Composability and other tools for attacking crypto protocols

Information on blockchains is more valuable to attackers than is traditionally the case in cyber crime, since a successful attack on a smart contract has direct financial rewards. Traditionally, hacked information — such as stolen personal information — can be sold to make money, whereas smart contracts hold money directly.

In the earlier days of Ethereum, the majority of attacks were based on finding individual bugs that gave the attacker the ability to freeze or drain a smart contract. This was the case in the infamous DAO hack in 2016, where $160 million in ETH was stolen and Ethereum ended up forking as a result. Similarly, the Parity multi-sig hack that allowed an attacker to steal $30 million and the $150 million frozen in the Parity wallet in 2017 were the results of such direct bugs.