Tsaro na Kwantirago a DeFi: Kuskuren da Aka Fi Samu da Yadda Ake Gujewa Su

Kafin mu shiga cikin raunin fasaha, yana da kyau koyaushe a tabbatar cewa ayyukan kasuwancin ka na asali suna kan dandalin da aka tabbatar. Zaka ku duba sabbin farashi da motsi na kayan aiki daban-daban a shafin Exbix Markets .

Part 2: Rashin Tsaro na Kwantiragin Smart da Hanyoyin Da Ake Amfani Da Su

Mu raba mafi yawan nau'ikan rashin tsaro da suka haifar da manyan asarar a cikin DeFi.

1. Harin Reentrancy: Babban Satar

Harin reentrancy shine shahararren raunin kwangilar fasaha, wanda aka nuna sosai ta hanyar harin DAO a 2016, wanda ya haifar da asarar ETH miliyan 3.6 da kuma wani babban fork na Ethereum a gaba.

• Menene shi? Harin reentrancy ya faru ne lokacin da kwangila mai cutarwa ta kira kwangilar da ta kira kafin a kammala aiwatar da aikin farko. Wannan na iya ba wa mai kutse damar janye kudade a maimakon kafin a sabunta asusunsa.
• Yadda yake aiki:
  1. Kwangilar A tana da withdraw() aikin da ke tura ETH ga mai amfani da sa sabunta ma'aunin cikin mai amfani.
  2. Kwantaragin Mai Harin B yana kira withdraw().
  3. Kwantaragin A yana tura ETH zuwa Kwantaragin B.
  4. Kwantaragin B yana da fallback() aiki (wanda ke karɓar ETH) wanda nan da nan yake kira withdraw() a cikin Kwantaragin A sake.
  5. Kwantaragin A bai har yanzu ba a sabunta ma'aunin mai kai hari ba, don haka yana ganin cewa Kwantirakt B har yanzu yana da hakkin karɓar ƙarin ETH kuma yana aikawa da shi sake.
  6. Wannan zagaye yana ci gaba, yana draining Kwantirakt A, har sai gas ɗin ma'amala ya ƙare ko kwantirakt ɗin ya zama fanko.
• Misali Shahararre: Fashin DAO (2016).
• Yadda Ake Gujewa Shi:
  • Yi amfani da tsarin Checks-Effects-Interactions: Wannan shine ka'idar zinariya. Ko da yaushe:
    1. Dubawa duk sharuɗɗan (misali, require(balances[msg.sender] >= amount);).
    2. Sabunta duk canje-canje na cikin gida (effects) (misali, balances[msg.sender] -= amount;).
    3. Sa'an nan, yi mu'amala da sauran kwangiloli ko EOAs (mu'amaloli) (misali, msg.sender.call{value: amount}("");).
  • Yi Amfani da Kariya daga Maido: OpenZeppelin yana bayar da ReentrancyGuard modifier wanda ke kulle wata hanya yayin da ake aiwatar da ita, yana hana kiran maimaitawa.

2. Hare-haren Kariya na Oracle

Kwantaragani masu wayo suna buƙatar bayanai na duniya. Oracles sune sabis da ke bayar da wannan bayanin. Canza farashin da oracle ke bayarwa shine babban hanyar kai hari.

• Menene shi? Mai kai hari yana canza farashin wani abu a kasuwar musayar da ba ta da ruwa (DEX) tare da ƙarancin ruwa don yaudara oraclen na'ura ta hanyar bayar da rahoton farashi mara kyau.
• Yadda yake aiki:
  1. Wani tsarin bayar da rance yana amfani da farashin kasuwa na DEX a matsayin oraclen sa don tantance yawan da za a iya aro bisa ga jari.
  2. Wani mai kai hari yana daukar rancen gaggawa don cire ruwa daga wani hadin gwiwa, misali, ABC/ETH, yana mai sa shi zama mara ruwa sosai.
  3. Mai hari ya canza kadan daga ABC don motsa farashinsa da yawa a kan tazara mara ruwa yanzu.
  4. Oracle na tsarin yana karanta wannan farashin da aka yi wa zamba.
  5. Mai hari yana amfani da ABC da aka inflata a hankali a matsayin jari don aro babban adadin wasu kadarorin da ba a yi wa zamba ba daga tsarin.
  6. Mai hari yana biya bashin gaggawa, kuma farashin ABC
  ya gyara kansa, amma tsarin yana barin kayan aiki marasa amfani da babban bashi mara kyau.
• Misalan Shahararru: Harshen Farm hack ($34 miliyan da aka rasa), lamari na DAI na Compound.
• Yadda Ake Gujewa Shi:
  • Yi Amfani da Oracles Masu Tsari: Yi amfani da hanyoyin oracle masu karfi kamar Chainlink, wanda tara bayanai daga nodes da yawa masu zaman kansu da hanyoyin, wanda ke sa su zama masu wahala da tsada don sarrafawa.
  • Yi Amfani da Farashin Matsakaicin Lokaci (TWAPs): Amfani da matsakaicin farashi a cikin wani lokaci (misali, mintuna 30) maimakon farashin gaggawa yana sa sarrafa gajeren lokaci ya zama mara riba.
  • Yi Amfani da Hanyoyin Bayani da yawa: Kada dogara da ruwa na DEX guda ɗaya don samun muhimmin bayanin farashi.

3. Ƙarfin Integer da Ƙarancin Integer

Na'urorin kwamfuta suna da iyaka akan yadda babban lamba zai iya kasancewa. Wani uint256 (lamba mara alamar) a cikin Solidity yana da mafi girman ƙima na 2^256 - 1.

• Menene shi?
  • Overflow: Lokacin da wani aiki (kamar ƙara) ya haifar da lamba mafi girma fiye da ƙimar mafi girma, yana “daukar juyawa” zuwa lamba mai ƙanƙanta sosai.
  • Underflow: Lokacin da wani aiki (kamar ragewa) ya haifar da lamba mai ƙasa da sifili (ga lambobin da ba su da alamar ƙasa, waɗanda ba za su iya zama maras kyau ba), yana juyawa zuwa lamba mai girma sosai.
  number.
• Yadda ake aiki:
  • Wani ma'auni na 100 tokens. Mai amfani yana kashe 101. Lissafin 100 - 101 zai yi ƙarancin ƙima, wanda zai haifar da ma'auni na 2^256 - 1, yana ba mai amfani damar samun ma'auni mai kusan mara iyaka.
• Yadda za a guje wa It:
  • Yi amfani da Solidity 0.8.x ko daga baya: Mai fassara yana duba ta atomatik don karuwa/raguwa kuma yana dawo da ma'amaloli inda suka faru.
  • Yi amfani da SafeMath don tsofaffin masu fassara: OpenZeppelin SafeMath ɗin yana ba da ayyuka don tsaro a cikin lissafi kafin v0.8.

4. Kurakurai Ikon