Skip to content
By using Twitter’s services you agree to our Cookies Use. We and our partners operate globally and use cookies, including for analytics, personalisation, and ads.
  • Home Home Home, current page.
  • Moments Moments Moments, current page.

Saved searches

  • Remove
  • In this conversation
    Verified accountProtected Tweets @
Suggested users
  • Verified accountProtected Tweets @
  • Verified accountProtected Tweets @
  • Language: English
    • Bahasa Indonesia
    • Bahasa Melayu
    • Català
    • Čeština
    • Dansk
    • Deutsch
    • English UK
    • Español
    • Filipino
    • Français
    • Hrvatski
    • Italiano
    • Magyar
    • Nederlands
    • Norsk
    • Polski
    • Português
    • Română
    • Slovenčina
    • Suomi
    • Svenska
    • Tiếng Việt
    • Türkçe
    • Ελληνικά
    • Български език
    • Русский
    • Српски
    • Українська мова
    • עִבְרִית
    • العربية
    • فارسی
    • मराठी
    • हिन्दी
    • বাংলা
    • ગુજરાતી
    • தமிழ்
    • ಕನ್ನಡ
    • ภาษาไทย
    • 한국어
    • 日本語
    • 简体中文
    • 繁體中文
  • Have an account? Log in
    Have an account?
    · Forgot password?

    New to Twitter?
    Sign up
dguido's profile
Dan Guido
Dan Guido
Dan Guido
@dguido

Tweets

Dan Guido

@dguido

CEO @trailofbits, organizer @EmpireHacking, director @hack_secure. Open DMs.

Brooklyn, NY
trailofbits.com
Joined April 2008

Tweets

  • © 2018 Twitter
  • About
  • Help Center
  • Terms
  • Privacy policy
  • Cookies
  • Ads info
Dismiss
Previous
Next

Go to a person's profile

Saved searches

  • Remove
  • In this conversation
    Verified accountProtected Tweets @
Suggested users
  • Verified accountProtected Tweets @
  • Verified accountProtected Tweets @

Promote this Tweet

Block

  • Tweet with a location

    You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more

    Your lists

    Create a new list


    Under 100 characters, optional

    Privacy

    Copy link to Tweet

    Embed this Tweet

    Embed this Video

    Add this Tweet to your website by copying the code below. Learn more

    Add this video to your website by copying the code below. Learn more

    Hmm, there was a problem reaching the server.

    By embedding Twitter content in your website or app, you are agreeing to the Twitter Developer Agreement and Developer Policy.

    Preview

    Why you're seeing this ad

    Log in to Twitter

    · Forgot password?
    Don't have an account? Sign up »

    Sign up for Twitter

    Not on Twitter? Sign up, tune into the things you care about, and get updates as they happen.

    Sign up
    Have an account? Log in »

    Two-way (sending and receiving) short codes:

    Country Code For customers of
    United States 40404 (any)
    Canada 21212 (any)
    United Kingdom 86444 Vodafone, Orange, 3, O2
    Brazil 40404 Nextel, TIM
    Haiti 40404 Digicel, Voila
    Ireland 51210 Vodafone, O2
    India 53000 Bharti Airtel, Videocon, Reliance
    Indonesia 89887 AXIS, 3, Telkomsel, Indosat, XL Axiata
    Italy 4880804 Wind
    3424486444 Vodafone
    » See SMS short codes for other countries

    Confirmation

     

    Welcome home!

    This timeline is where you’ll spend most of your time, getting instant updates about what matters to you.

    Tweets not working for you?

    Hover over the profile pic and click the Following button to unfollow any account.

    Say a lot with a little

    When you see a Tweet you love, tap the heart — it lets the person who wrote it know you shared the love.

    Spread the word

    The fastest way to share someone else’s Tweet with your followers is with a Retweet. Tap the icon to send it instantly.

    Join the conversation

    Add your thoughts about any Tweet with a Reply. Find a topic you’re passionate about, and jump right in.

    Learn the latest

    Get instant insight into what people are talking about now.

    Get more of what you love

    Follow more accounts to get instant updates about topics you care about.

    Find what's happening

    See the latest conversations about any topic instantly.

    Never miss a Moment

    Catch up instantly on the best stories happening as they unfold.

    1. Dan Guido‏ @dguido Feb 22

      Before I begin, I think the MAIAN analysis tool is a useful advance to the field and we plan to incorporate some of their features into Manticore in the coming months. My main issue is with their evaluation of results.

      2 replies 1 retweet 10 likes
      Show this thread
    2. Dan Guido‏ @dguido Feb 22

      In their paper, a “greedy contract” is any contract that can lock ethers. However, ALL CONTRACTS compiled with solc <= 0.3.6 without a ‘withdraw’ function are “greedy contracts” and are included in their totals.

      1 reply 0 retweets 7 likes
      Show this thread
    3. Dan Guido‏ @dguido Feb 22

      This is because solc < 0.4.0 allowed any function to receive ethers. This behavior has since changed and current versions of solc use the “payable” attribute to denote functions that can receive ether.

      1 reply 0 retweets 6 likes
      Show this thread
    4. Dan Guido‏ @dguido Feb 22

      To really drive this home, even their example “true positive” issue in section 5.2 is a greedy contract due to this behavior of solc. This vastly inflates their numbers beyond what reasonably should get counted.

      1 reply 0 retweets 6 likes
      Show this thread
    5. Dan Guido‏ @dguido Feb 22

      Next issue: the authors indicate they found only 1,524 _distinct_ greedy contracts. ~30k comes from instances of the issues. There is no discussion of the distribution. Are there a few contracts that repeat the vast majority of these issues? We don’t know!

      1 reply 0 retweets 6 likes
      Show this thread
    6. Dan Guido‏ @dguido Feb 22

      Even further skewing their results, they neglect to discuss that _many_ contracts deployed to public chains are there only for testing. Better benchmarks would account for usage.

      1 reply 0 retweets 7 likes
      Show this thread
    7. Dan Guido‏ @dguido Feb 22

      In our own testing at @trailofbits, we have tools (e.g., Slither and others) that have detected _thousands_ of vulnerabilities on the public Ethereum blockchain, but most of the contracts affected are not used or are useless.

      2 replies 4 retweets 10 likes
      Show this thread
    8. Dan Guido‏ @dguido Feb 22

      We think our work contributes to the field and have found many issues for our clients with them, but we have resisted fantastical headlines like the ones in this paper because we are aware of the caveats.

      1 reply 1 retweet 6 likes
      Show this thread
    9. Dan Guido‏ @dguido Feb 22

      Many of the articles written about this paper have neglected to note that it was never accepted to a peer-reviewed journal, a process which exists to root out exactly these issues of bias and methodology.

      1 reply 1 retweet 6 likes
      Show this thread
    10. Dan Guido‏ @dguido Feb 22

      Further, many journalists writing about this paper have only interviewed its authors for commentary, neglecting to speak with industry experts. Please consider myself and the team @trailofbits a source when writing about blockchain security!

      1 reply 1 retweet 16 likes
      Show this thread
      Dan Guido‏ @dguido Feb 22

      In order to move this conversation forward, we’re calling on the MAIAN team to release the raw data they used to discover these issues, or share it privately with a qualified team capable of reviewing it.

      2:08 PM - 22 Feb 2018
      • 2 Retweets
      • 8 Likes
      • Yoppy Halilintar UnnamedOutsider 37.419857 Calle Svensson antiprosynthesis Joe Parker ETHGasStation The Architect Alex Radocea
      3 replies 2 retweets 8 likes
        1. New conversation
        2. Dan Guido‏ @dguido Feb 22

          Oops! Lost in Twitter's threaded replies: "For example, they could have only counted contracts with at least X transactions or contracts that received more than Y ethers. Defining some kind of low watermark is essential for reviewing contracts on public chains."

          1 reply 0 retweets 2 likes
          Show this thread
        3. Dan Guido‏ @dguido Feb 22

          Dan Guido Retweeted Jay Little

          Quoting a few tweets so they show up in threaded replies: "The only contract address cited in this paper never had any ether sent to it"https://twitter.com/computerality/status/966802544247869440 …

          Dan Guido added,

          Jay Little @computerality
          Replying to @dguido
          The only contract address cited in this paper never had any ether sent to it https://etherscan.io/address/0x4671ebe586199456ca28ac050cc9473cbac829eb …
          1 reply 1 retweet 4 likes
          Show this thread
        4. Dan Guido‏ @dguido Feb 22

          Dan Guido Retweeted more alien

          Ethereum mainnet was once used as a testnethttps://twitter.com/maurelian_/status/966810648171765760 …

          Dan Guido added,

          more alien @maurelian_
          People often forget that the Ethereum main net was once cheap enough to be used as it's own testnet. https://twitter.com/dguido/status/966795503479480320 …
          1 reply 1 retweet 4 likes
          Show this thread
        5. Dan Guido‏ @dguido Feb 22

          Dan Guido Retweeted Alex Radocea

          It's 2018. If you publish research, publish your data too.https://twitter.com/defendtheworld/status/966801561694490628 …

          Dan Guido added,

          Alex Radocea @defendtheworld
          Replying to @dguido
          Agreed. In the age of github, which is right now, one of the wonders of Academia is seeing data and code for reproducible results. Ten years ago college students had to forge around AFS for remote home directories for these things
          1 reply 4 retweets 24 likes
          Show this thread
        6. End of conversation
        1. New conversation
        2. Alex Radocea‏ @defendtheworld Feb 22
          Replying to @dguido

          Agreed. In the age of github, which is right now, one of the wonders of Academia is seeing data and code for reproducible results. Ten years ago college students had to forge around AFS for remote home directories for these things

          2 replies 2 retweets 6 likes
        3. Braden Thomas‏ @drspringfield Feb 22
          Replying to @defendtheworld @dguido

          YOU DID WHAT

          1 reply 0 retweets 1 like
        4. Alex Radocea‏ @defendtheworld Feb 23
          Replying to @drspringfield @dguido

          There's this thing called Internet2 where students of universities can choose to share their home directories over AndrewFS

          0 replies 0 retweets 2 likes
        5. End of conversation
        1. Jay Little‏ @computerality Feb 22
          Replying to @dguido

          The only contract address cited in this paper never had any ether sent to it https://etherscan.io/address/0x4671ebe586199456ca28ac050cc9473cbac829eb …

          0 replies 2 retweets 2 likes
          Thanks. Twitter will use this to make your timeline better. Undo
          Undo

      Loading seems to be taking a while.

      Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

        Promoted Tweet

        false

        • © 2018 Twitter
        • About
        • Help Center
        • Terms
        • Privacy policy
        • Cookies
        • Ads info