Debugger
Phalcon Explorer Debugger
Last updated
Phalcon Explorer Debugger
Last updated
Phalcon Explorer supports transaction debugging, a powerful feature that can significantly improve the analysis efficiency of complex transactions. In the following, we will illustrate this feature using the transaction of the exploitation of the Euler protocol.
Click the link for this transaction.
There are two different ways to enter the debug mode: from a specific line in the invocation flow view or by clicking the Debug button.
The Invocation Flow in Phalcon provides a view that lets users take a complete picture of the hack transaction and identify possible exploitation locations. This is useful when hundreds of external calls and events may exist in the transaction.
Another way to enter the debug mode is by clicking the Debug button in the upper right corner.
After entering the Debug mode, we can see the following screen.
This screen has five panels, which are as follows.
Call Trace Panel: Showing the trace of external calls and events.
Source Code Panel: Providing the contract's source code and the current line (highlighted) referring to the call site of a function.
Debug Console: a call-level single-step debug console.
Debug Trace Panel: Showing the call stack of the current contract with a combination of internal and external calls.
Parameters & Return Values Panel: Showing call parameters and return values.
Sometimes, you may notice that the source code panel does not show the code. This is because the panel shows the function's call site by default. The reason is that the hacking contract is not unverified (not open-sourced), so the source code cannot be shown.
The eDai contract is verified so we can Step In to see the specific implementation of donateToReserves(). After clicking Step In, the current line becomes the call site inside the eDai contract. It’s a proxy contract, and the code is shown below.
After Step In again, we can finally see the concrete implementation of donateToReserves().
The debug console helps understand the detailed call trace, including the internal function call (The Jump at the first of a line indicates that this is an internal call). Note that the Call Trace Panel does not have an internal call trace.
To traverse between the detailed execution, Phalcon provides four buttons on the Debug Console, and Next and Previous have slightly different logic under the two colors.
Next (Red Button): Go to the next call site in the whole call trace.
Next (Blue Button): Go to the next call site of the current function.
Previous(Red Button): Go to the previous call site in the whole call trace.
Previous(Blue Button): Go to the previous call site of the current function.
Step In: Go to the callee function.
Step Out: Return to the call site of the current function.
For instance, we can click the Next button to analyze the implementation of donateToReserves(). We can find that the hacker donated 100 million eDAI, making the eDAI less than the dDAI and eligible for liquidation. Therefore, the root cause is that donateToReserves() lacks of liquidity check for eligible liquidation, and the exploiter liquidated himself/herself and took out 38 million eDAI.
A transaction's debug can be shared directly via URL, which contains the trace’s row number. When others open the link, the same debug view will be shown. This is useful when you want to share the analysis result with others. Team members can use this to collaborate, analyze, and discuss together!
In summary, the typical workflow of using Phalcon Explorer Debugger to analyze a hack transaction follows.
Find the possible issue in Invocation Flow and start debugging from there.
Debug the source code, check the parameters, and return values of internal calls.
Share your analysis with team members (or public readers) for collaboration.
Phalcon Debug has many features to help you improve efficiency.
The Call Trace View can show the full parameters by turning on the parameters switch on the left top panel.
For external calls, click "Rawdata" can see the raw call parameters.
In the case of the Euler protocol exploitation, the hack transaction consists of many steps, including borrowing Flashloan from Aave, depositing Dai into the Euler protocol, etc. But in one of the steps, the exploiter called donateToReserves() to "donate" a massive fund to the Euler protocol, which warrants our vigilance. In this case, we can directly debug the transaction from this step by clicking the debug icon.
