王建元

Anatomist Security / Co-founder

Kevin Wang (@kevingwn_) is the co-founder of Anatomist Security and a member of the Balsn CTF Team. He has achieved top-three results in multiple international CTF competitions, including DEFCON and HITCON. He has also been a speaker at events like CYBERSEC and the HITCON CMT Annual Conference. Additionally, he discovered several CVEs.

SPEECH
4/17 (Thu.) 14:00 - 14:30 7F 702 Web 3 Security Forum
Breaking Down Web3 Attack Surfaces: A Dive into Consensus, VMs, Smart Contracts, and Toolchains

This agenda will comprehensively explore multiple attack surfaces in Web3, analyzing from the consensus layer to the execution layer (VM), then to the application layer (smart contracts) and toolchains (compilers), combined with real-world examples of actual cases we have discovered.

First, we will start with the consensus layer, introducing the core protocols in blockchain, such as Proof-of-Work and Proof-of-Stake, and discussing vulnerabilities in consensus mechanisms and possible attack methods. Next, we will analyze the execution layer, focusing on the virtual machine (VM). Using Solana's SVM, we will explore potential attack methods, such as race conditions caused by parallel computation, backward compatibility issues when updating the execution layer that could lead to denial of service (DoS) attacks, and more severe remote code execution (RCE) vulnerabilities. In the application layer, we will focus on the security issues of smart contracts, discussing how to defend against common attacks. Finally, we will explore the often-overlooked security of toolchains, particularly compiler vulnerabilities, and how mistakes when these tools convert high-level code into executable code can become an attack vector for exploiting smart contracts.