Hacking Blockchain & Hacking Blockchain

Marcus J. Carey opens by arguing that security professionals will soon face blockchain payments and assets at their companies, so they need a working understanding of the technology. He explains the basics: an externally owned account is a public and private key pair that signs transactions, gas fees cap how much computation a contract can use, and hot wallets keep keys in a browser while cold wallets keep them on a hardware device. He also covers how apps reach the chain through RPC providers such as Infura, and how a wallet can be generated in code with the ethers JavaScript library.

The middle of the talk moves to development. Carey walks through Solidity concepts, including events that record data on the chain, which he suggests could support chain-of-custody records by storing evidence hashes, and modifiers that restrict who can call a function. He points to OpenZeppelin for standard contract components, the ERC token standards, Hardhat for local testing with simulated time, and Next.js for combined front-end and back-end projects. He also floats the idea of using NFTs as a login credential.

The demos cover common flaws. A contract with no withdrawal function traps deposited funds permanently. A re-entrancy bug lets an attacker call withdraw repeatedly before the balance is reset, and moving the balance update ahead of the external call prevents it. The takeaways for practitioners are to review contracts for withdrawal logic, keep private keys out of source code and in environment variables or secure storage, and test contracts before deployment. The demos ran on a simulated network with fake ether.