Currently in the Ethereum blockbuster there are hundreds of thousands of smart contracts that manage wallets, tokens, applications or used to store funds. A group of British researchers alone was able to identify 34,200 vulnerable smart contracts, writes Motherboard.
Assistant professor from University College London Ilya Sergey and his colleagues conducted a large-scale study to detect all possible vulnerabilities of smart contracts on the blockbuster Ethereum. To do this, they downloaded the blocking Ethereum, in effect creating its fork for personal use, and began to launch a variety of scenarios, trying to achieve undesirable consequences. When these consequences came, they marked a smart contract "with a tracked vulnerability."
Analyzing about a million smart contracts in this way, the researchers found that 34,200 of them contained critical vulnerabilities. They tested their assumptions on 3,000 smart contracts, and in 89% of cases they caused the most undesirable consequences. In theory, this could allow them to steal $ 6 million in Ethereum.
![](https://steemitimages.com/DQmazvoJkYpdymD3FLpWgkgeunMuEbQtTg2VcjPnZQzxYo1/image.png)
According to experts, early detection of vulnerabilities prevents
possible negative consequences. So, for example, in November 2017, a user under the pseudonym DevOps19 found a vulnerability in the code of the Ethereum-purity library Parity and accidentally blocked $ 150 million.
"We are working with applications that have two very unpleasant features: they are used to manage your money and can not be fixed,
- explained Ilya Sergey.
Attempts to find the creators of vulnerable smart contracts were in vain. But since researchers do not say which vulnerabilities were found in smart contracts, they can be considered as safe.
"If someone wants to take advantage of our idea, he, at least, will have to do as much work as we did,
- summed up the researcher.
Recall, in January, the Cisco unit detected a number of vulnerabilities in the Ethereum-client Parity. First of all, it was about the create2 operating code, the incorrect operation of which could lead to a large-scale DoS-attack on its supporting nodes. Moreover, a number of "loopholes" in the purse software allowed access to private information.
A few days later, representatives of Parity Technologies said that the vulnerabilities were corrected in new versions of the software Ethereum-client.