1

Currently, I am conducting a research regarding the security and privacy vulnerabilities of Quorum-based smart contracts. However, so far I've been struggling to implement attack vectors in order to demonstrate possible attacks. An overflow or reentrancy vulnerability is fairly easy to implement and exploit, but other vulnerabilities listed in the Quorum documentation (https://docs.goquorum.consensys.net/en/stable/Concepts/Security/Framework/DecentralizedApplication/SmartContractsSecurity/#common-contract-vulnerabilities) such as time manipulation are less trivial. Moreover, little academic literature regarding this topic exists. Could you please provide some tips on how to implement these kinds of attack vectors and which tools to use to this end? So far, I have set up the 7nodes example using Docker and I use Remix with the Quorum plugin in order to deploy smart contracts.

Thank you in advance.

Improve this question

1 Answer 1

Reset to default
0

Thanks for your question! As per the documentation, time manipulation is a lot more significant a risk on a private network since block time is controlled by the system time of validators. On the smart contract side of things you can find more information here in the Smart Contract Weakness registry and this section in Mastering Ethereum. Depending on the consensus protocol used, other validators may reject blocks that stretch the time too far from the current block as far as I understand it, but if it's a single leader election system like RAFT I think you could set that time however you like. Your setup seems correct to test that though, so I hope these suggestions give you some pointers!

Improve this answer
3
  • Please also check out ConsenSys' Smart Contract Best Practices here for more detail on other attacks: consensys.github.io/smart-contract-best-practices
    – Vijay Michalik
    Commented May 10, 2021 at 17:02
  • Thanks for helping out. I indeed also found the sources you mention and was planning on using RAFT to demonstrate time manipulation. However, my question that still remains is: how can I control a node (in this case the leader) in order to make it return a specific time? Are there any tools or libraries available which enable you to enforce certain behavior upon specific nodes in the network? So far, I've looked at Truffle Suite and Hardhat, although I am not yet sure if these offer the functionality that I'm looking for.
    – Cheyenne Slager
    Commented May 11, 2021 at 9:03
  • I am not aware of any standard tooling that will enable this - since the logic is at the client level you would have to modify the Go code that currently synchronises the system time with NTP, not just the smart contract code as per the SWC post. The Geth code in question is referenced here. You might be able to set up a local NTP server to effectively manipulate the recorded time.
    – Vijay Michalik
    Commented May 11, 2021 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.