#RomHack2022 - Davide TheZero - Security in a Immutable web3 World: Breaching Smart Contracts
Reviews #RomHack2022 - Davide TheZero - Security in a Immutable web3 World: Breaching Smart Contracts and evaluates key implications for security practitioners.
Summary
Web3 security primer
Davide TheZero of Shielder walks from blockchain basics through smart-contract exploitation without ICO hype. Solidity compiles to EVM bytecode; ABI metadata defines contract interfaces similar to Swagger or symbol files for reversers. Execution requests broadcast to the network mutate on-chain state.
Immutable code, upgradeable reality
Deployed contracts are immutable, yet proxy patterns delegate calls to implementation contracts owners can swap via upgrade functions. This preserves user-facing addresses while changing behavior—creating trust and audit challenges when owners can redirect logic.
Web2 skills transfer
The talk bridges web2 researchers into web3 by covering EVM semantics, common vulnerability classes, and root-cause analysis of major historical breaches. Closing remarks stress that "immutable" blockchains still host mutable trust assumptions through admin keys, oracles, and upgradeable proxies.
Related talks
RomHack·40 min
Sina Kheirkhah
Investigates sina Kheirkhah - Unveiling the Ivanti vulnerability: from discovery to exploitation and evaluates key implications for security practitioners.
RomHack·53 min
Adnan Khan
Details adnan Khan - The dark side of GitHub Actions and evaluates key implications for security practitioners.
RomHack·38 min
PlayStation 4 Remote Kernel Exploitation
Explores andy Nguyen and evaluates key implications for security practitioners.