Gdebordeaux's Blog

The Concept:

• Slither was created by Trails Of Bits https://www.trailofbits.com/
• It is an open-source static analysis framework for Solidity smart contracts, written in Python 3.
• It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses.

The Opportunity:

• As I was learning  as a Decentralized Consensus Fellow at Insight Data Science, I decided to help an open-source project.
• After researching and comparing static analysis tools for smart contracts, Slither seemed to be the best and the most promising, as it is both a tool and a framework.
• https://github.com/crytic/slither

The Potential:

• A popular story from the 70’s describes a programmer who altered a program at a bank and moved fractions of a cent from every transaction to another account.
  • In 1988, a former bank employee in Canada stole $70,000 using this type of attack.
  • It is called the Salami attack. Salami attack is when small amounts are systematically acquired from large number of sources. They exist just below the threshold of perception and detection, so the victims fail to notice.
• We don’t want to repeat history, and especially not in our smart contracts, so I created a new detector called “too_many_digits”.
  • It detects numbers in the code that have too many digits to be readable and suggest replacing them with a more appropriate Ethereum denomination.
  • Ethereum has a metric system of denominations used as units of ether. Each denomination has its own unique name. The smallest denomination is called Wei. It is the base unit of ether.

The Result:

• Pull request 216 has been accepted and included in the code of Slither.
• “too_many_digits” is now part of this open source tool.