ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®éèŠãªåŽé¢ãæ¢æ±ããã»ãã¥ãªãã£è匱æ§ãç£æ»æ¹æ³è«ããã¹ããã©ã¯ãã£ã¹ãããã³åæ£åã¢ããªã±ãŒã·ã§ã³ã»ãã¥ãªãã£ã®å°æ¥ã«ã€ããŠèª¬æããŸãã
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ïŒã»ãã¥ãªãã£è匱æ§åæã®å æ¬çã¬ã€ã
ã¹ããŒãã³ã³ãã©ã¯ãã¯ãã³ãŒãã§èšè¿°ããããããã¯ãã§ãŒã³ãããã¯ãŒã¯äžã«ãããã€ãããèªå·±å®è¡åã®å¥çŽã§ãããããã¯ã忣åéèïŒDeFiïŒãã©ãããã©ãŒã ãããµãã©ã€ãã§ãŒã³ç®¡çã·ã¹ãã ãŸã§ãå¹ åºã忣åã¢ããªã±ãŒã·ã§ã³ïŒdAppsïŒã匷åããŸãããã ããã¹ããŒãã³ã³ãã©ã¯ãã¯ãé倧ãªçµæžçæå€±ãšè©å€ã®äœäžã«ã€ãªããå¯èœæ§ã®ããã»ãã¥ãªãã£è匱æ§ã®åœ±é¿ãåãããããªã£ãŠããŸãããã®èšäºã§ã¯ãã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®å æ¬çãªã¬ã€ããæäŸããäž»èŠãªæŠå¿µãäžè¬çãªè匱æ§ãç£æ»æ¹æ³è«ãããã³åæ£åã¢ããªã±ãŒã·ã§ã³ã®ã»ãã¥ãªãã£ã確ä¿ããããã®ãã¹ããã©ã¯ãã£ã¹ã«ã€ããŠèª¬æããŸãã
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ãšã¯äœã§ããïŒ
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã¯ãæœåšçãªã»ãã¥ãªãã£è匱æ§ããã°ãããã³ããžãã¯ãšã©ãŒãç¹å®ããããã«ãã¹ããŒãã³ã³ãã©ã¯ãã³ãŒããäœç³»çã«ã¬ãã¥ãŒããã³åæããããã»ã¹ã§ããããã¯ãå®å šã§ãªãã³ãŒãããããã¯ãã§ãŒã³ã«ãããã€ããããšã«é¢é£ãããªã¹ã¯ã軜æžããã®ã«åœ¹ç«ã€ãããããããdAppã®éçºã©ã€ããµã€ã¯ã«ã«ãããéèŠãªã¹ãããã§ããåŸæ¥ã®ãœãããŠã§ã¢ãšã¯ç°ãªããã¹ããŒãã³ã³ãã©ã¯ãã¯äžåºŠãããã€ããããšäžå€ã§ããããããã€åŸã«çºèŠãããè匱æ§ãç°¡åã«ä¿®æ£ããããšã¯ã§ããŸãããããã«ããã培åºçãªç£æ»ãããã«éèŠã«ãªããŸãã
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®äž»ãªç®æšã¯ãã³ã³ãã©ã¯ããæå³ãããšããã«æ©èœããã»ãã¥ãªãã£äžã®æ¬ é¥ããªãããã¹ããã©ã¯ãã£ã¹ã«æºæ ããŠããããšã確èªããããšã§ããããã«ã¯ãæœåšçãªåé¡ãç¹å®ããŠå¯ŸåŠããããã®ãæåã«ããã³ãŒãã¬ãã¥ãŒãèªååæããŒã«ãããã³ãã¹ãææ³ã®çµã¿åãããå«ãŸããŸãã
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã¯ãªãéèŠã§ããïŒ
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®éèŠæ§ã¯ãã©ãã ã匷調ããŠãããããããšã¯ãããŸãããè匱ãªã¹ããŒãã³ã³ãã©ã¯ãããããã€ããããšã®çµæã¯æ·±å»ã§ãããæ¬¡ã®ããã«ãªããŸãã
- çµæžçæå€±ïŒæªæã®ããã¢ã¯ã¿ãŒãè匱æ§ãæªçšããŠãè³éãçãã ããã³ã³ãã©ã¯ãããžãã¯ãæäœããããdAppã®æ©èœãäžæãããããå¯èœæ§ããããŸãã
- è©å€ã®äœäžïŒã»ãã¥ãªãã£äŸµå®³ã¯ããŠãŒã¶ãŒã®ä¿¡é Œãæãªãããããžã§ã¯ããšãã®ããŒã ã®è©å€ãå·ã€ããå¯èœæ§ããããŸãã
- æ³çããã³èŠå¶äžã®ãªã¹ã¯ïŒäžéšã®æ³åã§ã¯ãå®å šã§ãªãã¹ããŒãã³ã³ãã©ã¯ãããããã€ãããšãæ³ç責任ããã³èŠå¶äžã®ããã«ãã£ãçºçããå¯èœæ§ããããŸãã
- ãŠãŒã¶ãŒã®ä¿¡é Œã®åªå€±ïŒãŠãŒã¶ãŒã¯ãã»ãã¥ãªãã£è匱æ§ã®å±¥æŽãããdAppãä¿¡é ŒããŠäœ¿çšããå¯èœæ§ãäœããªããŸãã
æè¿ã®æŽå²ã«ã¯ãæ°çŸäžãã«ã®æå€±ã«ã€ãªããæªçšã®äŸãæ£èŠãããŸããç£æ»ã¯ãããã®æå€±ãé²ãããã©ãããã©ãŒã ãžã®ä¿¡é Œã確ç«ããããšãã§ããŸãã
äžè¬çãªã¹ããŒãã³ã³ãã©ã¯ãã®è匱æ§
äžè¬çãªã¹ããŒãã³ã³ãã©ã¯ãã®è匱æ§ãçè§£ããããšã¯ãéçºè ãšç£æ»è ã®äž¡æ¹ã«ãšã£ãŠäžå¯æ¬ ã§ããæãäžè¬çãªè匱æ§ã®çš®é¡ã次ã«ç€ºããŸãã
1. åå ¥å¯èœæ§
åå ¥å¯èœæ§ã¯ãã³ã³ãã©ã¯ããç¬èªã®ç¶æ ãæŽæ°ããåã«å¥ã®ã³ã³ãã©ã¯ããžã®å€éšåŒã³åºããè¡ãå Žåã«çºçããè匱æ§ã§ããããã«ãããå€éšã³ã³ãã©ã¯ãã¯ãå ã®ã³ã³ãã©ã¯ããããžãã¯ã®å®è¡ãçµäºããåã«ãå ã®ã³ã³ãã©ã¯ãã«è€æ°åã³ãŒã«ããã¯ã§ããŸããåå ¥æ»æã¯ãDAOããã¯ã§æªåé«ãæªçšãããæ°çŸäžãã«çžåœã®EtherãçãŸããŸããã
äŸïŒ
ãŠãŒã¶ãŒãEtherãåŒãåºãããšãã§ããã³ã³ãã©ã¯ãã«ã€ããŠèããŠã¿ãŸããã³ã³ãã©ã¯ããå éšæ®é«ãæŽæ°ããåã«EtherããŠãŒã¶ãŒã«éä¿¡ããå ŽåããŠãŒã¶ãŒã¯ã³ã³ãã©ã¯ãã«ã³ãŒã«ããã¯ããæ®é«ãæŽæ°ãããåã«Etherãè€æ°ååŒãåºãããšãã§ããŸãã
軜æžçïŒ
- ããã§ãã¯-广-ã€ã³ã¿ã©ã¯ã·ã§ã³ããã¿ãŒã³ã䜿çšããŸããããã«ã¯ãå€éšåŒã³åºããè¡ãåã«ãã§ãã¯ãå®è¡ããå€éšåŒã³åºããè¡ãåã«ç¶æ ãæŽæ°ããå€éšã³ã³ãã©ã¯ããšã®ã€ã³ã¿ã©ã¯ã·ã§ã³ãå¶éããããšãå«ãŸããŸãã
- `transfer()`ãŸãã¯`send()`颿°ã䜿çšããŠEtherãéä¿¡ããŸãããããã®é¢æ°ã¯ãåä¿¡è ã䜿çšã§ããã¬ã¹ã®éãå¶éããã³ã³ãã©ã¯ããžã®ã³ãŒã«ããã¯ãé²ããŸãã
- 颿°ãååž°çã«åŒã³åºãããã®ãé²ãåå ¥ã¬ãŒããå®è£ ããŸãã
2. æŽæ°ã®ãªãŒããŒãããŒãšã¢ã³ããŒãããŒ
æŽæ°ã®ãªãŒããŒãããŒãšã¢ã³ããŒãããŒã¯ãç®è¡æŒç®ã®çµæããçµæãæ ŒçŽããããã«äœ¿çšãããŠããããŒã¿åã®ç¯å²å€ã®å€ã«ãªãå Žåã«çºçããŸããããšãã°ã笊å·ãªã8ãããæŽæ°ïŒuint8ïŒã255ãè¶ ããŠã€ã³ã¯ãªã¡ã³ãããããšã0ã«ã©ããã¢ã©ãŠã³ãããŸããåæ§ã«ã0æªæºã«ãã¯ãªã¡ã³ãããããšã255ã«ã©ããã¢ã©ãŠã³ãããŸãã
äŸïŒ
ããŒã¯ã³ã®ç·äŸçµŠéã笊å·ãªãæŽæ°ã§è¡šãããããŒã¯ã³ã³ã³ãã©ã¯ãã«ã€ããŠèããŠã¿ãŸããã³ã³ãã©ã¯ãã§ãŠãŒã¶ãŒãæ°ããããŒã¯ã³ããã³ãã§ããå Žåãç·äŸçµŠéãæŽæ°ã®æå€§å€ãè¶ ãããšãå°ããå€ã«ã©ããã¢ã©ãŠã³ãããæ»æè ãç¡å¶éã®æ°ã®ããŒã¯ã³ããã³ãã§ããããã«ãªãå¯èœæ§ããããŸãã
軜æžçïŒ
- OpenZeppelinã®SafeMathã©ã€ãã©ãªãªã©ã®å®å šãªç®è¡ã©ã€ãã©ãªã䜿çšããŸããããã¯ããªãŒããŒãããŒãšã¢ã³ããŒãããŒããã§ãã¯ããçºçããå Žåã¯ãã©ã³ã¶ã¯ã·ã§ã³ãå ã«æ»ã颿°ãæäŸããŸãã
- ãªãŒããŒãããŒãšã¢ã³ããŒãããŒã®å¯èœæ§ãæžããããã«ãuint256ãªã©ã®ãã倧ããªæŽæ°ããŒã¿åã䜿çšããŸãã
3. ãµãŒãã¹æåŠïŒDoSïŒ
ãµãŒãã¹æåŠïŒDoSïŒæ»æã¯ãã¹ããŒãã³ã³ãã©ã¯ãã®éåžžã®æ©èœãäžæããæ£åœãªãŠãŒã¶ãŒããã®ãµãŒãã¹ã«ã¢ã¯ã»ã¹ã§ããªãããã«ããããšãç®çãšããŠããŸããDoSã®è匱æ§ã¯ãã¬ã¹å¶éã®åé¡ããããã¯ã¹ã¿ãŒãã£ã³ã°ãããã³äºæããªããªããŒãæ¡ä»¶ãªã©ãããŸããŸãªåå ããçºçããå¯èœæ§ããããŸãã
äŸïŒ
ãŠãŒã¶ãŒããªãŒã¯ã·ã§ã³ã«åå ã§ããã³ã³ãã©ã¯ãã«ã€ããŠèããŠã¿ãŸããã³ã³ãã©ã¯ããå ¥æè ã®ãªã¹ããå埩åŠçããŠåè ãæ±ºå®ããå Žåãæ»æè ã¯å€§éã®ãããŒå ¥æè ãäœæããŠãå埩åŠçã§éå°ãªã¬ã¹ãæ¶è²»ããããã©ã³ã¶ã¯ã·ã§ã³ã倱æãããå¯èœæ§ããããŸããããã«ãããæ£åœãªå ¥æè ããªãŒã¯ã·ã§ã³ã«åå ã§ããªããªãå¯èœæ§ããããŸãã
軜æžçïŒ
- éå°ãªã¬ã¹ãæ¶è²»ããå¯èœæ§ããããããéæçã«ãŒããšå埩åŠçãåé¿ããŸãã
- ããŒãžããŒã·ã§ã³ãŸãã¯ãããåŠçãå®è£ ããŠãåãã©ã³ã¶ã¯ã·ã§ã³ã«å¿ èŠãªã¬ã¹ã®éãå¶éããŸãã
- ããã·ã¥æ¯æãã§ã¯ãªããã«æ¯æãã䜿çšããŸãããã«æ¯æãã¯ããŠãŒã¶ãŒãèªåã®ããŒã¹ã§è³éãåŒãåºãããšãã§ãããããã¬ã¹å¶éã®åé¡ã®ãªã¹ã¯ã軜æžãããŸãã
- DoSæ»æãæ€åºãããå Žåã«ãã³ã³ãã©ã¯ãã®ç¹å®ã®æ©èœãäžæçã«ç¡å¹ã«ã§ãããµãŒããããã¬ãŒã«ãŒãå®è£ ããŸãã
4. ã¿ã€ã ã¹ã¿ã³ãã®äŸåæ§
ã¹ããŒãã³ã³ãã©ã¯ãã¯ãçŸåšã®ãããã¯ã®ã¿ã€ã ã¹ã¿ã³ãã«ã¢ã¯ã»ã¹ã§ããŸããããã¯ããããã¯ããã€ãã³ã°ãããã€ããŒã«ãã£ãŠæäŸãããŸãããã ãããã€ããŒã¯ã¿ã€ã ã¹ã¿ã³ããããçšåºŠå¶åŸ¡ã§ããç¹å®ã®å¶éå ã§æäœã§ããŸããã³ã³ãã©ã¯ããã©ã³ãã çªå·ã®çæãæéäŸåã®æäœãªã©ã®éèŠãªããžãã¯ã«ã¿ã€ã ã¹ã¿ã³ãã䜿çšããŠããå Žåãããã¯è匱æ§ã«ã€ãªããå¯èœæ§ããããŸãã
äŸïŒ
ãããã¯ã®ã¿ã€ã ã¹ã¿ã³ãã䜿çšããŠä¹±æ°ãçæããã®ã£ã³ãã«ã³ã³ãã©ã¯ãã«ã€ããŠèããŠã¿ãŸããæ»æè ã¯ãç®çã®çµæãæ¯æããã¿ã€ã ã¹ã¿ã³ãã§ãããã¯ããã€ãã³ã°ããããšã«ãããã²ãŒã ã®çµæã«åœ±é¿ãäžããããšãã§ããŸãã
軜æžçïŒ
- éèŠãªããžãã¯ã«ã¯ãããã¯ã®ã¿ã€ã ã¹ã¿ã³ãã䜿çšããªãã§ãã ããã
- Chainlink VRFãRANDAOãªã©ã®ãããä¿¡é Œæ§ã®é«ãä¹±æ°æºã䜿çšããŸãã
- ã¿ã€ã ã¹ã¿ã³ãã劥åœãªç¯å²å ã«ããããšã確èªããããã®ã»ãŒãã¬ãŒããå®è£ ããŸãã
5. Delegatecall
`delegatecall`ã¯ãã³ã³ãã©ã¯ããåŒã³åºãå ã®ã³ã³ãã©ã¯ãã®ã³ã³ããã¹ãã§å¥ã®ã³ã³ãã©ã¯ãããã³ãŒããå®è¡ã§ããããã«ããäœã¬ãã«é¢æ°ã§ããããã¯ãåŒã³åºãããã³ã³ãã©ã¯ããåŒã³åºãå ã®ã³ã³ãã©ã¯ãã®ã¹ãã¬ãŒãžå€æ°ãšç¶æ 倿°ã倿Žã§ããããšãæå³ããŸããäžé©åã«äœ¿çšãããšã`delegatecall`ã¯æ·±å»ãªã»ãã¥ãªãã£è匱æ§ã«ã€ãªããå¯èœæ§ããããŸãã
äŸïŒ
`delegatecall`ã䜿çšããŠåŒã³åºããããžãã¯ã³ã³ãã©ã¯ãã«è»¢éãããããã·ã³ã³ãã©ã¯ãã«ã€ããŠèããŠã¿ãŸããããžãã¯ã³ã³ãã©ã¯ãã®ã¹ãã¬ãŒãžã¬ã€ã¢ãŠãããããã·ã³ã³ãã©ã¯ããšç°ãªãå Žåããããã·ã³ã³ãã©ã¯ãã®éèŠãªã¹ãã¬ãŒãžå€æ°ãäžæžãããæ»æè ããããã·ã³ã³ãã©ã¯ãã®å¶åŸ¡ãååŸã§ããããã«ãªãå¯èœæ§ããããŸãã
軜æžçïŒ
- ãããã·ã³ã³ãã©ã¯ããšããžãã¯ã³ã³ãã©ã¯ãã®ã¹ãã¬ãŒãžã¬ã€ã¢ãŠãã«äºææ§ãããããšã確èªããŸãã
- ããžãã¯ã³ã³ãã©ã¯ãã®ã³ãŒããæ³šææ·±ãç£æ»ããŠãæªæã®ããã³ãŒããå«ãŸããŠããªãããšã確èªããŸãã
- UUPSïŒãŠãããŒãµã«ã¢ããã°ã¬ãŒãå¯èœãããã·æšæºïŒãã¿ãŒã³ãªã©ãååã«ãã¹ãããç£æ»ããããããã·ãã¿ãŒã³ã䜿çšããŸãã
6. ã¢ã¯ã»ã¹å¶åŸ¡
é©åãªã¢ã¯ã»ã¹å¶åŸ¡ã¯ãèš±å¯ããããŠãŒã¶ãŒã®ã¿ãã¹ããŒãã³ã³ãã©ã¯ãã§ç¹å®ã®ã¢ã¯ã·ã§ã³ãå®è¡ã§ããããã«ããããã«äžå¯æ¬ ã§ããäžååãŸãã¯äžé©åãªã¢ã¯ã»ã¹å¶åŸ¡ã«ãããæ»æè ãã»ãã¥ãªãã£å¯Ÿçãåé¿ããæ©å¯ããŒã¿ãŸãã¯æ©èœãžã®äžæ£ã¢ã¯ã»ã¹ãååŸã§ããããã«ãªãå¯èœæ§ããããŸãã
äŸïŒ
ææè ã®ã¿ãè³éãåŒãåºãããšãã§ããã³ã³ãã©ã¯ãã«ã€ããŠèããŠã¿ãŸããã³ã³ãã©ã¯ããåŒã³åºãå ã®IDãé©åã«æ€èšŒããªãå Žåãæ»æè ã¯ææè ãåœè£ ããŠè³éãåŒãåºãããšãã§ããŸãã
軜æžçïŒ
- `onlyOwner`修食åã䜿çšããŠãç¹å®ã®é¢æ°ãžã®ã¢ã¯ã»ã¹ãã³ã³ãã©ã¯ãã®ææè ã«å¶éããŸãã
- è€æ°çœ²åèªèšŒãå®è£ ããŠãè€æ°ã®åœäºè ãéèŠãªã¢ã¯ã·ã§ã³ãæ¿èªããããšãèŠæ±ããŸãã
- ããŒã«ããŒã¹ã®ã¢ã¯ã»ã¹å¶åŸ¡ïŒRBACïŒã䜿çšããŠãç°ãªããŠãŒã¶ãŒã«å¯ŸããŠç°ãªãããŒã«ãšæš©éãå®çŸ©ããŸãã
- ã¢ã¯ã»ã¹å¶åŸ¡ãªã¹ãïŒACLïŒãå®è£ ããŠãç¹å®ã®ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ãŸãã¯åãæ¶ããŸãã
7. æªåŠçã®äŸå€
Solidityã§ã¯ã`revert()`ã`require()`ãããã³`assert()`颿°ã䜿çšããŠäŸå€ãã¹ããŒã§ããŸããäŸå€ãé©åã«åŠçãããªãå Žåãäºæããªãåäœãšã»ãã¥ãªãã£è匱æ§ã«ã€ãªããå¯èœæ§ããããŸãã
äŸïŒ
EtherããŠãŒã¶ãŒã«éä¿¡ããã³ã³ãã©ã¯ãã«ã€ããŠèããŠã¿ãŸãããŠãŒã¶ãŒã®ã¢ãã¬ã¹ãEtherã®åä¿¡æã«äŸå€ãã¹ããŒããã³ã³ãã©ã¯ãã§ããå Žåããã©ã³ã¶ã¯ã·ã§ã³ã¯å ã«æ»ããŸãããã ããã³ã³ãã©ã¯ããäŸå€ãé©åã«åŠçããªãå Žåããã®ç¶æ ãäžè²«æ§ã®ãªãç¶æ ã«ãªããæ»æè ããã®äžæŽåãæªçšã§ããããã«ãªãå¯èœæ§ããããŸãã
軜æžçïŒ
- ããã§ãã¯-广-ã€ã³ã¿ã©ã¯ã·ã§ã³ããã¿ãŒã³ã䜿çšããŠãå€éšåŒã³åºãäžã«äŸå€ãçºçãããªã¹ã¯ãæå°éã«æããŸãã
- try-catchãããã¯ã䜿çšããŠäŸå€ãåŠçããå¿ èŠã«å¿ããŠãã©ã³ã¶ã¯ã·ã§ã³ãå ã«æ»ããŸãã
- äŸå€ãã¹ããŒããå¯èœæ§ã®ããå€éšåŒã³åºããåé¿ããŸãã
8. ããã³ãã©ã³ãã³ã°
ããã³ãã©ã³ãã³ã°ã¯ãæ»æè ãä¿çäžã®ãã©ã³ã¶ã¯ã·ã§ã³ãç£èŠããããé«ãã¬ã¹äŸ¡æ Œã§ç¬èªã®ãã©ã³ã¶ã¯ã·ã§ã³ãéä¿¡ããŠãå ã®ãã©ã³ã¶ã¯ã·ã§ã³ã®åã«å®è¡ãããããã«ããå Žåã«çºçããŸããããã«ãããæ»æè ã¯å ã®ãã©ã³ã¶ã¯ã·ã§ã³ããå©çãåŸããããã®çµæãæäœãããã§ããŸãã
äŸïŒ
ãŠãŒã¶ãŒãããŒã¯ã³ãååŒã§ãã忣åååŒæïŒDEXïŒã«ã€ããŠèããŠã¿ãŸããæ»æè ãå€§èŠæš¡ãªè²·ã泚æãç£èŠããŠããå Žåããããã«é«ãã¬ã¹äŸ¡æ Œã§ç¬èªã®è²·ã泚æãéä¿¡ããŠãå ã®æ³šæã®åã«å®è¡ãããããã«ããããšãã§ããŸããããã«ãããæ»æè ã¯ããŒã¯ã³ãããäœãäŸ¡æ Œã§è³Œå ¥ããå ã®ãã€ã€ãŒã«ããé«ãäŸ¡æ Œã§è²©å£²ã§ããŸãã
軜æžçïŒ
- ã³ããã-ãªããŒã«ã¹ããŒã ã䜿çšããŸããããã«ããããŠãŒã¶ãŒã¯ãªã³ãã§ãŒã³ã§å ¬éããåã«ãã©ã³ã¶ã¯ã·ã§ã³ã«ã³ãããããå¿ èŠããããŸãã
- ã¬ã€ã€ãŒ2ã¹ã±ãŒãªã³ã°ãœãªã¥ãŒã·ã§ã³ãªã©ã®ãªããã§ãŒã³å®è¡ç°å¢ã䜿çšããŠããã©ã³ã¶ã¯ã·ã§ã³ã®å¯èŠæ§ãäœäžãããŸãã
- ããã³ãã©ã³ãã³ã°ã«èæ§ã®ããæ³šæç §åã¢ã«ãŽãªãºã ãå®è£ ããŸãã
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»æ¹æ³è«
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã«ã¯ãéåžžãæåã«ããã³ãŒãã¬ãã¥ãŒãèªååæããŒã«ãããã³ãã¹ãææ³ã®çµã¿åãããå«ãŸããŸããæãäžè¬çãªæ¹æ³è«ã次ã«ç€ºããŸãã
1. æåã³ãŒãã¬ãã¥ãŒ
æåã³ãŒãã¬ãã¥ãŒã¯ãæœåšçãªè匱æ§ããã°ãããã³ããžãã¯ãšã©ãŒãç¹å®ããããã«ãã¹ããŒãã³ã³ãã©ã¯ãã³ãŒãã1è¡ãã€æ³šææ·±ã調ã¹ãããã»ã¹ã§ããããã¯æéãããããŸãããç£æ»ããã»ã¹ã®äžå¯æ¬ ãªéšåã§ããããã«ãããç£æ»äººã¯ã³ã³ãã©ã¯ãã®æ©èœãæ·±ãçè§£ããèªååãããããŒã«ã§ã¯æ€åºãããªãå¯èœæ§ã®ããåé¡ãç¹å®ã§ããŸãã
ãã¹ããã©ã¯ãã£ã¹ïŒ
- ã¬ãã¥ãŒããã»ã¹ãã¬ã€ãããããã«ãOWASPã¹ããŒãã³ã³ãã©ã¯ãã®ããã10ãªã©ã®æ§é åãããã¢ãããŒãã䜿çšããŸãã
- ãã¹ãŠã®èª¿æ»çµæãšæšå¥šäºé ãæç¢ºãã€ç°¡æœãªæ¹æ³ã§ææžåããŸãã
- 培åºçãªã¬ãã¥ãŒã確å®ã«ããããã«ãç°ãªãå°éç¥èãæã€è€æ°ã®ç£æ»äººãé¢äžãããŸãã
- ã³ãŒãã¬ãã¥ãŒããŒã«ã䜿çšããŠãæœåšçãªåé¡ã匷調衚瀺ããé²æç¶æ³ã远跡ããŸãã
2. éçåæ
éçåæã«ã¯ãã¹ããŒãã³ã³ãã©ã¯ãã³ãŒããå®è¡ããã«åæããããšãå«ãŸããŸããããã«ãããç£æ»äººã¯ãæŽæ°ãªãŒããŒãããŒãšã¢ã³ããŒãããŒãåå ¥å¯èœæ§ãããã³ã¿ã€ã ã¹ã¿ã³ãã®äŸåæ§ãªã©ã®æœåšçãªè匱æ§ãããããã¯ãã§ãŒã³ã§ã³ã³ãã©ã¯ããå®è¡ããã«ç¹å®ã§ããŸããéçåæããŒã«ã¯ãã³ãŒãã¬ãã¥ãŒããã»ã¹ã®å€ããèªååã§ãããããããå¹ççã§ã人çºçãªãšã©ãŒãçºçãã«ãããªããŸãã
人æ°ã®ããããŒã«ïŒ
- Slither
- Mythril
- Securify
- Oyente
3. åçåæ
åçåæã«ã¯ãå¶åŸ¡ãããç°å¢ã§ã¹ããŒãã³ã³ãã©ã¯ãã³ãŒããå®è¡ããŠããã®åäœã芳å¯ããæœåšçãªè匱æ§ãç¹å®ããããšãå«ãŸããŸããããã¯ãäºæããªãåäœãããªã¬ãŒããããšããããã«ã³ã³ãã©ã¯ãã«å€§éã®ã©ã³ãã ãªå ¥åãæäŸãããã¡ãžã³ã°ææ³ã䜿çšããããã³ã³ãã©ã¯ãã®èãããããã¹ãŠã®å®è¡ãã¹ãæ¢çŽ¢ããã·ã³ããªãã¯å®è¡ãéããŠå®è¡ã§ããŸãã
人æ°ã®ããããŒã«ïŒ
- Echidna
- MythX
- Manticore
4. åœ¢åŒæ€èšŒ
åœ¢åŒæ€èšŒã¯ãã¹ããŒãã³ã³ãã©ã¯ãã®æå³ãããåäœãæ£åŒã«æå®ããã³ãŒãã仿§ãæºãããŠããããšãæ€èšŒããããšã«ããããã®æ£åœæ§ã蚌æããæ°åŠçãªææ³ã§ããããã¯éåžžã«å³å¯ã§ãããæéããããè€éãªããã»ã¹ã§ãããã»ãã¥ãªãã£ãæéèŠã§ããéèŠãªã³ã³ãã©ã¯ãã«é垞䜿çšãããŸãã
人æ°ã®ããããŒã«ïŒ
- Certora Prover
- K Framework
- Isabelle/HOL
5. ã¬ã¹ã®æé©å
ã¬ã¹ã®æé©åã¯ãã¹ããŒãã³ã³ãã©ã¯ãã®å®è¡ã«å¿ èŠãªã¬ã¹ã®éãæžããããã»ã¹ã§ããã¬ã¹ã®ã³ã¹ãã¯ãç¹ã«è€éãªã³ã³ãã©ã¯ãã§ã¯é«é¡ã«ãªãå¯èœæ§ããããããããã¯éèŠã§ããã¬ã¹ã®æé©åã¯ãã³ã³ãã©ã¯ãã®ããã©ãŒãã³ã¹ãåäžããããµãŒãã¹æåŠæ»æã®ãªã¹ã¯ã軜æžããããšãã§ããŸãã
ãã¹ããã©ã¯ãã£ã¹ïŒ
- å¹ççãªããŒã¿æ§é ãšã¢ã«ãŽãªãºã ã䜿çšããŸãã
- ã¹ãã¬ãŒãžã®èªã¿åããšæžã蟌ã¿ã®æ°ãæå°éã«æããŸãã
- 颿°åŒæ°ã«ã¯ãã¡ã¢ãªã®ä»£ããã«calldataã䜿çšããŸãã
- é »ç¹ã«ã¢ã¯ã»ã¹ãããããŒã¿ããã£ãã·ã¥ããŸãã
- äžèŠãªã«ãŒããšå埩åŠçãåé¿ããŸãã
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ããã»ã¹
äžè¬çãªã¹ããŒãã³ã³ãã©ã¯ãç£æ»ããã»ã¹ã«ã¯ãæ¬¡ã®æé ãå«ãŸããŸãã
- ã¹ã³ãŒãïŒç£æ»ã®ã¹ã³ãŒããå®çŸ©ããŸããããã«ã¯ãç£æ»ããã³ã³ãã©ã¯ãããã¹ãããæ©èœãããã³éæããã»ãã¥ãªãã£ç®æšãå«ãŸããŸãã
- æ å ±åéïŒã¢ãŒããã¯ãã£ãããžãã¹ããžãã¯ããããã€ã¡ã³ãç°å¢ãããã³æœåšçãªæ»æãã¯ãã«ãªã©ããããžã§ã¯ãã«é¢ããæ å ±ãåéããŸãã
- ã³ãŒãã¬ãã¥ãŒïŒæåã«ããã³ãŒãã¬ãã¥ãŒãå®è¡ããŠãæœåšçãªè匱æ§ããã°ãããã³ããžãã¯ãšã©ãŒãç¹å®ããŸãã
- èªååæïŒéçåæããã³åçåæããŒã«ã䜿çšããŠãã³ãŒãã¬ãã¥ãŒããã»ã¹ãèªååãã远å ã®è匱æ§ãç¹å®ããŸãã
- ãã¹ãïŒåäœãã¹ããçµ±åãã¹ããããã³ãã¡ãžã³ã°ãã¹ããå®è¡ããŠãã³ã³ãã©ã¯ãã®æ©èœãšã»ãã¥ãªãã£ãæ€èšŒããŸãã
- ã¬ããŒãïŒå æ¬çãªç£æ»ã¬ããŒãã§ãã¹ãŠã®èª¿æ»çµæãšæšå¥šäºé ãææžåããŸãã
- 修埩ïŒéçºããŒã ãšååããŠãç¹å®ãããè匱æ§ã修埩ããæšå¥šãããã»ãã¥ãªãã£å¯Ÿçãå®è£ ããŸãã
- åç£æ»ïŒåç£æ»ãå®è¡ããŠã修埩ãããè匱æ§ãæ£åžžã«å¯ŸåŠãããããšã確èªããŸãã
ç£æ»äŒç€Ÿã®éžæ
ã¹ããŒãã³ã³ãã©ã¯ãã®ã»ãã¥ãªãã£ã確ä¿ããã«ã¯ãé©åãªç£æ»äŒç€ŸãéžæããããšãéèŠã§ããç£æ»äŒç€Ÿãéžæããéã«èæ ®ãã¹ãèŠçŽ ãæ¬¡ã«ç€ºããŸãã
- çµéšïŒã¹ããŒãã³ã³ãã©ã¯ãã®ç£æ»ã§å®çžŸãããããããã¯ãã§ãŒã³ãã¯ãããžãŒãæ·±ãçè§£ããŠããäŒç€ŸãéžæããŠãã ããã
- å°éç¥èïŒäŒç€Ÿãã¹ããŒãã³ã³ãã©ã¯ãã§äœ¿çšãããŠããç¹å®ã®ããã°ã©ãã³ã°èšèªããã³ãã¬ãŒã ã¯ãŒã¯ã«é¢ããå°éç¥èãæã£ãŠããããšã確èªããŸãã
- è©å€ïŒäŒç€Ÿã®è©å€ãšåèæç®ããã§ãã¯ããŠãä¿¡é Œæ§ãšä¿¡é Œæ§ãããããšã確èªããŸãã
- æ¹æ³è«ïŒäŒç€Ÿã®ç£æ»æ¹æ³è«ãçè§£ãããããã»ãã¥ãªãã£ç®æšãšäžèŽããŠããããšã確èªããŸãã
- ã³ãã¥ãã±ãŒã·ã§ã³ïŒå¯Ÿå¿ãè¯ããã³ãã¥ãã±ãŒã·ã§ã³ãåããŠãããæžå¿µäºé ã«å¯ŸåŠããããã«ååããŠãããäŒç€ŸãéžæããŸãã
- ã³ã¹ãïŒããŸããŸãªäŒç€Ÿã®ã³ã¹ããæ¯èŒããæäŸããããµãŒãã¹ã«å¯ŸããŠå ¬æ£ãªäŸ¡æ ŒãæäŸããäŒç€ŸãéžæããŸãããã ããã³ã¹ãã®ããã«å質ã劥åããªãã§ãã ããã
ã¹ããŒãã³ã³ãã©ã¯ãã®ã»ãã¥ãªãã£ã«é¢ãããã¹ããã©ã¯ãã£ã¹
ç£æ»ã«å ããŠãéçºè ãã¹ããŒãã³ã³ãã©ã¯ãã®ã»ãã¥ãªãã£ãåäžãããããã«åŸãããšãã§ããããã€ãã®ãã¹ããã©ã¯ãã£ã¹ããããŸãã
- æç¢ºã§ç°¡æœãªã³ãŒããèšè¿°ããŸãïŒæå³ã®ãã倿°åãã³ã¡ã³ããããã³äžè²«ããã³ãŒãã£ã³ã°ã¹ã¿ã€ã«ã䜿çšããŠãã³ãŒããçè§£ããã³ã¬ãã¥ãŒããããããŸãã
- ã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ã«åŸã£ãŠãã ããïŒOWASPã¹ããŒãã³ã³ãã©ã¯ãã®ããã10ãªã©ã確ç«ãããã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ã«åŸããŸãã
- ååã«ãã¹ãããç£æ»ãããã©ã€ãã©ãªã䜿çšããŸãïŒè»èŒªã®åçºæãšæ°ããè匱æ§ã®å°å ¥ãåé¿ããããã«ãOpenZeppelin Contractsãªã©ã®ååã«ãã¹ãããç£æ»ãããã©ã€ãã©ãªã䜿çšããŸãã
- é©åãªã¢ã¯ã»ã¹å¶åŸ¡ãå®è£ ããŸãïŒ`onlyOwner`修食åãè€æ°çœ²åèªèšŒãããã³ããŒã«ããŒã¹ã®ã¢ã¯ã»ã¹å¶åŸ¡ã䜿çšããŠãæ©å¯æ©èœãžã®ã¢ã¯ã»ã¹ãå¶éããŸãã
- äŸå€ãé©åã«åŠçããŸãïŒtry-catchãããã¯ã䜿çšããŠäŸå€ãåŠçããå¿ èŠã«å¿ããŠãã©ã³ã¶ã¯ã·ã§ã³ãå ã«æ»ããŸãã
- 培åºçã«ãã¹ãããŸãïŒåäœãã¹ããçµ±åãã¹ããããã³ãã¡ãžã³ã°ãã¹ããå®è¡ããŠãã³ã³ãã©ã¯ãã®æ©èœãšã»ãã¥ãªãã£ãæ€èšŒããŸãã
- ææ°ã®ã»ãã¥ãªãã£è åšã«é¢ããææ°æ å ±ãå ¥æããŠãã ããïŒææ°ã®ã»ãã¥ãªãã£è åšãšè匱æ§ã«ã€ããŠåžžã«ææ°æ å ±ãå ¥æããããã«å¿ããŠã³ãŒããæŽæ°ããŠãã ããã
- éèŠãªã³ã³ãã©ã¯ãã«ã¯åœ¢åŒæ€èšŒãæ€èšããŠãã ããïŒåœ¢åŒæ€èšŒã䜿çšããŠãéèŠãªã³ã³ãã©ã¯ãã®æ£åœæ§ãæ°åŠçã«èšŒæããŸãã
- ç£èŠãšã¢ã©ãŒããå®è£ ããŸãïŒæœåšçãªã»ãã¥ãªãã£ã€ã³ã·ãã³ããæ€åºããŠå¯Ÿå¿ããããã«ãç£èŠããã³ã¢ã©ãŒãã·ã¹ãã ãå®è£ ããŸãã
- ãã°ããŠã³ãã£ããã°ã©ã ã宿œããŸãïŒã»ãã¥ãªãã£ç ç©¶è ãè匱æ§ãèŠã€ããŠå ±åããããã«ä¿ãããã«ããã°ããŠã³ãã£ããã°ã©ã ãæäŸããŸãã
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®å°æ¥
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®åéã¯ãæ°ãããã¯ãããžãŒãšè匱æ§ãç»å Žããã«ã€ããŠåžžã«é²åããŠããŸããã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®å°æ¥ã圢äœããã¬ã³ããæ¬¡ã«ç€ºããŸãã
- èªååã®åŒ·åïŒèªååæããŒã«ã¯ãããæŽç·Žãããããåºç¯å²ã®è匱æ§ãæ€åºã§ããããã«ãªã£ãŠããŸãã
- åœ¢åŒæ€èšŒã®æ¡çšïŒåœ¢åŒæ€èšŒã¯ãããã¢ã¯ã»ã¹ããããå®çšçã«ãªããããåºç¯å²ã®ã³ã³ãã©ã¯ãã«ãšã£ãŠå®è¡å¯èœãªãªãã·ã§ã³ã«ãªã£ãŠããŸãã
- AIæèŒã®ç£æ»ïŒäººå·¥ç¥èœïŒAIïŒããã³æ©æ¢°åŠç¿ïŒMLïŒã¯ãè匱æ§ãèªåçã«ç¹å®ããŠåªå é äœãä»ããããšãã§ããæ°ããç£æ»ããŒã«ãéçºããããã«äœ¿çšãããŠããŸãã
- æšæºåãããç£æ»ãã¬ãŒã ã¯ãŒã¯ïŒã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®å質ãšäžè²«æ§ã確ä¿ããããã«ãæšæºåãããç£æ»ãã¬ãŒã ã¯ãŒã¯ãšèªèšŒãéçºããåãçµã¿ãé²è¡äžã§ãã
- ã³ãã¥ããã£äž»å°ã®ç£æ»ïŒã³ãã¥ããã£äž»å°ã®ç£æ»ãã©ãããã©ãŒã ãåºçŸããŠãããéçºè ã¯ã»ãã¥ãªãã£å°éå®¶ã®ã³ãã¥ããã£ã«ããã¬ãã¥ãŒã®ããã«ã³ã³ãã©ã¯ããæåºã§ããŸãã
çµè«
ã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã¯ã忣åã¢ããªã±ãŒã·ã§ã³ã®ã»ãã¥ãªãã£ãšä¿¡é Œæ§ã確ä¿ããããã®éèŠãªåŽé¢ã§ããäžè¬çãªè匱æ§ãçè§£ããå ç¢ãªç£æ»æ¹æ³è«ãå®è£ ããã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ã«åŸãããšã§ãéçºè ã¯å®å šã§ãªãã³ãŒãããããã¯ãã§ãŒã³ã«ãããã€ããããšã«é¢é£ãããªã¹ã¯ã軜æžã§ããŸãããããã¯ãã§ãŒã³ãšã³ã·ã¹ãã ãæé·ãšé²åãç¶ããã«ã€ããŠãã¹ããŒãã³ã³ãã©ã¯ãç£æ»ã®éèŠæ§ã¯ãŸããŸãé«ãŸãã§ãããã
培åºçãªç£æ»ãžã®æè³ã¯åãªãã³ã¹ãã§ã¯ãããŸãããããã¯ãããžã§ã¯ãã®é·æçãªæåãšæç¶å¯èœæ§ãžã®æè³ã§ããã»ãã¥ãªãã£ãåªå ããããšã§ããŠãŒã¶ãŒãšã®ä¿¡é Œãç¯ããè³ç£ãä¿è·ããããå®å šã§å埩åã®ãã忣åã®æªæ¥ã«è²¢ç®ã§ããŸããã°ããŒãã«ãªã¹ããŒãã³ã³ãã©ã¯ãã®ç¶æ³ãæçããã«ã€ããŠãå æ¬çãªç£æ»ãå«ãç©æ¥µçãªã»ãã¥ãªãã£å¯Ÿçã¯ã倿§ãªåœéçãªã³ã³ããã¹ãå šäœã§ãããã¯ãã§ãŒã³ã¢ããªã±ãŒã·ã§ã³ã®åºç¯ãªæ¡çšãä¿é²ããæŽåæ§ãç¶æããããã«äžå¯æ¬ ã«ãªããŸãã