All your Ether are belong to us (a.k.a Hacking Ethereum-based DApps)

The talk opens with a short primer on blockchain: a distributed ledger protected by hashes and proof-of-work consensus, with smart contracts being code stored on-chain that anyone can read and call. It then explains how a hybrid decentralized app pairs static web files served from a normal server with a backend on Ethereum, and how a browser wallet signs transactions that are relayed through a node.

The middle section is the core of the session. A betting game that kept player choices as "private" data showed that every transaction is public, so the opponent could read the move and win. An overflow in a token sale let a purchase total wrap around to a tiny payment for a very large token balance. A reentrancy flaw in a simple deposit contract was exploited with a malicious fallback function that kept withdrawing funds in a loop until the victim contract was empty.

For fixes, the presenter recommends keeping sensitive data off-chain or encrypted, using safe math libraries or Solidity 0.8 and later, and updating balances before sending funds, plus adding a reentrancy lock. Static and dynamic tools help but cover limited ground, so manual review and reading the contract logic matter most. The Q&A covers bug bounties, which often pay in the project's own token, and upgradeable proxy patterns as a way to work around immutability.