WEBVTT Kind: captions Language: en 00:00:08.980 --> 00:00:14.110 align:start position:0% [Music] 00:00:14.110 --> 00:00:14.120 align:start position:0% [Music] 00:00:14.120 --> 00:00:17.900 align:start position:0% [Music] hello<00:00:15.120> my<00:00:15.900> name<00:00:16.139> is<00:00:16.170> Martin<00:00:16.890> Hollis<00:00:17.160> Wanda<00:00:17.610> and 00:00:17.900 --> 00:00:17.910 align:start position:0% hello my name is Martin Hollis Wanda and 00:00:17.910 --> 00:00:20.750 align:start position:0% hello my name is Martin Hollis Wanda and I<00:00:18.540> am<00:00:18.660> the<00:00:18.870> security<00:00:19.290> lead<00:00:19.620> for<00:00:20.280> their<00:00:20.430> Terry 00:00:20.750 --> 00:00:20.760 align:start position:0% I am the security lead for their Terry 00:00:20.760 --> 00:00:24.230 align:start position:0% I am the security lead for their Terry foundation<00:00:21.860> today<00:00:22.860> I'm<00:00:23.250> going<00:00:23.490> to<00:00:23.610> talk<00:00:24.090> a<00:00:24.120> bit 00:00:24.230 --> 00:00:24.240 align:start position:0% foundation today I'm going to talk a bit 00:00:24.240 --> 00:00:28.940 align:start position:0% foundation today I'm going to talk a bit about<00:00:25.520> avian<00:00:26.520> forensics<00:00:27.270> and<00:00:27.950> managing 00:00:28.940 --> 00:00:28.950 align:start position:0% about avian forensics and managing 00:00:28.950 --> 00:00:31.640 align:start position:0% about avian forensics and managing attacks<00:00:29.340> against<00:00:29.970> the<00:00:30.120> network<00:00:30.570> and<00:00:31.080> how 00:00:31.640 --> 00:00:31.650 align:start position:0% attacks against the network and how 00:00:31.650 --> 00:00:40.750 align:start position:0% attacks against the network and how we've<00:00:31.890> been<00:00:32.070> working<00:00:32.550> on<00:00:32.669> that<00:00:38.179> so<00:00:39.179> I've<00:00:39.960> been 00:00:40.750 --> 00:00:40.760 align:start position:0% we've been working on that so I've been 00:00:40.760 --> 00:00:43.549 align:start position:0% we've been working on that so I've been security<00:00:41.760> lead<00:00:41.940> for<00:00:42.239> one<00:00:42.449> year<00:00:42.809> I<00:00:43.019> started 00:00:43.549 --> 00:00:43.559 align:start position:0% security lead for one year I started 00:00:43.559 --> 00:00:47.299 align:start position:0% security lead for one year I started just<00:00:43.890> before<00:00:45.050> DEFCON<00:00:46.050> 2<00:00:46.289> in<00:00:46.499> Shanghai<00:00:47.010> last 00:00:47.299 --> 00:00:47.309 align:start position:0% just before DEFCON 2 in Shanghai last 00:00:47.309 --> 00:00:52.160 align:start position:0% just before DEFCON 2 in Shanghai last year<00:00:49.550> which<00:00:50.550> started<00:00:51.179> off<00:00:51.359> with<00:00:51.749> the<00:00:51.899> Shanghai 00:00:52.160 --> 00:00:52.170 align:start position:0% year which started off with the Shanghai 00:00:52.170 --> 00:00:55.579 align:start position:0% year which started off with the Shanghai attacks<00:00:52.769> roughly<00:00:53.429> one<00:00:54.059> day<00:00:54.300> after<00:00:54.629> I<00:00:54.989> started 00:00:55.579 --> 00:00:55.589 align:start position:0% attacks roughly one day after I started 00:00:55.589 --> 00:01:00.799 align:start position:0% attacks roughly one day after I started my<00:00:55.890> new<00:00:56.429> role<00:00:58.039> it<00:00:59.039> kept<00:00:59.309> on<00:00:59.429> for<00:00:59.640> a<00:00:59.699> month<00:00:59.879> we've 00:01:00.799 --> 00:01:00.809 align:start position:0% my new role it kept on for a month we've 00:01:00.809 --> 00:01:02.719 align:start position:0% my new role it kept on for a month we've also<00:01:01.109> seen<00:01:01.559> here<00:01:01.800> in<00:01:01.920> the<00:01:02.010> last<00:01:02.159> year<00:01:02.309> we<00:01:02.550> have 00:01:02.719 --> 00:01:02.729 align:start position:0% also seen here in the last year we have 00:01:02.729 --> 00:01:05.590 align:start position:0% also seen here in the last year we have done<00:01:03.239> three<00:01:03.659> hard<00:01:03.899> Forks<00:01:04.440> we've<00:01:05.040> had<00:01:05.339> one 00:01:05.590 --> 00:01:05.600 align:start position:0% done three hard Forks we've had one 00:01:05.600 --> 00:01:09.860 align:start position:0% done three hard Forks we've had one unintentional<00:01:06.600> consensus<00:01:07.380> split<00:01:08.690> there<00:01:09.690> was 00:01:09.860 --> 00:01:09.870 align:start position:0% unintentional consensus split there was 00:01:09.870 --> 00:01:12.790 align:start position:0% unintentional consensus split there was a<00:01:09.900> DOS<00:01:10.560> attack<00:01:10.670> against<00:01:11.670> specifically<00:01:12.390> the 00:01:12.790 --> 00:01:12.800 align:start position:0% a DOS attack against specifically the 00:01:12.800 --> 00:01:17.690 align:start position:0% a DOS attack against specifically the client<00:01:15.260> there<00:01:16.260> has<00:01:16.350> been<00:01:16.500> thousands<00:01:17.070> of<00:01:17.250> ether 00:01:17.690 --> 00:01:17.700 align:start position:0% client there has been thousands of ether 00:01:17.700 --> 00:01:21.290 align:start position:0% client there has been thousands of ether stolen<00:01:18.690> in<00:01:18.960> more<00:01:19.350> or<00:01:19.650> less<00:01:19.860> more<00:01:20.580> and<00:01:20.850> less 00:01:21.290 --> 00:01:21.300 align:start position:0% stolen in more or less more and less 00:01:21.300 --> 00:01:23.960 align:start position:0% stolen in more or less more and less sophisticated<00:01:21.840> attacks<00:01:22.620> both<00:01:23.190> on<00:01:23.460> Shane<00:01:23.760> and 00:01:23.960 --> 00:01:23.970 align:start position:0% sophisticated attacks both on Shane and 00:01:23.970 --> 00:01:29.030 align:start position:0% sophisticated attacks both on Shane and off<00:01:24.060> chain<00:01:25.850> we<00:01:26.850> had<00:01:27.180> the<00:01:27.720> test<00:01:28.110> not<00:01:28.380> totally 00:01:29.030 --> 00:01:29.040 align:start position:0% off chain we had the test not totally 00:01:29.040 --> 00:01:30.790 align:start position:0% off chain we had the test not totally brought<00:01:29.220> to<00:01:29.400> its<00:01:29.520> knees<00:01:29.610> and<00:01:29.790> then 00:01:30.790 --> 00:01:30.800 align:start position:0% brought to its knees and then 00:01:30.800 --> 00:01:33.560 align:start position:0% brought to its knees and then resurrected<00:01:31.800> again<00:01:31.920> and<00:01:32.580> of<00:01:33.060> course<00:01:33.300> there's 00:01:33.560 --> 00:01:33.570 align:start position:0% resurrected again and of course there's 00:01:33.570 --> 00:01:36.110 align:start position:0% resurrected again and of course there's the<00:01:33.780> standard<00:01:34.260> IT<00:01:34.590> incidents<00:01:35.370> with<00:01:35.940> leaked 00:01:36.110 --> 00:01:36.120 align:start position:0% the standard IT incidents with leaked 00:01:36.120 --> 00:01:38.960 align:start position:0% the standard IT incidents with leaked databases<00:01:37.050> and<00:01:37.410> someone<00:01:38.280> taking<00:01:38.670> over 00:01:38.960 --> 00:01:38.970 align:start position:0% databases and someone taking over 00:01:38.970 --> 00:01:42.080 align:start position:0% databases and someone taking over someone's<00:01:39.390> phone<00:01:40.140> number<00:01:40.170> and<00:01:40.920> their<00:01:41.790> account 00:01:42.080 --> 00:01:42.090 align:start position:0% someone's phone number and their account 00:01:42.090 --> 00:01:46.100 align:start position:0% someone's phone number and their account and<00:01:43.160> attacking<00:01:44.160> our<00:01:44.370> github<00:01:44.640> but<00:01:44.930> stuff<00:01:45.930> like 00:01:46.100 --> 00:01:46.110 align:start position:0% and attacking our github but stuff like 00:01:46.110 --> 00:01:46.960 align:start position:0% and attacking our github but stuff like that 00:01:46.960 --> 00:01:46.970 align:start position:0% that 00:01:46.970 --> 00:01:51.530 align:start position:0% that so<00:01:48.110> we<00:01:49.110> should<00:01:49.440> all<00:01:49.820> be<00:01:50.820> very<00:01:51.060> clear<00:01:51.300> about 00:01:51.530 --> 00:01:51.540 align:start position:0% so we should all be very clear about 00:01:51.540 --> 00:01:54.410 align:start position:0% so we should all be very clear about where<00:01:52.080> we're<00:01:52.290> out<00:01:52.440> at<00:01:52.710> this<00:01:53.520> is<00:01:53.700> crypto<00:01:54.180> land 00:01:54.410 --> 00:01:54.420 align:start position:0% where we're out at this is crypto land 00:01:54.420 --> 00:01:56.540 align:start position:0% where we're out at this is crypto land and<00:01:54.660> we're<00:01:54.780> all<00:01:54.900> in<00:01:55.080> crypto<00:01:55.470> land<00:01:55.740> and<00:01:56.040> it's 00:01:56.540 --> 00:01:56.550 align:start position:0% and we're all in crypto land and it's 00:01:56.550 --> 00:01:59.600 align:start position:0% and we're all in crypto land and it's like<00:01:57.170> Australia<00:01:58.170> where<00:01:58.440> anything<00:01:59.190> with<00:01:59.490> the 00:01:59.600 --> 00:01:59.610 align:start position:0% like Australia where anything with the 00:01:59.610 --> 00:02:01.370 align:start position:0% like Australia where anything with the heartbeat<00:02:00.030> will<00:02:00.450> try<00:02:00.630> to<00:02:00.660> kill<00:02:00.990> you 00:02:01.370 --> 00:02:01.380 align:start position:0% heartbeat will try to kill you 00:02:01.380 --> 00:02:04.430 align:start position:0% heartbeat will try to kill you and<00:02:01.500> if<00:02:02.190> you<00:02:02.340> make<00:02:02.520> a<00:02:02.550> mistake<00:02:03.440> you're 00:02:04.430 --> 00:02:04.440 align:start position:0% and if you make a mistake you're 00:02:04.440 --> 00:02:10.999 align:start position:0% and if you make a mistake you're probably<00:02:04.800> dead<00:02:07.190> so<00:02:09.319> meanwhile<00:02:10.319> for<00:02:10.679> attackers 00:02:10.999 --> 00:02:11.009 align:start position:0% probably dead so meanwhile for attackers 00:02:11.009 --> 00:02:14.869 align:start position:0% probably dead so meanwhile for attackers they<00:02:11.969> have<00:02:12.299> never<00:02:12.900> had<00:02:13.109> it<00:02:13.260> better<00:02:13.519> they<00:02:14.519> no 00:02:14.869 --> 00:02:14.879 align:start position:0% they have never had it better they no 00:02:14.879 --> 00:02:15.660 align:start position:0% they have never had it better they no longer<00:02:14.909> need 00:02:15.660 --> 00:02:15.670 align:start position:0% longer need 00:02:15.670 --> 00:02:20.460 align:start position:0% longer need to<00:02:15.790> hack<00:02:16.890> point-of-sales<00:02:18.959> computers<00:02:19.959> and 00:02:20.460 --> 00:02:20.470 align:start position:0% to hack point-of-sales computers and 00:02:20.470 --> 00:02:26.010 align:start position:0% to hack point-of-sales computers and trade<00:02:21.400> carding<00:02:22.030> details<00:02:22.510> over<00:02:24.209> shady<00:02:25.209> forums 00:02:26.010 --> 00:02:26.020 align:start position:0% trade carding details over shady forums 00:02:26.020 --> 00:02:28.860 align:start position:0% trade carding details over shady forums they<00:02:26.920> can<00:02:27.160> just<00:02:27.370> hack<00:02:27.580> a<00:02:27.610> computer<00:02:27.819> and<00:02:28.480> or 00:02:28.860 --> 00:02:28.870 align:start position:0% they can just hack a computer and or 00:02:28.870 --> 00:02:32.330 align:start position:0% they can just hack a computer and or somehow<00:02:29.700> get<00:02:30.700> some<00:02:30.940> cryptocurrency<00:02:31.480> and 00:02:32.330 --> 00:02:32.340 align:start position:0% somehow get some cryptocurrency and 00:02:32.340 --> 00:02:37.110 align:start position:0% somehow get some cryptocurrency and immediately<00:02:33.340> turned<00:02:33.670> into<00:02:34.170> value<00:02:35.310> and<00:02:36.310> and 00:02:37.110 --> 00:02:37.120 align:start position:0% immediately turned into value and and 00:02:37.120 --> 00:02:39.240 align:start position:0% immediately turned into value and and it's<00:02:37.330> so<00:02:37.630> it's<00:02:37.780> like<00:02:38.050> a<00:02:38.319> Wild<00:02:38.650> West<00:02:38.890> in 00:02:39.240 --> 00:02:39.250 align:start position:0% it's so it's like a Wild West in 00:02:39.250 --> 00:02:43.110 align:start position:0% it's so it's like a Wild West in Australia<00:02:39.730> right<00:02:40.060> now<00:02:41.730> these<00:02:42.730> are<00:02:42.790> the 00:02:43.110 --> 00:02:43.120 align:start position:0% Australia right now these are the 00:02:43.120 --> 00:02:44.759 align:start position:0% Australia right now these are the Shanghai<00:02:43.690> attacks<00:02:43.959> I'm<00:02:44.110> not<00:02:44.230> going<00:02:44.440> to<00:02:44.560> talk 00:02:44.759 --> 00:02:44.769 align:start position:0% Shanghai attacks I'm not going to talk 00:02:44.769 --> 00:02:45.990 align:start position:0% Shanghai attacks I'm not going to talk that<00:02:45.130> much<00:02:45.370> about<00:02:45.430> them 00:02:45.990 --> 00:02:46.000 align:start position:0% that much about them 00:02:46.000 --> 00:02:48.120 align:start position:0% that much about them the<00:02:46.090> first<00:02:46.360> Chiang<00:02:46.690> attack<00:02:47.110> is<00:02:47.290> a<00:02:47.319> little<00:02:47.830> blip 00:02:48.120 --> 00:02:48.130 align:start position:0% the first Chiang attack is a little blip 00:02:48.130 --> 00:02:51.059 align:start position:0% the first Chiang attack is a little blip down<00:02:48.459> there<00:02:48.730> and<00:02:49.120> then<00:02:50.110> it<00:02:50.230> just<00:02:50.440> kept<00:02:50.890> on 00:02:51.059 --> 00:02:51.069 align:start position:0% down there and then it just kept on 00:02:51.069 --> 00:02:57.870 align:start position:0% down there and then it just kept on going<00:02:51.250> for<00:02:51.850> a<00:02:51.880> month<00:02:53.100> and<00:02:54.690> it<00:02:55.690> was<00:02:55.870> a<00:02:56.860> lot<00:02:57.760> of 00:02:57.870 --> 00:02:57.880 align:start position:0% going for a month and it was a lot of 00:02:57.880 --> 00:03:02.400 align:start position:0% going for a month and it was a lot of different<00:02:58.299> attacks<00:03:00.900> mostly<00:03:01.900> targeted 00:03:02.400 --> 00:03:02.410 align:start position:0% different attacks mostly targeted 00:03:02.410 --> 00:03:07.500 align:start position:0% different attacks mostly targeted towards<00:03:02.739> gap<00:03:05.190> but<00:03:06.190> when<00:03:06.610> the<00:03:06.730> dust<00:03:06.880> is<00:03:07.060> settled 00:03:07.500 --> 00:03:07.510 align:start position:0% towards gap but when the dust is settled 00:03:07.510 --> 00:03:14.340 align:start position:0% towards gap but when the dust is settled after<00:03:09.299> incidents<00:03:10.299> happen<00:03:11.790> then<00:03:13.019> that's<00:03:14.019> when 00:03:14.340 --> 00:03:14.350 align:start position:0% after incidents happen then that's when 00:03:14.350 --> 00:03:16.229 align:start position:0% after incidents happen then that's when you<00:03:14.500> can<00:03:14.650> actually<00:03:14.830> do<00:03:15.160> something<00:03:15.610> about<00:03:15.730> them 00:03:16.229 --> 00:03:16.239 align:start position:0% you can actually do something about them 00:03:16.239 --> 00:03:18.539 align:start position:0% you can actually do something about them and<00:03:16.450> think<00:03:16.989> about<00:03:17.319> how<00:03:17.950> can<00:03:18.220> we<00:03:18.370> be<00:03:18.519> better 00:03:18.539 --> 00:03:18.549 align:start position:0% and think about how can we be better 00:03:18.549 --> 00:03:21.210 align:start position:0% and think about how can we be better prepared<00:03:18.970> next<00:03:19.600> time<00:03:19.810> something<00:03:20.739> similar 00:03:21.210 --> 00:03:21.220 align:start position:0% prepared next time something similar 00:03:21.220 --> 00:03:24.300 align:start position:0% prepared next time something similar happens<00:03:21.780> when<00:03:22.780> I<00:03:22.870> can<00:03:23.049> we<00:03:23.140> prevent<00:03:23.380> it<00:03:23.620> so<00:03:23.829> how 00:03:24.300 --> 00:03:24.310 align:start position:0% happens when I can we prevent it so how 00:03:24.310 --> 00:03:27.030 align:start position:0% happens when I can we prevent it so how can<00:03:24.370> we<00:03:24.579> improve<00:03:24.670> the<00:03:24.910> readiness<00:03:25.329> and<00:03:26.109> the 00:03:27.030 --> 00:03:27.040 align:start position:0% can we improve the readiness and the 00:03:27.040 --> 00:03:30.180 align:start position:0% can we improve the readiness and the resiliency<00:03:28.079> so<00:03:29.079> for<00:03:29.260> readiness<00:03:29.530> it's<00:03:29.950> about 00:03:30.180 --> 00:03:30.190 align:start position:0% resiliency so for readiness it's about 00:03:30.190 --> 00:03:32.460 align:start position:0% resiliency so for readiness it's about detecting<00:03:30.760> attacks<00:03:31.090> and<00:03:31.570> performing 00:03:32.460 --> 00:03:32.470 align:start position:0% detecting attacks and performing 00:03:32.470 --> 00:03:37.289 align:start position:0% detecting attacks and performing analysis<00:03:33.010> quickly<00:03:35.400> so<00:03:36.400> we<00:03:36.519> started<00:03:37.000> improving 00:03:37.289 --> 00:03:37.299 align:start position:0% analysis quickly so we started improving 00:03:37.299 --> 00:03:40.500 align:start position:0% analysis quickly so we started improving that<00:03:37.680> with<00:03:38.680> some<00:03:39.070> monitoring<00:03:39.549> adding<00:03:40.060> up<00:03:40.239> some 00:03:40.500 --> 00:03:40.510 align:start position:0% that with some monitoring adding up some 00:03:40.510 --> 00:03:42.180 align:start position:0% that with some monitoring adding up some monitoring<00:03:40.930> nodes<00:03:41.200> that<00:03:41.739> we<00:03:41.859> run<00:03:42.010> in<00:03:42.100> the 00:03:42.180 --> 00:03:42.190 align:start position:0% monitoring nodes that we run in the 00:03:42.190 --> 00:03:45.750 align:start position:0% monitoring nodes that we run in the cloud<00:03:42.430> and<00:03:42.760> adding<00:03:43.090> some<00:03:43.269> graphs<00:03:44.489> turns<00:03:45.489> out 00:03:45.750 --> 00:03:45.760 align:start position:0% cloud and adding some graphs turns out 00:03:45.760 --> 00:03:49.410 align:start position:0% cloud and adding some graphs turns out there<00:03:46.209> was<00:03:46.390> some<00:03:46.620> inherent<00:03:47.620> issues<00:03:48.489> which 00:03:49.410 --> 00:03:49.420 align:start position:0% there was some inherent issues which 00:03:49.420 --> 00:03:50.699 align:start position:0% there was some inherent issues which hadn't<00:03:49.690> been<00:03:49.750> noticed<00:03:50.170> before 00:03:50.699 --> 00:03:50.709 align:start position:0% hadn't been noticed before 00:03:50.709 --> 00:03:53.210 align:start position:0% hadn't been noticed before with<00:03:51.340> transaction<00:03:52.209> propagation 00:03:53.210 --> 00:03:53.220 align:start position:0% with transaction propagation 00:03:53.220 --> 00:03:57.720 align:start position:0% with transaction propagation inefficiencies<00:03:55.799> which<00:03:56.799> over<00:03:57.280> the<00:03:57.310> course<00:03:57.400> of 00:03:57.720 --> 00:03:57.730 align:start position:0% inefficiencies which over the course of 00:03:57.730 --> 00:04:00.840 align:start position:0% inefficiencies which over the course of a<00:03:57.790> few<00:03:57.970> months<00:03:58.239> in<00:03:58.569> the<00:03:58.600> beginning<00:03:59.049> of<00:03:59.850> from 00:04:00.840 --> 00:04:00.850 align:start position:0% a few months in the beginning of from 00:04:00.850 --> 00:04:04.410 align:start position:0% a few months in the beginning of from January<00:04:01.209> to<00:04:01.569> March<00:04:02.640> we<00:04:03.640> managed<00:04:04.090> to<00:04:04.209> bring 00:04:04.410 --> 00:04:04.420 align:start position:0% January to March we managed to bring 00:04:04.420 --> 00:04:06.390 align:start position:0% January to March we managed to bring down<00:04:04.660> the<00:04:05.260> overall<00:04:05.470> network<00:04:05.859> traffic<00:04:06.069> with 00:04:06.390 --> 00:04:06.400 align:start position:0% down the overall network traffic with 00:04:06.400 --> 00:04:08.400 align:start position:0% down the overall network traffic with about<00:04:06.579> northern<00:04:07.090> magnitude<00:04:07.630> just<00:04:08.230> by 00:04:08.400 --> 00:04:08.410 align:start position:0% about northern magnitude just by 00:04:08.410 --> 00:04:12.170 align:start position:0% about northern magnitude just by removing<00:04:09.810> valid<00:04:10.810> transaction<00:04:11.040> propagation 00:04:12.170 --> 00:04:12.180 align:start position:0% removing valid transaction propagation 00:04:12.180 --> 00:04:16.379 align:start position:0% removing valid transaction propagation from<00:04:13.180> the<00:04:13.329> clients<00:04:14.760> on<00:04:15.760> these<00:04:16.000> monitoring 00:04:16.379 --> 00:04:16.389 align:start position:0% from the clients on these monitoring 00:04:16.389 --> 00:04:19.259 align:start position:0% from the clients on these monitoring nodes<00:04:16.630> we<00:04:17.200> also<00:04:17.380> added<00:04:17.769> some<00:04:17.950> interface<00:04:18.549> so 00:04:19.259 --> 00:04:19.269 align:start position:0% nodes we also added some interface so 00:04:19.269 --> 00:04:21.870 align:start position:0% nodes we also added some interface so that<00:04:19.709> we<00:04:20.709> can<00:04:20.859> extract<00:04:21.039> very<00:04:21.489> detailed 00:04:21.870 --> 00:04:21.880 align:start position:0% that we can extract very detailed 00:04:21.880 --> 00:04:23.790 align:start position:0% that we can extract very detailed information<00:04:22.479> about<00:04:22.600> what<00:04:23.229> are<00:04:23.440> the<00:04:23.560> canonical 00:04:23.790 --> 00:04:23.800 align:start position:0% information about what are the canonical 00:04:23.800 --> 00:04:27.240 align:start position:0% information about what are the canonical blocks<00:04:24.580> in<00:04:24.940> the<00:04:25.030> chain<00:04:25.270> and<00:04:26.050> if<00:04:26.860> we<00:04:27.039> see<00:04:27.220> a 00:04:27.240 --> 00:04:27.250 align:start position:0% blocks in the chain and if we see a 00:04:27.250 --> 00:04:29.439 align:start position:0% blocks in the chain and if we see a consensus<00:04:27.880> splits<00:04:28.210> we<00:04:28.599> can<00:04:28.810> get<00:04:28.990> very 00:04:29.439 --> 00:04:29.449 align:start position:0% consensus splits we can get very 00:04:29.449 --> 00:04:32.189 align:start position:0% consensus splits we can get very information<00:04:30.169> about<00:04:30.379> the<00:04:30.620> receipts<00:04:31.009> and 00:04:32.189 --> 00:04:32.199 align:start position:0% information about the receipts and 00:04:32.199 --> 00:04:35.679 align:start position:0% information about the receipts and differences<00:04:33.199> in<00:04:33.529> these<00:04:34.219> and<00:04:34.610> and<00:04:34.819> quickly 00:04:35.679 --> 00:04:35.689 align:start position:0% differences in these and and quickly 00:04:35.689 --> 00:04:38.769 align:start position:0% differences in these and and quickly point<00:04:36.050> out<00:04:36.259> which<00:04:36.620> transaction<00:04:37.370> cost<00:04:38.059> this 00:04:38.769 --> 00:04:38.779 align:start position:0% point out which transaction cost this 00:04:38.779 --> 00:04:45.719 align:start position:0% point out which transaction cost this consensus<00:04:39.680> issue<00:04:41.169> so<00:04:42.169> here<00:04:42.349> you<00:04:42.529> see<00:04:44.139> as<00:04:45.139> a<00:04:45.259> gas 00:04:45.719 --> 00:04:45.729 align:start position:0% consensus issue so here you see as a gas 00:04:45.729 --> 00:04:48.369 align:start position:0% consensus issue so here you see as a gas master<00:04:46.729> and<00:04:46.879> gas<00:04:47.029> develop<00:04:47.629> and<00:04:47.900> the<00:04:47.960> parity 00:04:48.369 --> 00:04:48.379 align:start position:0% master and gas develop and the parity 00:04:48.379 --> 00:04:50.920 align:start position:0% master and gas develop and the parity note<00:04:48.620> and<00:04:48.949> right<00:04:49.819> in<00:04:50.059> this<00:04:50.210> image<00:04:50.449> their 00:04:50.920 --> 00:04:50.930 align:start position:0% note and right in this image their 00:04:50.930 --> 00:04:52.929 align:start position:0% note and right in this image their differing<00:04:51.409> on<00:04:51.559> two<00:04:51.740> fields<00:04:52.219> marking<00:04:52.759> red 00:04:52.929 --> 00:04:52.939 align:start position:0% differing on two fields marking red 00:04:52.939 --> 00:04:56.619 align:start position:0% differing on two fields marking red there<00:04:53.180> and<00:04:53.210> that's<00:04:53.629> because<00:04:55.210> parity<00:04:56.210> RPC 00:04:56.619 --> 00:04:56.629 align:start position:0% there and that's because parity RPC 00:04:56.629 --> 00:04:58.570 align:start position:0% there and that's because parity RPC interface<00:04:56.719> exposes<00:04:57.620> a<00:04:57.650> few<00:04:57.889> different<00:04:58.249> fields 00:04:58.570 --> 00:04:58.580 align:start position:0% interface exposes a few different fields 00:04:58.580 --> 00:05:04.059 align:start position:0% interface exposes a few different fields than<00:04:58.789> gas<00:05:00.759> now<00:05:02.050> as<00:05:03.050> we're<00:05:03.289> going<00:05:03.379> to<00:05:03.560> analysis 00:05:04.059 --> 00:05:04.069 align:start position:0% than gas now as we're going to analysis 00:05:04.069 --> 00:05:07.600 align:start position:0% than gas now as we're going to analysis talk<00:05:04.909> a<00:05:04.939> few<00:05:05.330> words<00:05:05.479> about<00:05:05.569> the<00:05:05.810> EVM<00:05:06.610> because 00:05:07.600 --> 00:05:07.610 align:start position:0% talk a few words about the EVM because 00:05:07.610 --> 00:05:10.179 align:start position:0% talk a few words about the EVM because there's<00:05:08.110> they<00:05:09.110> might<00:05:09.289> be<00:05:09.469> conception<00:05:10.009> that 00:05:10.179 --> 00:05:10.189 align:start position:0% there's they might be conception that 00:05:10.189 --> 00:05:12.129 align:start position:0% there's they might be conception that any<00:05:10.400> minor<00:05:10.810> difference<00:05:11.810> in<00:05:12.020> the 00:05:12.129 --> 00:05:12.139 align:start position:0% any minor difference in the 00:05:12.139 --> 00:05:13.899 align:start position:0% any minor difference in the implementation<00:05:12.349> of<00:05:12.800> the<00:05:12.949> UM<00:05:13.249> will 00:05:13.899 --> 00:05:13.909 align:start position:0% implementation of the UM will 00:05:13.909 --> 00:05:15.429 align:start position:0% implementation of the UM will automatically<00:05:14.509> result<00:05:14.810> in<00:05:14.930> a<00:05:14.960> consensus 00:05:15.429 --> 00:05:15.439 align:start position:0% automatically result in a consensus 00:05:15.439 --> 00:05:16.839 align:start position:0% automatically result in a consensus failure<00:05:15.800> and<00:05:16.129> that's<00:05:16.370> not<00:05:16.520> quite<00:05:16.789> true 00:05:16.839 --> 00:05:16.849 align:start position:0% failure and that's not quite true 00:05:16.849 --> 00:05:19.089 align:start position:0% failure and that's not quite true because<00:05:17.419> there<00:05:17.599> are<00:05:17.689> some<00:05:17.870> things<00:05:18.110> some<00:05:18.830> parts 00:05:19.089 --> 00:05:19.099 align:start position:0% because there are some things some parts 00:05:19.099 --> 00:05:21.700 align:start position:0% because there are some things some parts of<00:05:19.189> the<00:05:19.310> ABM<00:05:19.969> which<00:05:20.150> are<00:05:20.330> ephemeral<00:05:20.599> such<00:05:21.529> as 00:05:21.700 --> 00:05:21.710 align:start position:0% of the ABM which are ephemeral such as 00:05:21.710 --> 00:05:27.519 align:start position:0% of the ABM which are ephemeral such as the<00:05:21.860> memory<00:05:22.219> on<00:05:22.310> the<00:05:22.430> stack<00:05:24.789> and<00:05:26.259> which<00:05:27.259> do<00:05:27.499> not 00:05:27.519 --> 00:05:27.529 align:start position:0% the memory on the stack and which do not 00:05:27.529 --> 00:05:30.129 align:start position:0% the memory on the stack and which do not necessarily<00:05:28.270> issues<00:05:29.270> but<00:05:29.719> they're<00:05:29.960> very 00:05:30.129 --> 00:05:30.139 align:start position:0% necessarily issues but they're very 00:05:30.139 --> 00:05:31.839 align:start position:0% necessarily issues but they're very interesting<00:05:30.620> because<00:05:30.800> they<00:05:31.039> can<00:05:31.069> be<00:05:31.309> used<00:05:31.520> to 00:05:31.839 --> 00:05:31.849 align:start position:0% interesting because they can be used to 00:05:31.849 --> 00:05:35.860 align:start position:0% interesting because they can be used to trigger<00:05:32.029> consensus<00:05:32.719> errors<00:05:34.120> and<00:05:35.120> in<00:05:35.449> order<00:05:35.719> to 00:05:35.860 --> 00:05:35.870 align:start position:0% trigger consensus errors and in order to 00:05:35.870 --> 00:05:39.600 align:start position:0% trigger consensus errors and in order to really<00:05:36.399> measure<00:05:37.399> EVM<00:05:37.969> side<00:05:38.270> by<00:05:38.449> side<00:05:38.779> and 00:05:39.600 --> 00:05:39.610 align:start position:0% really measure EVM side by side and 00:05:39.610 --> 00:05:42.219 align:start position:0% really measure EVM side by side and detect<00:05:40.610> implementation<00:05:41.330> differences<00:05:41.899> in 00:05:42.219 --> 00:05:42.229 align:start position:0% detect implementation differences in 00:05:42.229 --> 00:05:45.550 align:start position:0% detect implementation differences in idioms<00:05:42.620> we<00:05:43.249> need<00:05:43.399> an<00:05:43.580> kind<00:05:44.029> of<00:05:44.089> up<00:05:44.300> by<00:05:44.659> up<00:05:44.930> view 00:05:45.550 --> 00:05:45.560 align:start position:0% idioms we need an kind of up by up view 00:05:45.560 --> 00:05:49.839 align:start position:0% idioms we need an kind of up by up view of<00:05:45.589> the<00:05:45.889> internal<00:05:46.819> state<00:05:48.129> so<00:05:49.129> we<00:05:49.279> push<00:05:49.520> kind<00:05:49.759> of 00:05:49.839 --> 00:05:49.849 align:start position:0% of the internal state so we push kind of 00:05:49.849 --> 00:05:52.300 align:start position:0% of the internal state so we push kind of hard<00:05:50.089> to<00:05:50.330> get<00:05:50.659> common<00:05:51.589> output<00:05:51.740> format<00:05:52.279> for 00:05:52.300 --> 00:05:52.310 align:start position:0% hard to get common output format for 00:05:52.310 --> 00:05:55.659 align:start position:0% hard to get common output format for EVMs<00:05:52.939> so<00:05:53.629> that<00:05:53.839> after<00:05:54.229> each<00:05:54.349> instruction<00:05:55.009> made 00:05:55.659 --> 00:05:55.669 align:start position:0% EVMs so that after each instruction made 00:05:55.669 --> 00:05:58.239 align:start position:0% EVMs so that after each instruction made in<00:05:55.819> a<00:05:55.939> VM<00:05:56.240> it<00:05:56.419> would<00:05:56.569> output<00:05:56.930> JSON<00:05:57.529> blob<00:05:57.919> with 00:05:58.239 --> 00:05:58.249 align:start position:0% in a VM it would output JSON blob with 00:05:58.249 --> 00:06:00.070 align:start position:0% in a VM it would output JSON blob with internal<00:05:59.060> state<00:05:59.300> as<00:05:59.449> you<00:05:59.569> can<00:05:59.719> see<00:05:59.870> on<00:06:00.020> the 00:06:00.070 --> 00:06:00.080 align:start position:0% internal state as you can see on the 00:06:00.080 --> 00:06:05.980 align:start position:0% internal state as you can see on the left<00:06:02.499> and<00:06:03.499> also<00:06:04.490> a<00:06:04.520> capability<00:06:05.029> to<00:06:05.539> use 00:06:05.980 --> 00:06:05.990 align:start position:0% left and also a capability to use 00:06:05.990 --> 00:06:08.499 align:start position:0% left and also a capability to use arbitrary<00:06:06.560> state<00:06:07.189> in<00:06:07.339> Genesys<00:06:07.759> configuration 00:06:08.499 --> 00:06:08.509 align:start position:0% arbitrary state in Genesys configuration 00:06:08.509 --> 00:06:17.800 align:start position:0% arbitrary state in Genesys configuration with<00:06:08.779> the<00:06:08.810> raw<00:06:09.199> EVMs<00:06:15.759> so<00:06:16.759> one<00:06:16.939> problem<00:06:17.180> that 00:06:17.800 --> 00:06:17.810 align:start position:0% with the raw EVMs so one problem that 00:06:17.810 --> 00:06:21.129 align:start position:0% with the raw EVMs so one problem that can<00:06:18.110> arise<00:06:18.229> is<00:06:19.270> if<00:06:20.270> we<00:06:20.479> hit<00:06:20.539> by<00:06:20.749> an<00:06:20.810> attack 00:06:21.129 --> 00:06:21.139 align:start position:0% can arise is if we hit by an attack 00:06:21.139 --> 00:06:23.829 align:start position:0% can arise is if we hit by an attack which<00:06:21.589> blows<00:06:22.009> the<00:06:22.939> node<00:06:23.149> out<00:06:23.389> of<00:06:23.419> the<00:06:23.569> water 00:06:23.829 --> 00:06:23.839 align:start position:0% which blows the node out of the water 00:06:23.839 --> 00:06:27.879 align:start position:0% which blows the node out of the water how<00:06:24.709> can<00:06:24.949> we<00:06:25.129> analyze<00:06:25.430> that<00:06:26.620> because<00:06:27.620> I<00:06:27.649> now 00:06:27.879 --> 00:06:27.889 align:start position:0% how can we analyze that because I now 00:06:27.889 --> 00:06:29.019 align:start position:0% how can we analyze that because I now just<00:06:28.189> died<00:06:28.459> right 00:06:29.019 --> 00:06:29.029 align:start position:0% just died right 00:06:29.029 --> 00:06:31.449 align:start position:0% just died right how<00:06:29.120> can<00:06:29.300> analyze<00:06:29.689> transaction<00:06:30.439> if<00:06:31.219> the 00:06:31.449 --> 00:06:31.459 align:start position:0% how can analyze transaction if the 00:06:31.459 --> 00:06:34.899 align:start position:0% how can analyze transaction if the transaction<00:06:31.759> crashes<00:06:32.300> my<00:06:32.479> node<00:06:33.580> well<00:06:34.580> if<00:06:34.759> we 00:06:34.899 --> 00:06:34.909 align:start position:0% transaction crashes my node well if we 00:06:34.909 --> 00:06:38.110 align:start position:0% transaction crashes my node well if we have<00:06:35.089> a<00:06:35.360> standalone<00:06:35.870> EVM<00:06:36.709> what<00:06:37.490> we<00:06:37.639> can<00:06:37.789> do<00:06:37.939> is 00:06:38.110 --> 00:06:38.120 align:start position:0% have a standalone EVM what we can do is 00:06:38.120 --> 00:06:41.050 align:start position:0% have a standalone EVM what we can do is we<00:06:38.300> can<00:06:38.449> just<00:06:39.079> fetch<00:06:39.409> the<00:06:39.740> pre<00:06:39.979> state<00:06:40.339> about 00:06:41.050 --> 00:06:41.060 align:start position:0% we can just fetch the pre state about 00:06:41.060 --> 00:06:43.090 align:start position:0% we can just fetch the pre state about the<00:06:41.120> sender<00:06:41.569> and<00:06:41.689> the<00:06:41.750> receiver<00:06:42.050> is<00:06:42.319> just 00:06:43.090 --> 00:06:43.100 align:start position:0% the sender and the receiver is just 00:06:43.100 --> 00:06:47.350 align:start position:0% the sender and the receiver is just to<00:06:43.370> accounts<00:06:45.010> we<00:06:46.010> can<00:06:46.160> execute<00:06:46.430> that<00:06:46.640> locally 00:06:47.350 --> 00:06:47.360 align:start position:0% to accounts we can execute that locally 00:06:47.360 --> 00:06:50.200 align:start position:0% to accounts we can execute that locally in<00:06:47.600> our<00:06:47.720> EVM<00:06:48.290> and<00:06:48.680> then<00:06:49.040> analyze<00:06:49.490> the<00:06:49.520> trace<00:06:49.940> to 00:06:50.200 --> 00:06:50.210 align:start position:0% in our EVM and then analyze the trace to 00:06:50.210 --> 00:06:52.120 align:start position:0% in our EVM and then analyze the trace to find<00:06:50.570> did<00:06:51.080> we<00:06:51.200> miss<00:06:51.350> anything<00:06:51.650> was<00:06:52.010> there 00:06:52.120 --> 00:06:52.130 align:start position:0% find did we miss anything was there 00:06:52.130 --> 00:06:53.650 align:start position:0% find did we miss anything was there anything<00:06:52.250> else<00:06:52.460> we<00:06:52.550> should<00:06:52.670> have<00:06:52.910> had<00:06:53.060> here<00:06:53.360> an 00:06:53.650 --> 00:06:53.660 align:start position:0% anything else we should have had here an 00:06:53.660 --> 00:06:57.130 align:start position:0% anything else we should have had here an external<00:06:54.440> references<00:06:54.920> and<00:06:55.730> fetch<00:06:56.360> those<00:06:56.690> and 00:06:57.130 --> 00:06:57.140 align:start position:0% external references and fetch those and 00:06:57.140 --> 00:06:59.200 align:start position:0% external references and fetch those and start<00:06:57.410> over<00:06:57.680> and<00:06:57.980> if<00:06:58.130> no<00:06:58.370> crashes<00:06:58.850> then<00:06:59.060> we're 00:06:59.200 --> 00:06:59.210 align:start position:0% start over and if no crashes then we're 00:06:59.210 --> 00:07:03.250 align:start position:0% start over and if no crashes then we're just<00:06:59.240> successfully<00:07:00.610> reproduced<00:07:01.610> the<00:07:01.880> API<00:07:02.480> the 00:07:03.250 --> 00:07:03.260 align:start position:0% just successfully reproduced the API the 00:07:03.260 --> 00:07:05.680 align:start position:0% just successfully reproduced the API the transaction<00:07:03.620> and<00:07:04.490> for<00:07:05.000> this<00:07:05.120> we<00:07:05.270> only<00:07:05.360> need<00:07:05.600> a 00:07:05.680 --> 00:07:05.690 align:start position:0% transaction and for this we only need a 00:07:05.690 --> 00:07:08.790 align:start position:0% transaction and for this we only need a web<00:07:05.840> 3<00:07:06.080> standard<00:07:06.410> API<00:07:06.770> without<00:07:06.980> any<00:07:07.430> debug 00:07:08.790 --> 00:07:08.800 align:start position:0% web 3 standard API without any debug 00:07:08.800 --> 00:07:19.330 align:start position:0% web 3 standard API without any debug specialities<00:07:14.170> sorry<00:07:17.500> so<00:07:18.500> I'm<00:07:18.890> going<00:07:19.130> to 00:07:19.330 --> 00:07:19.340 align:start position:0% specialities sorry so I'm going to 00:07:19.340 --> 00:07:22.450 align:start position:0% specialities sorry so I'm going to demonstrate<00:07:20.380> quickly<00:07:21.380> how<00:07:22.010> we<00:07:22.070> can<00:07:22.370> do 00:07:22.450 --> 00:07:22.460 align:start position:0% demonstrate quickly how we can do 00:07:22.460 --> 00:07:25.180 align:start position:0% demonstrate quickly how we can do analysis<00:07:22.700> of<00:07:23.360> the<00:07:23.480> jump<00:07:23.750> test<00:07:23.990> attack<00:07:24.950> which 00:07:25.180 --> 00:07:25.190 align:start position:0% analysis of the jump test attack which 00:07:25.190 --> 00:07:36.790 align:start position:0% analysis of the jump test attack which we<00:07:25.310> were<00:07:25.370> hit<00:07:25.550> by<00:07:25.760> in<00:07:26.140> on<00:07:27.140> June<00:07:27.470> 1<00:07:35.440> so<00:07:36.440> I'm 00:07:36.790 --> 00:07:36.800 align:start position:0% we were hit by in on June 1 so I'm 00:07:36.800 --> 00:07:40.170 align:start position:0% we were hit by in on June 1 so I'm running<00:07:36.980> this<00:07:37.250> little<00:07:37.430> reproducer<00:07:38.150> here<00:07:38.950> I 00:07:40.170 --> 00:07:40.180 align:start position:0% running this little reproducer here I 00:07:40.180 --> 00:07:44.860 align:start position:0% running this little reproducer here I pipe<00:07:41.180> in<00:07:41.390> the<00:07:42.110> hash<00:07:42.710> used<00:07:43.550> in<00:07:43.970> the<00:07:44.090> attack<00:07:44.420> the 00:07:44.860 --> 00:07:44.870 align:start position:0% pipe in the hash used in the attack the 00:07:44.870 --> 00:07:47.440 align:start position:0% pipe in the hash used in the attack the transaction<00:07:45.730> telling<00:07:46.730> it<00:07:46.820> I'm<00:07:46.940> gonna<00:07:47.090> use<00:07:47.240> my 00:07:47.440 --> 00:07:47.450 align:start position:0% transaction telling it I'm gonna use my 00:07:47.450 --> 00:07:51.070 align:start position:0% transaction telling it I'm gonna use my local<00:07:47.720> EVM<00:07:48.350> not<00:07:49.160> through<00:07:49.730> darker<00:07:50.210> and<00:07:50.810> it 00:07:51.070 --> 00:07:51.080 align:start position:0% local EVM not through darker and it 00:07:51.080 --> 00:07:53.710 align:start position:0% local EVM not through darker and it basically<00:07:51.520> sets<00:07:52.520> the<00:07:52.610> right<00:07:52.850> fork<00:07:53.150> rules<00:07:53.450> for 00:07:53.710 --> 00:07:53.720 align:start position:0% basically sets the right fork rules for 00:07:53.720 --> 00:07:57.190 align:start position:0% basically sets the right fork rules for that<00:07:53.840> particular<00:07:54.080> block<00:07:55.570> and<00:07:56.570> executes<00:07:57.170> it 00:07:57.190 --> 00:07:57.200 align:start position:0% that particular block and executes it 00:07:57.200 --> 00:08:01.650 align:start position:0% that particular block and executes it and<00:07:57.710> it<00:07:58.220> has<00:07:58.460> some<00:07:58.490> intermediary<00:07:59.330> traces<00:07:59.900> here 00:08:01.650 --> 00:08:01.660 align:start position:0% and it has some intermediary traces here 00:08:01.660 --> 00:08:07.420 align:start position:0% and it has some intermediary traces here we<00:08:02.660> can<00:08:02.810> take<00:08:03.020> a<00:08:03.080> look<00:08:03.230> at<00:08:03.380> those<00:08:05.710> so<00:08:06.710> let's<00:08:07.280> go 00:08:07.420 --> 00:08:07.430 align:start position:0% we can take a look at those so let's go 00:08:07.430 --> 00:08:18.790 align:start position:0% we can take a look at those so let's go directly<00:08:07.850> and<00:08:07.940> set<00:08:08.120> for<00:08:08.330> the<00:08:08.740> final<00:08:09.740> trace<00:08:17.800> I'm 00:08:18.790 --> 00:08:18.800 align:start position:0% directly and set for the final trace I'm 00:08:18.800 --> 00:08:21.070 align:start position:0% directly and set for the final trace I'm showing<00:08:19.430> this<00:08:19.550> and<00:08:20.090> what<00:08:20.540> I<00:08:20.570> call<00:08:20.750> the<00:08:20.810> OP 00:08:21.070 --> 00:08:21.080 align:start position:0% showing this and what I call the OP 00:08:21.080 --> 00:08:25.690 align:start position:0% showing this and what I call the OP viewer<00:08:21.730> or<00:08:22.730> retro<00:08:23.210> mix<00:08:23.420> if<00:08:23.660> you<00:08:23.690> like<00:08:24.700> it's 00:08:25.690 --> 00:08:25.700 align:start position:0% viewer or retro mix if you like it's 00:08:25.700 --> 00:08:29.890 align:start position:0% viewer or retro mix if you like it's remix<00:08:26.270> like<00:08:26.510> a<00:08:27.250> debug<00:08:28.250> viewer<00:08:28.490> for<00:08:29.060> the<00:08:29.210> JSON 00:08:29.890 --> 00:08:29.900 align:start position:0% remix like a debug viewer for the JSON 00:08:29.900 --> 00:08:33.250 align:start position:0% remix like a debug viewer for the JSON output<00:08:29.990> format<00:08:30.590> that<00:08:30.680> I<00:08:30.770> showed<00:08:31.040> earlier<00:08:32.260> and 00:08:33.250 --> 00:08:33.260 align:start position:0% output format that I showed earlier and 00:08:33.260 --> 00:08:36.370 align:start position:0% output format that I showed earlier and it's<00:08:34.010> a<00:08:34.099> good<00:08:34.250> start<00:08:34.580> for<00:08:35.110> analyzing<00:08:36.110> what's 00:08:36.370 --> 00:08:36.380 align:start position:0% it's a good start for analyzing what's 00:08:36.380 --> 00:08:39.969 align:start position:0% it's a good start for analyzing what's happening<00:08:36.830> in<00:08:37.280> a<00:08:37.490> transaction<00:08:38.770> so<00:08:39.770> you<00:08:39.830> can 00:08:39.969 --> 00:08:39.979 align:start position:0% happening in a transaction so you can 00:08:39.979 --> 00:08:42.130 align:start position:0% happening in a transaction so you can see<00:08:40.130> this<00:08:40.340> particular<00:08:40.880> transaction<00:08:41.450> it 00:08:42.130 --> 00:08:42.140 align:start position:0% see this particular transaction it 00:08:42.140 --> 00:08:47.699 align:start position:0% see this particular transaction it doesn't<00:08:42.530> Xcode<00:08:42.860> copy 00:08:47.699 --> 00:08:47.709 align:start position:0% 00:08:47.709 --> 00:08:51.389 align:start position:0% and<00:08:47.980> the<00:08:48.370> Xcode<00:08:48.670> copy<00:08:49.529> fills<00:08:50.529> the<00:08:50.740> memory<00:08:51.069> with 00:08:51.389 --> 00:08:51.399 align:start position:0% and the Xcode copy fills the memory with 00:08:51.399 --> 00:08:55.079 align:start position:0% and the Xcode copy fills the memory with five<00:08:51.730> B<00:08:52.000> and<00:08:52.689> it<00:08:52.779> does<00:08:52.959> it<00:08:53.110> repeatedly<00:08:53.649> and<00:08:54.310> as 00:08:55.079 --> 00:08:55.089 align:start position:0% five B and it does it repeatedly and as 00:08:55.089 --> 00:09:00.600 align:start position:0% five B and it does it repeatedly and as you<00:08:55.209> can<00:08:55.329> see<00:08:55.389> the<00:08:56.370> memory<00:08:57.370> is<00:08:57.819> growing<00:08:59.310> and<00:09:00.310> it 00:09:00.600 --> 00:09:00.610 align:start position:0% you can see the memory is growing and it 00:09:00.610 --> 00:09:03.329 align:start position:0% you can see the memory is growing and it keeps<00:09:00.879> doing<00:09:01.089> this<00:09:01.329> for<00:09:01.660> about<00:09:01.769> 600<00:09:02.769> steps<00:09:03.100> I'm 00:09:03.329 --> 00:09:03.339 align:start position:0% keeps doing this for about 600 steps I'm 00:09:03.339 --> 00:09:07.319 align:start position:0% keeps doing this for about 600 steps I'm gonna<00:09:03.490> go<00:09:03.819> a<00:09:03.850> bit<00:09:04.000> faster<00:09:04.389> here<00:09:05.939> until<00:09:06.939> it<00:09:07.089> has 00:09:07.319 --> 00:09:07.329 align:start position:0% gonna go a bit faster here until it has 00:09:07.329 --> 00:09:10.710 align:start position:0% gonna go a bit faster here until it has filled<00:09:07.810> up<00:09:07.990> the<00:09:08.170> memory<00:09:08.939> with<00:09:09.939> half<00:09:10.600> a 00:09:10.710 --> 00:09:10.720 align:start position:0% filled up the memory with half a 00:09:10.720 --> 00:09:14.009 align:start position:0% filled up the memory with half a megabytes<00:09:11.199> all<00:09:11.730> 5b<00:09:12.730> which<00:09:13.360> happens<00:09:13.899> to<00:09:13.990> be 00:09:14.009 --> 00:09:14.019 align:start position:0% megabytes all 5b which happens to be 00:09:14.019 --> 00:09:19.829 align:start position:0% megabytes all 5b which happens to be jump<00:09:14.769> test<00:09:16.980> then<00:09:17.980> it<00:09:18.009> puts<00:09:18.370> some<00:09:19.209> more<00:09:19.420> code<00:09:19.689> in 00:09:19.829 --> 00:09:19.839 align:start position:0% jump test then it puts some more code in 00:09:19.839 --> 00:09:25.650 align:start position:0% jump test then it puts some more code in there<00:09:20.050> and<00:09:22.350> this<00:09:23.350> is<00:09:23.560> looks<00:09:24.189> like<00:09:24.430> actual<00:09:24.790> EVM 00:09:25.650 --> 00:09:25.660 align:start position:0% there and this is looks like actual EVM 00:09:25.660 --> 00:09:32.309 align:start position:0% there and this is looks like actual EVM code<00:09:26.399> 6003<00:09:27.480> 56<00:09:28.480> 5b<00:09:29.310> and<00:09:30.870> all<00:09:31.870> of<00:09:32.019> you<00:09:32.139> I'm<00:09:32.290> sure 00:09:32.309 --> 00:09:32.319 align:start position:0% code 6003 56 5b and all of you I'm sure 00:09:32.319 --> 00:09:36.900 align:start position:0% code 6003 56 5b and all of you I'm sure recognize<00:09:33.279> that<00:09:33.670> that<00:09:33.939> is<00:09:34.379> the<00:09:35.379> push<00:09:35.680> one<00:09:36.069> jump 00:09:36.900 --> 00:09:36.910 align:start position:0% recognize that that is the push one jump 00:09:36.910 --> 00:09:39.809 align:start position:0% recognize that that is the push one jump jump<00:09:37.360> test<00:09:37.600> and<00:09:37.899> stop<00:09:38.170> so<00:09:39.160> it<00:09:39.250> it's<00:09:39.610> just 00:09:39.809 --> 00:09:39.819 align:start position:0% jump test and stop so it it's just 00:09:39.819 --> 00:09:44.790 align:start position:0% jump test and stop so it it's just executed<00:09:40.540> to<00:09:40.629> create<00:09:41.019> with<00:09:41.620> that<00:09:41.649> code<00:09:42.189> and<00:09:43.800> as 00:09:44.790 --> 00:09:44.800 align:start position:0% executed to create with that code and as 00:09:44.800 --> 00:09:46.920 align:start position:0% executed to create with that code and as you<00:09:44.980> can<00:09:45.129> see<00:09:45.339> the<00:09:45.550> size<00:09:45.850> of<00:09:46.180> the<00:09:46.300> create<00:09:46.629> is 00:09:46.920 --> 00:09:46.930 align:start position:0% you can see the size of the create is 00:09:46.930 --> 00:09:50.189 align:start position:0% you can see the size of the create is the<00:09:47.079> full<00:09:47.319> half<00:09:47.649> megabytes<00:09:48.810> okay<00:09:49.810> so<00:09:49.899> now<00:09:50.139> we 00:09:50.189 --> 00:09:50.199 align:start position:0% the full half megabytes okay so now we 00:09:50.199 --> 00:09:52.410 align:start position:0% the full half megabytes okay so now we know<00:09:50.379> that<00:09:50.410> the<00:09:50.709> attacker<00:09:51.009> is<00:09:51.670> doing<00:09:52.089> creates 00:09:52.410 --> 00:09:52.420 align:start position:0% know that the attacker is doing creates 00:09:52.420 --> 00:09:57.150 align:start position:0% know that the attacker is doing creates and<00:09:52.720> he<00:09:53.670> keeps<00:09:54.670> doing<00:09:54.819> it<00:09:54.970> repeatedly<00:09:56.160> one 00:09:57.150 --> 00:09:57.160 align:start position:0% and he keeps doing it repeatedly one 00:09:57.160 --> 00:09:59.939 align:start position:0% and he keeps doing it repeatedly one part<00:09:57.430> of<00:09:57.579> the<00:09:57.699> memory<00:09:58.000> changes<00:09:58.509> between<00:09:59.500> each 00:09:59.939 --> 00:09:59.949 align:start position:0% part of the memory changes between each 00:09:59.949 --> 00:10:03.600 align:start position:0% part of the memory changes between each invocation<00:10:01.319> it's<00:10:02.319> a<00:10:02.410> little<00:10:02.649> counter<00:10:03.129> down 00:10:03.600 --> 00:10:03.610 align:start position:0% invocation it's a little counter down 00:10:03.610 --> 00:10:09.569 align:start position:0% invocation it's a little counter down there<00:10:03.879> and<00:10:04.720> I'll<00:10:05.279> skip<00:10:06.279> forward<00:10:06.670> with<00:10:08.430> so<00:10:09.430> it's 00:10:09.569 --> 00:10:09.579 align:start position:0% there and I'll skip forward with so it's 00:10:09.579 --> 00:10:12.329 align:start position:0% there and I'll skip forward with so it's all<00:10:09.699> just<00:10:09.939> create<00:10:10.269> and<00:10:10.930> it<00:10:11.110> ends<00:10:11.470> on<00:10:11.649> create 00:10:12.329 --> 00:10:12.339 align:start position:0% all just create and it ends on create 00:10:12.339 --> 00:10:16.350 align:start position:0% all just create and it ends on create number<00:10:12.819> 105<00:10:13.809> it<00:10:14.019> goes<00:10:14.230> out<00:10:14.379> of<00:10:14.529> gas<00:10:15.059> so<00:10:16.059> by<00:10:16.300> this 00:10:16.350 --> 00:10:16.360 align:start position:0% number 105 it goes out of gas so by this 00:10:16.360 --> 00:10:21.090 align:start position:0% number 105 it goes out of gas so by this time<00:10:17.250> you<00:10:18.250> can<00:10:18.430> be<00:10:18.569> kind<00:10:19.569> of<00:10:19.750> have<00:10:20.410> an<00:10:20.529> idea<00:10:20.620> so 00:10:21.090 --> 00:10:21.100 align:start position:0% time you can be kind of have an idea so 00:10:21.100 --> 00:10:23.249 align:start position:0% time you can be kind of have an idea so it's<00:10:21.309> it's<00:10:21.879> doing<00:10:22.029> creates<00:10:22.480> a<00:10:22.660> lots<00:10:22.839> of<00:10:22.959> times 00:10:23.249 --> 00:10:23.259 align:start position:0% it's it's doing creates a lots of times 00:10:23.259 --> 00:10:25.079 align:start position:0% it's it's doing creates a lots of times with<00:10:23.589> a<00:10:23.680> large<00:10:23.860> memory<00:10:24.189> segment<00:10:24.759> totally 00:10:25.079 --> 00:10:25.089 align:start position:0% with a large memory segment totally 00:10:25.089 --> 00:10:29.009 align:start position:0% with a large memory segment totally filled<00:10:25.329> with<00:10:25.569> jump<00:10:25.959> tests<00:10:26.670> it<00:10:27.670> changes<00:10:28.509> one 00:10:29.009 --> 00:10:29.019 align:start position:0% filled with jump tests it changes one 00:10:29.019 --> 00:10:32.040 align:start position:0% filled with jump tests it changes one little<00:10:29.350> bytes<00:10:29.649> each<00:10:30.009> time<00:10:30.670> so<00:10:31.569> obviously 00:10:32.040 --> 00:10:32.050 align:start position:0% little bytes each time so obviously 00:10:32.050 --> 00:10:37.230 align:start position:0% little bytes each time so obviously bypassing<00:10:32.769> and<00:10:32.889> caching<00:10:33.339> mechanisms<00:10:34.709> so<00:10:36.240> by 00:10:37.230 --> 00:10:37.240 align:start position:0% bypassing and caching mechanisms so by 00:10:37.240 --> 00:10:40.679 align:start position:0% bypassing and caching mechanisms so by reproducing<00:10:37.899> it<00:10:38.019> and<00:10:39.120> viewing<00:10:40.120> at<00:10:40.269> the<00:10:40.420> trace 00:10:40.679 --> 00:10:40.689 align:start position:0% reproducing it and viewing at the trace 00:10:40.689 --> 00:10:42.809 align:start position:0% reproducing it and viewing at the trace in<00:10:41.110> this<00:10:41.259> fashion<00:10:41.709> we<00:10:42.100> can<00:10:42.279> do<00:10:42.370> a<00:10:42.430> very<00:10:42.579> quick 00:10:42.809 --> 00:10:42.819 align:start position:0% in this fashion we can do a very quick 00:10:42.819 --> 00:10:48.019 align:start position:0% in this fashion we can do a very quick analysis<00:10:43.480> of<00:10:43.509> what<00:10:43.750> happened<00:10:44.139> and<00:10:44.879> we<00:10:45.879> can 00:10:48.019 --> 00:10:48.029 align:start position:0% analysis of what happened and we can 00:10:48.029 --> 00:10:51.630 align:start position:0% analysis of what happened and we can benchmark<00:10:49.029> it 00:10:51.630 --> 00:10:51.640 align:start position:0% 00:10:51.640 --> 00:10:54.970 align:start position:0% right<00:10:52.640> now<00:10:52.790> it's<00:10:53.000> running<00:10:53.360> at<00:10:53.980> 300 00:10:54.970 --> 00:10:54.980 align:start position:0% right now it's running at 300 00:10:54.980 --> 00:11:01.390 align:start position:0% right now it's running at 300 milliseconds<00:10:56.380> and<00:10:57.380> if<00:10:57.590> I<00:10:57.710> compare<00:10:58.100> that<00:10:58.310> to<00:11:00.400> so 00:11:01.390 --> 00:11:01.400 align:start position:0% milliseconds and if I compare that to so 00:11:01.400 --> 00:11:06.570 align:start position:0% milliseconds and if I compare that to so this<00:11:01.610> is<00:11:01.730> the<00:11:01.850> EVM<00:11:02.800> get<00:11:03.800> EVM<00:11:04.430> with<00:11:05.210> the<00:11:05.690> patch 00:11:06.570 --> 00:11:06.580 align:start position:0% this is the EVM get EVM with the patch 00:11:06.580 --> 00:11:11.440 align:start position:0% this is the EVM get EVM with the patch applied<00:11:07.580> after<00:11:08.180> this<00:11:08.330> attack<00:11:08.690> I<00:11:10.120> can<00:11:11.120> try<00:11:11.420> it 00:11:11.440 --> 00:11:11.450 align:start position:0% applied after this attack I can try it 00:11:11.450 --> 00:11:14.440 align:start position:0% applied after this attack I can try it against<00:11:11.870> the<00:11:11.990> EVM<00:11:12.440> without<00:11:12.950> the<00:11:13.190> patch<00:11:13.450> for 00:11:14.440 --> 00:11:14.450 align:start position:0% against the EVM without the patch for 00:11:14.450 --> 00:11:23.560 align:start position:0% against the EVM without the patch for the<00:11:14.810> jump<00:11:15.050> test<00:11:15.290> analysis<00:11:21.670> and<00:11:22.670> as<00:11:23.300> you<00:11:23.420> can 00:11:23.560 --> 00:11:23.570 align:start position:0% the jump test analysis and as you can 00:11:23.570 --> 00:11:28.540 align:start position:0% the jump test analysis and as you can see<00:11:23.720> it<00:11:23.870> took<00:11:24.140> nine<00:11:24.920> seconds<00:11:26.050> so<00:11:27.050> this<00:11:27.680> tooling 00:11:28.540 --> 00:11:28.550 align:start position:0% see it took nine seconds so this tooling 00:11:28.550 --> 00:11:30.550 align:start position:0% see it took nine seconds so this tooling makes<00:11:28.880> it<00:11:29.000> possible<00:11:29.150> for<00:11:29.480> us<00:11:29.780> to<00:11:29.810> do<00:11:30.320> quick 00:11:30.550 --> 00:11:30.560 align:start position:0% makes it possible for us to do quick 00:11:30.560 --> 00:11:35.320 align:start position:0% makes it possible for us to do quick analysis<00:11:31.040> and<00:11:31.280> then<00:11:32.000> to<00:11:33.760> check<00:11:34.760> does<00:11:35.120> this 00:11:35.320 --> 00:11:35.330 align:start position:0% analysis and then to check does this 00:11:35.330 --> 00:11:43.180 align:start position:0% analysis and then to check does this patch<00:11:35.630> work<00:11:36.050> and<00:11:36.500> I<00:11:36.860> can<00:11:37.330> I<00:11:41.440> can<00:11:42.440> share<00:11:42.740> it<00:11:42.770> with 00:11:43.180 --> 00:11:43.190 align:start position:0% patch work and I can I can share it with 00:11:43.190 --> 00:11:44.950 align:start position:0% patch work and I can I can share it with the<00:11:43.280> co-workers<00:11:43.850> and<00:11:44.030> they<00:11:44.150> can<00:11:44.360> try<00:11:44.840> out 00:11:44.950 --> 00:11:44.960 align:start position:0% the co-workers and they can try out 00:11:44.960 --> 00:11:46.690 align:start position:0% the co-workers and they can try out various<00:11:44.990> patches<00:11:45.770> and<00:11:45.980> see<00:11:46.100> which<00:11:46.310> one<00:11:46.520> is<00:11:46.670> the 00:11:46.690 --> 00:11:46.700 align:start position:0% various patches and see which one is the 00:11:46.700 --> 00:11:51.460 align:start position:0% various patches and see which one is the best<00:11:46.970> I<00:11:47.530> can<00:11:48.530> also<00:11:48.740> run<00:11:48.950> this<00:11:49.160> in<00:11:49.960> a<00:11:50.960> web-like 00:11:51.460 --> 00:11:51.470 align:start position:0% best I can also run this in a web-like 00:11:51.470 --> 00:11:53.320 align:start position:0% best I can also run this in a web-like format<00:11:52.130> and<00:11:52.280> do<00:11:52.370> the<00:11:52.520> all<00:11:52.670> the<00:11:52.790> same<00:11:53.000> things 00:11:53.320 --> 00:11:53.330 align:start position:0% format and do the all the same things 00:11:53.330 --> 00:11:57.900 align:start position:0% format and do the all the same things and<00:11:55.300> investigate<00:11:56.300> other<00:11:56.510> on<00:11:56.720> chain<00:11:57.050> events 00:11:57.900 --> 00:11:57.910 align:start position:0% and investigate other on chain events 00:11:57.910 --> 00:12:02.970 align:start position:0% and investigate other on chain events for<00:11:58.910> example<00:11:59.300> the<00:12:00.130> take<00:12:01.130> that<00:12:01.160> was<00:12:01.430> the<00:12:01.520> same 00:12:02.970 --> 00:12:02.980 align:start position:0% for example the take that was the same 00:12:02.980 --> 00:12:12.570 align:start position:0% for example the take that was the same pair<00:12:03.980> 2<00:12:04.130> volt<00:12:04.310> attack 00:12:12.570 --> 00:12:12.580 align:start position:0% 00:12:12.580 --> 00:12:16.120 align:start position:0% and<00:12:13.630> there<00:12:14.630> we<00:12:14.780> have<00:12:14.930> the<00:12:14.960> parity<00:12:15.860> wolves 00:12:16.120 --> 00:12:16.130 align:start position:0% and there we have the parity wolves 00:12:16.130 --> 00:12:19.540 align:start position:0% and there we have the parity wolves attack<00:12:16.460> reproduced<00:12:18.040> and<00:12:19.040> you<00:12:19.160> can<00:12:19.310> run<00:12:19.460> it 00:12:19.540 --> 00:12:19.550 align:start position:0% attack reproduced and you can run it 00:12:19.550 --> 00:12:21.490 align:start position:0% attack reproduced and you can run it locally<00:12:19.730> or<00:12:20.000> you<00:12:20.240> can<00:12:20.360> check<00:12:20.540> and<00:12:20.900> annotate 00:12:21.490 --> 00:12:21.500 align:start position:0% locally or you can check and annotate 00:12:21.500 --> 00:12:23.500 align:start position:0% locally or you can check and annotate the<00:12:21.650> trace<00:12:21.920> of<00:12:22.310> what<00:12:22.700> happened<00:12:23.150> there<00:12:23.330> in<00:12:23.420> the 00:12:23.500 --> 00:12:23.510 align:start position:0% the trace of what happened there in the 00:12:23.510 --> 00:12:29.680 align:start position:0% the trace of what happened there in the Perrault<00:12:24.020> attack<00:12:24.380> and<00:12:26.710> for<00:12:27.710> example<00:12:28.550> yeah<00:12:29.450> so 00:12:29.680 --> 00:12:29.690 align:start position:0% Perrault attack and for example yeah so 00:12:29.690 --> 00:12:33.700 align:start position:0% Perrault attack and for example yeah so here's<00:12:29.960> the<00:12:30.610> fated<00:12:31.870> infamous<00:12:32.870> delegate<00:12:33.410> call 00:12:33.700 --> 00:12:33.710 align:start position:0% here's the fated infamous delegate call 00:12:33.710 --> 00:12:37.690 align:start position:0% here's the fated infamous delegate call and<00:12:34.100> the<00:12:35.680> node<00:12:36.680> attack<00:12:36.950> if<00:12:37.130> you<00:12:37.250> want<00:12:37.430> to<00:12:37.520> if 00:12:37.690 --> 00:12:37.700 align:start position:0% and the node attack if you want to if 00:12:37.700 --> 00:12:49.140 align:start position:0% and the node attack if you want to if you<00:12:37.820> want<00:12:37.880> to<00:12:37.970> analyze<00:12:38.120> that<00:12:38.570> more<00:12:38.810> in<00:12:38.900> depth 00:12:49.140 --> 00:12:49.150 align:start position:0% 00:12:49.150 --> 00:12:51.970 align:start position:0% so<00:12:50.150> the<00:12:50.300> EVM<00:12:50.600> lab<00:12:50.840> which<00:12:51.080> I<00:12:51.260> showed<00:12:51.560> you<00:12:51.590> part 00:12:51.970 --> 00:12:51.980 align:start position:0% so the EVM lab which I showed you part 00:12:51.980 --> 00:12:55.930 align:start position:0% so the EVM lab which I showed you part of<00:12:52.810> makes<00:12:53.810> possible<00:12:54.080> to<00:12:54.320> do<00:12:54.890> some<00:12:55.160> EVM 00:12:55.930 --> 00:12:55.940 align:start position:0% of makes possible to do some EVM 00:12:55.940 --> 00:12:59.410 align:start position:0% of makes possible to do some EVM assembly<00:12:56.510> pythonic<00:12:57.470> Li<00:12:57.910> and<00:12:58.910> investigate 00:12:59.410 --> 00:12:59.420 align:start position:0% assembly pythonic Li and investigate 00:12:59.420 --> 00:13:03.100 align:start position:0% assembly pythonic Li and investigate these<00:12:59.540> kinds<00:12:59.930> of<00:12:59.990> issues<00:13:00.140> and<00:13:01.480> yeah<00:13:02.480> dissect 00:13:03.100 --> 00:13:03.110 align:start position:0% these kinds of issues and yeah dissect 00:13:03.110 --> 00:13:09.220 align:start position:0% these kinds of issues and yeah dissect attacks<00:13:03.530> on<00:13:03.770> a<00:13:03.800> really<00:13:04.160> low<00:13:04.340> level<00:13:07.960> we<00:13:08.960> had<00:13:09.080> two 00:13:09.220 --> 00:13:09.230 align:start position:0% attacks on a really low level we had two 00:13:09.230 --> 00:13:11.410 align:start position:0% attacks on a really low level we had two hard<00:13:09.440> folks<00:13:09.680> also<00:13:10.490> and<00:13:10.730> in<00:13:10.820> preparation<00:13:11.360> of 00:13:11.410 --> 00:13:11.420 align:start position:0% hard folks also and in preparation of 00:13:11.420 --> 00:13:14.820 align:start position:0% hard folks also and in preparation of those<00:13:11.660> we<00:13:12.260> ramped<00:13:13.040> up<00:13:13.160> the<00:13:13.430> testing<00:13:13.940> and 00:13:14.820 --> 00:13:14.830 align:start position:0% those we ramped up the testing and 00:13:14.830 --> 00:13:17.410 align:start position:0% those we ramped up the testing and introducing<00:13:15.830> parameterize<00:13:16.430> tests<00:13:17.150> or 00:13:17.410 --> 00:13:17.420 align:start position:0% introducing parameterize tests or 00:13:17.420 --> 00:13:19.150 align:start position:0% introducing parameterize tests or generalized<00:13:17.870> test<00:13:18.230> which<00:13:18.470> Dmitriy<00:13:18.950> talked 00:13:19.150 --> 00:13:19.160 align:start position:0% generalized test which Dmitriy talked 00:13:19.160 --> 00:13:21.360 align:start position:0% generalized test which Dmitriy talked about<00:13:19.370> yesterday<00:13:19.700> in<00:13:19.940> the<00:13:20.030> breakout<00:13:20.330> room<00:13:20.600> and 00:13:21.360 --> 00:13:21.370 align:start position:0% about yesterday in the breakout room and 00:13:21.370 --> 00:13:25.630 align:start position:0% about yesterday in the breakout room and also<00:13:22.370> put<00:13:22.820> it<00:13:22.910> all<00:13:23.030> into<00:13:23.270> high<00:13:23.830> high<00:13:24.830> vis<00:13:25.040> PDC 00:13:25.630 --> 00:13:25.640 align:start position:0% also put it all into high high vis PDC 00:13:25.640 --> 00:13:28.150 align:start position:0% also put it all into high high vis PDC log<00:13:25.820> is<00:13:26.000> super<00:13:26.990> cool<00:13:27.140> framework<00:13:27.620> for<00:13:27.830> running 00:13:28.150 --> 00:13:28.160 align:start position:0% log is super cool framework for running 00:13:28.160 --> 00:13:31.300 align:start position:0% log is super cool framework for running notes<00:13:28.370> and<00:13:28.700> in<00:13:28.940> a<00:13:29.060> blackbox<00:13:29.510> fashion<00:13:30.020> and<00:13:30.310> just 00:13:31.300 --> 00:13:31.310 align:start position:0% notes and in a blackbox fashion and just 00:13:31.310 --> 00:13:34.810 align:start position:0% notes and in a blackbox fashion and just synthesize<00:13:32.000> the<00:13:32.890> the<00:13:33.890> environment<00:13:34.520> the 00:13:34.810 --> 00:13:34.820 align:start position:0% synthesize the the environment the 00:13:34.820 --> 00:13:36.220 align:start position:0% synthesize the the environment the genesis<00:13:35.270> and<00:13:35.420> the<00:13:35.510> blocks<00:13:35.720> and<00:13:35.900> everything 00:13:36.220 --> 00:13:36.230 align:start position:0% genesis and the blocks and everything 00:13:36.230 --> 00:13:38.560 align:start position:0% genesis and the blocks and everything and<00:13:36.410> then<00:13:37.250> you<00:13:37.370> can<00:13:37.520> compare<00:13:37.970> the<00:13:38.120> the 00:13:38.560 --> 00:13:38.570 align:start position:0% and then you can compare the the 00:13:38.570 --> 00:13:40.960 align:start position:0% and then you can compare the the expected<00:13:39.170> post<00:13:39.470> state<00:13:39.920> after<00:13:40.220> a<00:13:40.400> sequence<00:13:40.700> of 00:13:40.960 --> 00:13:40.970 align:start position:0% expected post state after a sequence of 00:13:40.970 --> 00:13:47.170 align:start position:0% expected post state after a sequence of blocks<00:13:43.780> and<00:13:44.780> this<00:13:44.990> makes<00:13:45.380> possible<00:13:45.800> to<00:13:45.890> run<00:13:46.180> it 00:13:47.170 --> 00:13:47.180 align:start position:0% blocks and this makes possible to run it 00:13:47.180 --> 00:13:50.160 align:start position:0% blocks and this makes possible to run it runs<00:13:47.450> about<00:13:47.710> 24,000<00:13:48.710> test<00:13:48.920> cases<00:13:49.160> against 00:13:50.160 --> 00:13:50.170 align:start position:0% runs about 24,000 test cases against 00:13:50.170 --> 00:13:54.970 align:start position:0% runs about 24,000 test cases against Pythian<00:13:51.170> parity<00:13:51.740> gets<00:13:52.160> and<00:13:52.400> cpp<00:13:52.970> and<00:13:53.830> it<00:13:54.830> runs 00:13:54.970 --> 00:13:54.980 align:start position:0% Pythian parity gets and cpp and it runs 00:13:54.980 --> 00:14:03.610 align:start position:0% Pythian parity gets and cpp and it runs it<00:13:55.160> 24/7<00:13:56.350> 365<00:14:00.220> it<00:14:01.220> removes<00:14:01.730> the<00:14:02.570> dependency<00:14:03.350> of 00:14:03.610 --> 00:14:03.620 align:start position:0% it 24/7 365 it removes the dependency of 00:14:03.620 --> 00:14:07.780 align:start position:0% it 24/7 365 it removes the dependency of the<00:14:03.830> developers<00:14:05.050> to<00:14:06.050> perform<00:14:06.560> tests<00:14:07.190> as<00:14:07.520> part 00:14:07.780 --> 00:14:07.790 align:start position:0% the developers to perform tests as part 00:14:07.790 --> 00:14:10.960 align:start position:0% the developers to perform tests as part of<00:14:08.060> the<00:14:08.150> test<00:14:08.360> process<00:14:08.570> so<00:14:09.230> now<00:14:09.610> testing<00:14:10.610> can 00:14:10.960 --> 00:14:10.970 align:start position:0% of the test process so now testing can 00:14:10.970 --> 00:14:12.370 align:start position:0% of the test process so now testing can be<00:14:11.090> a<00:14:11.120> totally<00:14:11.480> separate<00:14:11.780> process<00:14:12.200> which 00:14:12.370 --> 00:14:12.380 align:start position:0% be a totally separate process which 00:14:12.380 --> 00:14:15.040 align:start position:0% be a totally separate process which doesn't<00:14:12.710> really<00:14:12.890> rely<00:14:13.730> on<00:14:13.760> the<00:14:14.480> developers 00:14:15.040 --> 00:14:15.050 align:start position:0% doesn't really rely on the developers 00:14:15.050 --> 00:14:19.930 align:start position:0% doesn't really rely on the developers per<00:14:15.350> se<00:14:16.810> the<00:14:17.810> fall<00:14:18.080> out<00:14:18.320> however<00:14:18.730> after<00:14:19.730> the 00:14:19.930 --> 00:14:19.940 align:start position:0% per se the fall out however after the 00:14:19.940 --> 00:14:22.030 align:start position:0% per se the fall out however after the first<00:14:19.970> heart<00:14:20.600> sorry<00:14:21.020> second<00:14:21.320> heart<00:14:21.500> fork<00:14:21.770> is<00:14:22.010> a 00:14:22.030 --> 00:14:22.040 align:start position:0% first heart sorry second heart fork is a 00:14:22.040 --> 00:14:23.900 align:start position:0% first heart sorry second heart fork is a consensus<00:14:22.940> issue 00:14:23.900 --> 00:14:23.910 align:start position:0% consensus issue 00:14:23.910 --> 00:14:27.080 align:start position:0% consensus issue which<00:14:24.120> was<00:14:24.650> yeah<00:14:25.650> definitely<00:14:26.370> not<00:14:26.670> what<00:14:26.940> we 00:14:27.080 --> 00:14:27.090 align:start position:0% which was yeah definitely not what we 00:14:27.090 --> 00:14:31.160 align:start position:0% which was yeah definitely not what we wanted<00:14:29.060> manually<00:14:30.060> crafted<00:14:30.510> tests<00:14:30.810> are<00:14:30.930> great 00:14:31.160 --> 00:14:31.170 align:start position:0% wanted manually crafted tests are great 00:14:31.170 --> 00:14:34.370 align:start position:0% wanted manually crafted tests are great but<00:14:31.590> there's<00:14:31.800> no<00:14:31.950> way<00:14:32.130> to<00:14:32.190> scale<00:14:32.700> it<00:14:33.230> due<00:14:34.230> to 00:14:34.370 --> 00:14:34.380 align:start position:0% but there's no way to scale it due to 00:14:34.380 --> 00:14:36.320 align:start position:0% but there's no way to scale it due to the<00:14:34.500> inherent<00:14:34.860> complexity<00:14:35.460> of<00:14:35.610> the<00:14:35.760> EVM<00:14:36.060> we 00:14:36.320 --> 00:14:36.330 align:start position:0% the inherent complexity of the EVM we 00:14:36.330 --> 00:14:38.690 align:start position:0% the inherent complexity of the EVM we can't<00:14:36.570> just<00:14:36.810> have<00:14:37.380> enough<00:14:37.620> people<00:14:37.890> know<00:14:38.430> that 00:14:38.690 --> 00:14:38.700 align:start position:0% can't just have enough people know that 00:14:38.700 --> 00:14:41.330 align:start position:0% can't just have enough people know that much<00:14:38.970> about<00:14:39.000> it<00:14:39.510> to<00:14:39.870> to<00:14:40.380> be<00:14:40.740> able<00:14:40.800> to<00:14:41.010> scale<00:14:41.250> it 00:14:41.330 --> 00:14:41.340 align:start position:0% much about it to to be able to scale it 00:14:41.340 --> 00:14:43.250 align:start position:0% much about it to to be able to scale it up<00:14:41.400> so<00:14:41.700> we<00:14:42.120> wanted<00:14:42.390> more<00:14:42.630> coverage<00:14:43.050> for 00:14:43.250 --> 00:14:43.260 align:start position:0% up so we wanted more coverage for 00:14:43.260 --> 00:14:45.440 align:start position:0% up so we wanted more coverage for Byzantium<00:14:43.950> and<00:14:44.160> started<00:14:45.150> looking<00:14:45.360> into 00:14:45.440 --> 00:14:45.450 align:start position:0% Byzantium and started looking into 00:14:45.450 --> 00:14:47.810 align:start position:0% Byzantium and started looking into fussing<00:14:45.930> one<00:14:46.500> way<00:14:46.650> of<00:14:46.740> doing<00:14:46.920> that<00:14:47.250> would<00:14:47.760> be 00:14:47.810 --> 00:14:47.820 align:start position:0% fussing one way of doing that would be 00:14:47.820 --> 00:14:50.870 align:start position:0% fussing one way of doing that would be to<00:14:48.000> generate<00:14:48.390> test<00:14:49.020> cases<00:14:49.260> randomly<00:14:49.920> execute 00:14:50.870 --> 00:14:50.880 align:start position:0% to generate test cases randomly execute 00:14:50.880 --> 00:14:53.660 align:start position:0% to generate test cases randomly execute them<00:14:51.150> on<00:14:51.420> each<00:14:51.810> EVM<00:14:52.320> use<00:14:52.620> this<00:14:52.860> shared<00:14:53.280> output 00:14:53.660 --> 00:14:53.670 align:start position:0% them on each EVM use this shared output 00:14:53.670 --> 00:14:55.370 align:start position:0% them on each EVM use this shared output format<00:14:54.090> to<00:14:54.330> compare<00:14:54.660> the<00:14:54.780> internal<00:14:55.140> state 00:14:55.370 --> 00:14:55.380 align:start position:0% format to compare the internal state 00:14:55.380 --> 00:14:59.620 align:start position:0% format to compare the internal state after<00:14:55.830> each<00:14:56.070> operation<00:14:57.020> and<00:14:58.020> just<00:14:58.530> repeat<00:14:58.860> it 00:14:59.620 --> 00:14:59.630 align:start position:0% after each operation and just repeat it 00:14:59.630 --> 00:15:02.270 align:start position:0% after each operation and just repeat it this<00:15:00.630> can<00:15:00.810> be<00:15:00.840> done<00:15:01.050> fairly<00:15:01.350> quickly<00:15:01.770> you<00:15:02.160> can 00:15:02.270 --> 00:15:02.280 align:start position:0% this can be done fairly quickly you can 00:15:02.280 --> 00:15:04.160 align:start position:0% this can be done fairly quickly you can do<00:15:02.370> a<00:15:02.400> couple<00:15:02.640> of<00:15:02.790> million<00:15:03.060> tests<00:15:03.330> per<00:15:03.480> day<00:15:03.630> if 00:15:04.160 --> 00:15:04.170 align:start position:0% do a couple of million tests per day if 00:15:04.170 --> 00:15:07.580 align:start position:0% do a couple of million tests per day if you<00:15:04.620> draw<00:15:05.070> binaries<00:15:05.550> and<00:15:05.970> you<00:15:06.330> can<00:15:06.480> use<00:15:06.660> these 00:15:07.580 --> 00:15:07.590 align:start position:0% you draw binaries and you can use these 00:15:07.590 --> 00:15:13.310 align:start position:0% you draw binaries and you can use these for<00:15:07.890> clients<00:15:10.370> the<00:15:11.370> second<00:15:11.760> track<00:15:12.000> is<00:15:12.390> based<00:15:13.020> on 00:15:13.310 --> 00:15:13.320 align:start position:0% for clients the second track is based on 00:15:13.320 --> 00:15:15.350 align:start position:0% for clients the second track is based on Lib<00:15:13.530> foster<00:15:13.920> where<00:15:14.640> we<00:15:14.790> got<00:15:15.000> in<00:15:15.120> touch<00:15:15.300> with 00:15:15.350 --> 00:15:15.360 align:start position:0% Lib foster where we got in touch with 00:15:15.360 --> 00:15:18.560 align:start position:0% Lib foster where we got in touch with the<00:15:16.080> Guido<00:15:16.470> Rankin<00:15:17.190> who<00:15:17.340> has<00:15:17.520> done<00:15:18.210> a<00:15:18.240> lot<00:15:18.420> of 00:15:18.560 --> 00:15:18.570 align:start position:0% the Guido Rankin who has done a lot of 00:15:18.570 --> 00:15:21.110 align:start position:0% the Guido Rankin who has done a lot of fussing<00:15:18.960> and<00:15:19.020> is<00:15:19.140> a<00:15:19.170> real<00:15:19.380> expert<00:15:20.100> on<00:15:20.520> live 00:15:21.110 --> 00:15:21.120 align:start position:0% fussing and is a real expert on live 00:15:21.120 --> 00:15:23.990 align:start position:0% fussing and is a real expert on live foster<00:15:21.510> so<00:15:22.080> live<00:15:22.290> foster<00:15:22.650> is<00:15:22.920> the<00:15:23.190> core<00:15:23.550> of 00:15:23.990 --> 00:15:24.000 align:start position:0% foster so live foster is the core of 00:15:24.000 --> 00:15:27.680 align:start position:0% foster so live foster is the core of American<00:15:24.450> fossil<00:15:25.170> op<00:15:25.290> its<00:15:26.300> foster<00:15:27.300> developer 00:15:27.680 --> 00:15:27.690 align:start position:0% American fossil op its foster developer 00:15:27.690 --> 00:15:30.950 align:start position:0% American fossil op its foster developer mikhalev<00:15:28.440> scheme<00:15:28.970> and<00:15:29.970> it's<00:15:30.750> a<00:15:30.810> bit<00:15:30.930> more 00:15:30.950 --> 00:15:30.960 align:start position:0% mikhalev scheme and it's a bit more 00:15:30.960 --> 00:15:33.560 align:start position:0% mikhalev scheme and it's a bit more sophisticated<00:15:31.380> because<00:15:32.160> it<00:15:32.370> uses<00:15:32.670> code<00:15:33.180> paths 00:15:33.560 --> 00:15:33.570 align:start position:0% sophisticated because it uses code paths 00:15:33.570 --> 00:15:35.900 align:start position:0% sophisticated because it uses code paths and<00:15:34.050> instrumented<00:15:34.620> binaries<00:15:35.040> to<00:15:35.250> detect<00:15:35.610> code 00:15:35.900 --> 00:15:35.910 align:start position:0% and instrumented binaries to detect code 00:15:35.910 --> 00:15:38.180 align:start position:0% and instrumented binaries to detect code paths<00:15:36.270> for<00:15:36.570> any<00:15:36.660> given<00:15:36.930> input<00:15:37.050> and<00:15:37.620> mutating 00:15:38.180 --> 00:15:38.190 align:start position:0% paths for any given input and mutating 00:15:38.190 --> 00:15:39.800 align:start position:0% paths for any given input and mutating those<00:15:38.340> inputs<00:15:38.790> to<00:15:39.000> maximize<00:15:39.450> the<00:15:39.600> code 00:15:39.800 --> 00:15:39.810 align:start position:0% those inputs to maximize the code 00:15:39.810 --> 00:15:43.190 align:start position:0% those inputs to maximize the code coverage<00:15:41.480> and<00:15:42.480> since<00:15:42.720> everything<00:15:42.960> is 00:15:43.190 --> 00:15:43.200 align:start position:0% coverage and since everything is 00:15:43.200 --> 00:15:44.930 align:start position:0% coverage and since everything is instrumental<00:15:43.890> in<00:15:43.980> compiled<00:15:44.370> into<00:15:44.550> one<00:15:44.640> big 00:15:44.930 --> 00:15:44.940 align:start position:0% instrumental in compiled into one big 00:15:44.940 --> 00:15:48.490 align:start position:0% instrumental in compiled into one big binary<00:15:45.590> is<00:15:46.590> an<00:15:46.860> order<00:15:47.160> of<00:15:47.190> magnitude<00:15:47.730> faster 00:15:48.490 --> 00:15:48.500 align:start position:0% binary is an order of magnitude faster 00:15:48.500 --> 00:15:53.780 align:start position:0% binary is an order of magnitude faster to<00:15:49.500> perform<00:15:49.800> this<00:15:50.690> test<00:15:52.340> so<00:15:53.340> I<00:15:53.370> can<00:15:53.400> do<00:15:53.610> about 00:15:53.780 --> 00:15:53.790 align:start position:0% to perform this test so I can do about 00:15:53.790 --> 00:15:58.910 align:start position:0% to perform this test so I can do about 100<00:15:54.150> million<00:15:54.300> tests<00:15:54.570> per<00:15:54.810> day<00:15:56.540> and<00:15:57.860> there<00:15:58.860> was 00:15:58.910 --> 00:15:58.920 align:start position:0% 100 million tests per day and there was 00:15:58.920 --> 00:16:01.640 align:start position:0% 100 million tests per day and there was a<00:15:58.980> spectacular<00:15:59.760> and<00:16:00.270> kind<00:16:00.600> of<00:16:00.660> unexpected 00:16:01.640 --> 00:16:01.650 align:start position:0% a spectacular and kind of unexpected 00:16:01.650 --> 00:16:05.030 align:start position:0% a spectacular and kind of unexpected success<00:16:01.950> in<00:16:02.490> this<00:16:03.080> we've<00:16:04.080> had<00:16:04.320> seven<00:16:04.830> or<00:16:04.920> eight 00:16:05.030 --> 00:16:05.040 align:start position:0% success in this we've had seven or eight 00:16:05.040 --> 00:16:07.700 align:start position:0% success in this we've had seven or eight consensus<00:16:05.700> issues<00:16:06.030> found<00:16:06.420> most<00:16:07.320> of<00:16:07.560> them 00:16:07.700 --> 00:16:07.710 align:start position:0% consensus issues found most of them 00:16:07.710 --> 00:16:11.210 align:start position:0% consensus issues found most of them before<00:16:08.430> the<00:16:08.670> heart<00:16:08.880> Fork<00:16:09.860> one<00:16:10.860> of<00:16:11.040> them 00:16:11.210 --> 00:16:11.220 align:start position:0% before the heart Fork one of them 00:16:11.220 --> 00:16:14.300 align:start position:0% before the heart Fork one of them slightly<00:16:11.610> after<00:16:12.150> the<00:16:12.240> hard<00:16:12.420> work<00:16:12.950> it<00:16:13.950> has<00:16:14.100> been 00:16:14.300 --> 00:16:14.310 align:start position:0% slightly after the hard work it has been 00:16:14.310 --> 00:16:21.020 align:start position:0% slightly after the hard work it has been fixed<00:16:15.000> and<00:16:15.210> patched<00:16:15.510> and<00:16:15.840> released<00:16:16.700> and<00:16:20.030> the 00:16:21.020 --> 00:16:21.030 align:start position:0% fixed and patched and released and the 00:16:21.030 --> 00:16:23.690 align:start position:0% fixed and patched and released and the clients<00:16:21.480> today<00:16:21.690> I<00:16:22.050> would<00:16:22.500> say<00:16:22.530> are<00:16:23.220> more 00:16:23.690 --> 00:16:23.700 align:start position:0% clients today I would say are more 00:16:23.700 --> 00:16:25.220 align:start position:0% clients today I would say are more thoroughly<00:16:24.270> tested<00:16:24.690> than<00:16:24.810> they<00:16:24.990> have<00:16:25.110> ever 00:16:25.220 --> 00:16:25.230 align:start position:0% thoroughly tested than they have ever 00:16:25.230 --> 00:16:28.030 align:start position:0% thoroughly tested than they have ever been<00:16:25.430> in<00:16:26.430> the<00:16:26.490> history<00:16:26.580> of<00:16:26.910> ethereum<00:16:27.180> and 00:16:28.030 --> 00:16:28.040 align:start position:0% been in the history of ethereum and 00:16:28.040 --> 00:16:32.020 align:start position:0% been in the history of ethereum and we're<00:16:29.040> still<00:16:29.280> running<00:16:29.430> fosters<00:16:30.770> 24/7<00:16:31.770> and 00:16:32.020 --> 00:16:32.030 align:start position:0% we're still running fosters 24/7 and 00:16:32.030 --> 00:16:35.030 align:start position:0% we're still running fosters 24/7 and it's<00:16:33.030> been<00:16:33.210> millions<00:16:33.540> of<00:16:33.810> tests<00:16:34.530> done<00:16:34.770> on<00:16:34.830> the 00:16:35.030 --> 00:16:35.040 align:start position:0% it's been millions of tests done on the 00:16:35.040 --> 00:16:38.840 align:start position:0% it's been millions of tests done on the tests<00:16:35.280> off<00:16:35.460> and<00:16:35.760> billions<00:16:36.510> of 00:16:38.840 --> 00:16:38.850 align:start position:0% 00:16:38.850 --> 00:16:43.460 align:start position:0% based<00:16:39.300> on<00:16:39.420> live<00:16:39.600> posture<00:16:42.380> naturally<00:16:43.380> the 00:16:43.460 --> 00:16:43.470 align:start position:0% based on live posture naturally the 00:16:43.470 --> 00:16:45.320 align:start position:0% based on live posture naturally the Castella<00:16:43.800> consensus<00:16:44.310> issues<00:16:44.610> or<00:16:44.970> denial<00:16:45.300> of 00:16:45.320 --> 00:16:45.330 align:start position:0% Castella consensus issues or denial of 00:16:45.330 --> 00:16:48.050 align:start position:0% Castella consensus issues or denial of service<00:16:45.690> issues<00:16:46.080> and<00:16:46.710> if<00:16:47.070> that's<00:16:47.250> really 00:16:48.050 --> 00:16:48.060 align:start position:0% service issues and if that's really 00:16:48.060 --> 00:16:51.410 align:start position:0% service issues and if that's really really<00:16:48.350> concern<00:16:49.350> of<00:16:49.470> you<00:16:49.590> of<00:16:50.250> yours<00:16:50.490> then<00:16:51.390> you 00:16:51.410 --> 00:16:51.420 align:start position:0% really concern of you of yours then you 00:16:51.420 --> 00:16:53.450 align:start position:0% really concern of you of yours then you should<00:16:51.690> run<00:16:51.840> multiple<00:16:52.260> clients<00:16:52.650> and<00:16:52.860> try<00:16:53.400> to 00:16:53.450 --> 00:16:53.460 align:start position:0% should run multiple clients and try to 00:16:53.460 --> 00:16:58.900 align:start position:0% should run multiple clients and try to detect<00:16:54.410> mismatches<00:16:55.410> and<00:16:57.290> you<00:16:58.290> can<00:16:58.440> use<00:16:58.560> the 00:16:58.900 --> 00:16:58.910 align:start position:0% detect mismatches and you can use the 00:16:58.910 --> 00:17:02.300 align:start position:0% detect mismatches and you can use the debug<00:16:59.910> method<00:17:00.300> and<00:17:00.420> guess<00:17:00.600> to<00:17:01.350> find<00:17:01.920> out<00:17:02.100> if 00:17:02.300 --> 00:17:02.310 align:start position:0% debug method and guess to find out if 00:17:02.310 --> 00:17:05.810 align:start position:0% debug method and guess to find out if guess<00:17:02.520> has<00:17:03.230> tagged<00:17:04.230> one<00:17:04.829> of<00:17:04.980> parities<00:17:05.339> connect 00:17:05.810 --> 00:17:05.820 align:start position:0% guess has tagged one of parities connect 00:17:05.820 --> 00:17:11.600 align:start position:0% guess has tagged one of parities connect canonical<00:17:06.390> blocks<00:17:06.660> as<00:17:06.930> bad<00:17:08.780> and<00:17:10.220> key<00:17:11.220> takeaway 00:17:11.600 --> 00:17:11.610 align:start position:0% canonical blocks as bad and key takeaway 00:17:11.610 --> 00:17:14.060 align:start position:0% canonical blocks as bad and key takeaway here<00:17:11.640> is<00:17:11.880> that<00:17:12.209> all<00:17:12.480> everyone<00:17:13.350> here<00:17:13.560> are 00:17:14.060 --> 00:17:14.070 align:start position:0% here is that all everyone here are 00:17:14.070 --> 00:17:16.490 align:start position:0% here is that all everyone here are target's<00:17:14.699> for<00:17:14.790> attacker<00:17:15.240> it's<00:17:15.959> involved 00:17:16.490 --> 00:17:16.500 align:start position:0% target's for attacker it's involved 00:17:16.500 --> 00:17:19.939 align:start position:0% target's for attacker it's involved because<00:17:16.620> it's<00:17:16.949> important<00:17:18.050> so<00:17:19.050> be<00:17:19.079> paranoid 00:17:19.939 --> 00:17:19.949 align:start position:0% because it's important so be paranoid 00:17:19.949 --> 00:17:23.630 align:start position:0% because it's important so be paranoid and<00:17:20.370> be<00:17:20.670> proactive<00:17:21.060> and<00:17:21.630> work<00:17:22.050> on<00:17:22.640> improving 00:17:23.630 --> 00:17:23.640 align:start position:0% and be proactive and work on improving 00:17:23.640 --> 00:17:26.420 align:start position:0% and be proactive and work on improving the<00:17:23.940> security<00:17:24.120> and<00:17:24.750> your<00:17:24.900> resilience<00:17:25.470> and<00:17:25.800> how 00:17:26.420 --> 00:17:26.430 align:start position:0% the security and your resilience and how 00:17:26.430 --> 00:17:30.410 align:start position:0% the security and your resilience and how you<00:17:26.490> can<00:17:26.790> handle<00:17:27.750> tax<00:17:28.910> that's<00:17:29.910> about<00:17:30.090> it<00:17:30.270> for 00:17:30.410 --> 00:17:30.420 align:start position:0% you can handle tax that's about it for 00:17:30.420 --> 00:17:39.180 align:start position:0% you can handle tax that's about it for me<00:17:30.540> thank<00:17:30.720> you 00:17:39.180 --> 00:17:39.190 align:start position:0% 00:17:39.190 --> 00:17:46.769 align:start position:0% [Music]