Feeding
• Function Selector Abuse
• Griefing
• Hiding Malicious Code
• Historic Attacks
  • Constructor Names
  • Call Depth Attack
  • Solidity Abi Encoder v2 Bug
• Improper Array Deletion
• Incorrect Interface
• Insufficient Gas Attacks
• Integer Arithmetic
• Loop through long arrays
• Message call with hardcoded gas amount
• Miner Attacks
  • Transaction Ordering / Frontrunning
  • Timestamp Manipulation
• Offline Owner
• Oracle Manipulation
• Outdated Compiler
• Payable Multicall
• Precision Loss in Calculations
• Privacy Illusion