The four most famous international exchanges:

Binance INTL	OKX INTL	Gate.io INTL	Huobi INTL
China Line　APP DL	China Line　APP DL	China Line　APP DL	China Line　APP DL

Note: The above exchange logo is the official website registration link, and the text is the APP download link.

Speaking of smart contracts, it is actually a piece of code written on the blockchain. In a smart contract, once an event triggers the terms in the contract, the code will be automatically executed. This entire process does not require human control. In fact, many businesses in our daily life can be simplified with the help of smart contracts. Just like the insurance business, we only need to set the conditions. When the conditions are met, the contract will automatically trigger and automatically settle claims. This can not only reduce people's disputes, It can also improve the efficiency of claims settlement. However, there are also loopholes in smart contracts, so what do smart contract loopholes mean? Everyone wants to know what are the vulnerabilities of smart contracts? Now let the editor of the currency circle tell you about it.

 What does smart contract vulnerability mean?

The essence of a smart contract is a piece of code running in the blockchain network, which completes the business logic assigned by the user. Taking the tokens of the Ethereum system as an example, its business logic is token issuance and transactions. When Ethereum was originally designed, smart contracts were designed so that they could not be modified once deployed. This design may be to improve the credibility of smart contracts. But we know that as long as a program is written by humans, errors and defects will inevitably occur.

The design of Ethereum itself violates the general rules of programming, and may cause irreparable losses when there are loopholes in smart contracts. We can see that the recent smart contract vulnerabilities in the Ethereum system have had a huge impact, and some tokens have been destroyed as a result.

The current mechanism design of blockchain smart contracts in the Ethereum system, coupled with the potentially devastating impact of vulnerabilities, makes it very difficult to report and handle vulnerabilities in online smart contracts. In recent research, the 360 Code Guard team has discovered smart contract security vulnerabilities in multiple publicly traded tokens under the Ethereum system, and has reported them to the manufacturers as soon as possible, but so far the manufacturers have not responded.

For manufacturers, due to the non-modifiable nature of smart contracts, to effectively repair vulnerabilities discovered after going online, they can only choose to redeploy new contracts, which will cost a huge amount, so some manufacturers may choose not to respond. Not processed.

 What are the vulnerabilities of smart contracts?

1. Miners maliciously exploit vulnerabilities

Miners can maliciously exploit variables that exist outside the execution of smart contracts and benefit from them.

Transaction timestamp (when a new block is "mined", a corresponding timestamp will be generated locally)

2. Integer overflow and underflow

In computers, integers have a width, so they have a maximum value that can be represented. Integer overflow occurs when a number that exceeds the maximum value is stored; conversely, underflow occurs when a number that is less than the minimum value is stored.

3. Access and permission control vulnerabilities

In a public blockchain, the nature that anyone can read and write blocks in the chain determines that access and permission control are not important settings. However, with the development of blockchain technology, the network security situation is becoming more and more severe, and private chains now need to think deeply about how to establish a more secure access mechanism.

4.DDoS (Distributed Denial of Service) attack

Although blockchain can reduce some traditional DDoS attacks, this attack is still difficult to avoid. If the chain protocol does not have built-in protection measures, blockchain nodes can easily be attacked by maliciously coded smart contracts in the form of DDoS. This will cause all the resources in the network to be used to deal with these problems, eventually causing the network to collapse.

5. Reentrancy attacks

Attacks mediated by smart contracts do not always come from outside. A malicious contract can call back into the calling contract before the first function completes.

In other words, malicious contracts can be encoded into a compromised smart contract. So when the attacked contract performs the first operation, the malicious contract can interrupt the operation and then run another new function through the rollback function. Generally speaking, this operation is reentrant because it enters the calling operation of another contract before the initial call is completed.

The above content is the detailed answer of the editor of the currency circle to the two questions of what smart contract vulnerabilities mean and what are the smart contract vulnerabilities. In fact, for some security researchers, they are now facing a rather embarrassing situation, because it would be very disadvantageous for the manufacturer to disclose the details of the vulnerability before the manufacturer fixes the vulnerability. This goes against the general principle of vulnerability disclosure, but if the manufacturer delays If the vulnerability is not patched for a long time, the public will not know the existence of the vulnerability, and the risk will expand rapidly with time. Once the vulnerability breaks out, the harm will be greater and the range of people affected will be wider. Many people’s investments could be wiped out.