DCSG1 - Solidity Smart Contracts - Kennashka DeSilva
Source: YouTube · DEFCONConference · published Sep 30, 2026 · 34:52
BLUF: This presentation details critical Solidity smart contract vulnerabilities, including re-entrancy and Oracle manipulation, while highlighting a major 2026 cross-chain bridge exploit caused by misplaced trust in off-chain verifiers rather than code bugs 2:15.
Key Takeaways:
• Re-entrancy Attacks: Attackers exploit functions that make external calls before updating state, allowing recursive entry to drain funds 6:56.
• Oracle Manipulation: By using flash loans to distort Automated Market Maker (AMM) prices, attackers can trick lending protocols into accepting inflated collateral values 8:50.
• Access Control Failures: Missing or improper role-based checks allow unauthorized users to execute sensitive administrative functions, leading to fund theft 13:50.
• Flash Loan Amplification: Attackers borrow large sums without collateral to manipulate market prices, enabling over-borrowing and immediate profit extraction in a single transaction 17:28.
• Logic Flaws & Invariants: Critical bugs often stem from trusting unvalidated inputs or incorrect operation order; invariant testing ensures core rules remain true regardless of state changes 19:30.
• 2026 Kelp DAO Exploit: A $292 million loss occurred not via smart contract bugs, but by compromising off-chain RPC nodes and verifier networks to inject fake cross-chain messages 21:57.
• Secure Testing Methodologies: Researchers must use isolated environments like Foundry and Anvil to simulate attacks safely, avoiding mainnet interactions and adhering to legal permissions 27:30.
The evolution of blockchain security threats emphasizes that the next major exploits will likely target infrastructure trust models and off-chain data integrity rather than just on-chain code logic.
Sources:
- 2:15 Introduction and educational disclaimer for ethical security research.
- 6:56 Explanation of re-entrancy attack mechanics and vulnerable code patterns.
- 8:50 Diagram of Oracle manipulation using flash loans and AMM price distortion.
- 13:50 Analysis of access control failures and the importance of role-based permissions.
- 17:28 Detailed breakdown of flash loan amplification attacks.
- 19:30 Discussion on logic flaws and the necessity of invariant monitoring.
- 21:57 Case study of the 2026 Kelp DAO bridge exploit targeting off-chain verifiers.
- 27:30 Overview of security tooling like Foundry, Slither, and local fork testing.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
All right. So, once again, please join me in welcoming Kaneshka and Retro. Today, they will be delivering the talk titled Solidity Smart Contract Attacks. Without further ado, I'll be handing the time over to Kaneshka to kick off the talk. Please take it away. >> Hello everyone. Welcome to our talk, Solidity Smart Contract Attacks by Kaneshka De Silva and Retro. >> Hey guys, I'm Retro. I'm a security researcher for Coast. I'm working on the fixing blockchain protocols. Yeah, thank you. Let's move on. >> Perfect. So, hello everyone again. I'm Kaneshka De Silva. So, I am a cybersecurity analyst and a Web3 hacker. I'm a part of Hack Miami, which is our local Def Con and Black Hat group, uh which is based in Miami, Florida, US. Um I'm a part of a group called Black Girls in Cyber as well, and …