D4C : Fuzzing the Ethereum Network
{"type": "project", "title": "D4C : Fuzzing the Ethereum Network", "website": "https://github.com/mohasdev/D4C", "createdAt": 1700574414950, "userGithub": "mohasdev", "credentials": {"github": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..C2Ksk9Gafto8uW_pcrYDk2InphL7DE3vPgFTBUbR4ur1KUBIfp9IpV4d01spOaCGoxqT56WPumXV-3CBn9_KCg", "type": "Ed25519Signature2018", "created": "2023-11-22T10:52:56.671Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2023-11-22T10:52:56.671Z", "expirationDate": "2024-02-20T10:52:56.671Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x0DE65caB88C45DeCf8c84dc882fAc9073f216bCA", "hash": "v0.0.0:lrxYo4YKop2gohlC9Vz8MBmcg+wtkjsncJxQjN7QDiw=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextGithubOrg#mohasdevs#120682395"}}, "twitter": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..vVGAs7MlNNpMopDEphtMi0nxh8TF5o3RZ5oxIb5qYUMbPIsdsYUglkbvNCdnTOj6LM1FMd5wm8BrHZlSAGeQCg", "type": "Ed25519Signature2018", "created": "2023-11-21T13:30:00.182Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2023-11-21T13:30:00.181Z", "expirationDate": "2024-02-19T13:30:00.181Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x0DE65caB88C45DeCf8c84dc882fAc9073f216bCA", "hash": "v0.0.0:jdTZhfy5YRgaoj6VJY+UFVDNZaIuVk7KqNEFPn2qBdo=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextTwitter#mohasdev"}}}, "description": "D4C is malicious version of Geth for fuzzing the devp2p protocols of ethereum.\n\n## Problem\n\nIn order to ensure the good running of Ethereum, it is imperative that it remain highly secure. As a large blockchain, Ethereum represents a target for potential hackers.\n\nThe Ethereum network and the different protocols of the devp2p play an essential role in enabling communication between nodes, which is an essential element for the operation of the protocol.\n\nVulnerabilities or errors in this network could cause significant problems. It is therefore crucial to guarantee the maximum security of the network and exchanges between nodes.\n\nTo avoid that, ethereum contributors have developed a lot of tools, including fuzzers.\n\nFuzzer programs are programs that provide invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks.\n\nThere is a lot of Fuzzer projects built by ethereum community and protocol contributors but one thing we can notice is that there is no fuzzer interacting with the devp2p using an execution client.\n\n## Solution\n\nD4C is a modified version of go-ethereum client who send fuzzed and malicious messages to others clients in order to find bugs and security vulnerabilities.\n\nit can correctly connect to the Ethereum network and perform fuzzing on messages.\n\nThe project was able to find over 30 bugs on various Ethereum execution clients and also a security vulnerability .\n\n\n\n", "projectGithub": "mohasdevs", "projectTwitter": "mohasdev"}