Enhancing Ethereum P2P Network Security through Fuzzing | Devcon SEA

[Music] hello everyone thanks for joining this talk M te F from agono Felix lab yeah let's talk about the fing on ethereum network so quick uh quick uh intro on fasting testing fting testing is a software testing method that's often more efficient than Tradition Way like unit test and n2n testing for examp example OS as F uh Google developer TOS were wildly used and found about 25,000 vulnerabilities in last year Al and uh there are some tools specifically for ethereum such as evm fer go evm lab and text F and so on uh we do a review on the on some vulnerabilities discovered by fing in Ean protocol last year uh noting that most of our areas like consensus mechanism and the evm and some of is uh smart contract however there's not no no TOS for P2P Network layer our work fils this Gap uh let's me do what we do uh first quick recap On eum Da P2P protocol the ethereum execution layer use that P2P protocol well consensus layer you relies on Le P2P our works mainly focus on d2p D PTP is a modular and the layer Network protocol for no Discovery and the session management and data transfer in our in our fing efforts we many Focus sub protocol such as disc discover for disc discover five RPX and the wear and snap uh so why we fing on p2v network uh let's take a final message as an example if we send uh F final packet directly to the Target node without prier interaction we can it's likely to be drob but if we perform a ping pong handshake first and then resend the final message we got a response this shows that that deput Protocols are correlated in a time order the sequence of message matters additionally each no State Chang dynamically based on the pr interaction so uh it's creating a huge State space this complexities make fing particularly valuable for WP allowing us to explore the extensive State space and identify vulnerabilities so how do our fast inter Works Let's uh it compes in consist so five main steps first we generate packets ACR according to the WT specifications and for meting a baseline then we introduce the variations in this package to see the how Target n handles then we send this mutate package to the Target no like gas or something and collect the response packet and the no State then we compare the response to look for any on ual Behavior like errors or crashes and we found a interesting response with flag the package and the first analyze then we select the most promoting package for the next round of fing yeah so we call this a fasing uh loop and we can in this Loop we can explore the more space and find the more vulnerabilities also we got a uh method on cross client faing because each client in WP implementation should ideally follow the same input and output rules however inconsistence can arise due to cross client le le logic flaws or difference in programming language sandling in our approach we send the same package to multiple clients such as gas Aragon R user and so on each client propose the package and produce output we then use a compare to uh compose the outputs our FAS method is not limit to any specific client it can be expand Sim simly to any e client making it adaptable for future testing on implantations that yeah that's a brief talk and research on our research if you want to more details please contact us and scan this QR code for our GitHub repo yeah thank you thank you so much Tim um I want to welcome your two colleagues for the Q&A sessions yeah this is a good question but are there any sorry the first question are there any issues found with fcy test in existing clients uh actually we are ongoing this fing so no no issues found right nowm okay there are no other but I have a question since when do you do this research when did you start how many years uh not not a long time about three or four months ago we began the fing and became our engineer and the research on the fing yeah okay then it's quite new okay another question from audience so fasing input is generated randomly or you use some some seed yeah there is some strategy for uh Genera the seed because there are some correlated and disp uh dis uh dispense on the package so we need to use seed to SM the search space yeah do you guys plan to do liap P2P fuzzing yeah that's our next step we first build our method to will check if our Strate strategy is efficient and we will do Le P2P about three months later maybe and the next one which client produce the most different output yeah let like first question we are in our our way yeah we still have more time in case someone has more questions since there's uh how long is um I think the next one is comparison to automatic or you manually check for inconsistencies uh sorry is comparison tool automatic or you manually check for inconsistencies yeah it's automatically uh because there are some feature on uh inconsist inconsistence like crash or uh disorder on sequence yeah um our time is up but I mean the three gentlemen they're here so in case you have more questions you're more than welcome to answer them off stage and for me it's my it's the end of my mcing for today it was a pleasure hosting you and um I welcome my other MC to take over for the evening session