Forem: Vishak Bhaskar

Avalanche Effect and Proof of Work blockchains

Vishak Bhaskar — Mon, 17 Apr 2023 18:02:35 +0000

In this article, we will explore the concept of the avalanche effect in cryptography, its significance in securing data, and its application in blockchain technology, specifically in the case of Bitcoin. By the end of this article, you will have a good understanding of what the avalanche effect is, why it matters, and how it contributes to the security of blockchain systems. So, let's dive in!

The avalanche effect in cryptography is a property of cryptographic functions, where a small change in the input of the function results in a significant change in the output. In other words, if you make a small change to the input of a cryptographic function, the output will change so much that it appears completely unrelated to the original output.

The avalanche effect is important for cryptographic functions, such as hash functions and encryption algorithms, because it makes it much harder for an attacker to predict the output of the function or to find patterns in the output. If a cryptographic function did not exhibit the avalanche effect, an attacker might be able to deduce information about the input or the key used to encrypt the data by analyzing the output.

To understand it in more detail, we'll be looking at SHA256 hash function. It takes an input (message) and produces a fixed-length output, known as a hash or message digest. The SHA-256 algorithm produces a 256-bit (32-byte) hash value that is commonly represented as a hexadecimal string of 64 characters.

In this image you can see that even a small change in the input results in a completely different hash. You can play around with SHA256 hash function here.

Bitcoin too uses SHA256 algorithm. To understand how the avalanche effect influences the difficulty of Bitcoin mining, it's important to first understand the mining process. Bitcoin mining involves trying to find a nonce that, when combined with other data from the Bitcoin network, results in a hash that meets a certain set of criteria. This criteria is known as the mining difficulty and is adjusted periodically by the Bitcoin network to ensure that new blocks are added to the blockchain at a roughly consistent rate.

The avalanche effect ensures that even a small change in the nonce results in a completely different hash. This means that miners cannot rely on incremental changes to the nonce to find a valid hash. Instead, they must try many different nonces until they find one that produces a valid hash. The more difficult the mining difficulty, the more nonces a miner will need to try before finding a valid hash.

In bitcoin mining the miner must perform a series of mathematical operations on the block header data, which includes the transactions being confirmed, the previous block's hash, and a random number called a nonce.

The resulting hash value is then compared to the target value. If it is less than or equal to the target, the miner has successfully mined a new block, and the block is added to the blockchain.

The number of zeroes in the target determines the difficulty of mining. The more zeroes there are, the harder it is to find a hash value that is less than or equal to the target. For example, if the target begins with four zeroes, it will be easier to find a valid hash value than if it begins with eight zeroes. As the difficulty increases, it becomes more computationally expensive to find a valid hash value, and miners must use more powerful hardware or join mining pools to compete effectively.

The miner uses a trial-and-error approach to find the right hash value. This involves generating and testing thousands of possible hash values every second until a value is found that is less than or equal to the target value. If the target hash starts with more zeroes, it is harder for the miner to find a matching hash value because they will have to generate and test more hashes until they find one that meets the criteria.

A miner's successful discovery of a hash that meets the target in Bitcoin mining proves that they have invested energy and computational power to find it.

The hash is the proof that work was done by the miner to find it.

And that is why it is called Proof of Work!

Fork mainnet using hardhat to test and build on DeFi protocols and more

Vishak Bhaskar — Mon, 23 Jan 2023 18:07:12 +0000

So what does forking mainnet actually mean? According to hardhat docs :

Forking the mainnet will simulate having the same state as mainnet, but it will work as a local development network. That way you can interact with deployed protocols and test complex interactions locally.

But why is this awesome? I personally love it because it is faster than testing on a testnet and you never run out of test ether. If you've never tried forking mainnet on hardhat, after this tutorial you'll be equipped with the knowledge to do so and you will not have to use the testnets much and never worry about running out of test ether (at least not as much as you used to)

Forking mainnet is basically copying the current or a previous state of the mainnet and pasting it into your local development network. This way you will be able to access the deployed smart contracts in the mainnnet for testing purposes and the rest of the transactions or blocks will be mined and added to your local development network.

Testing your project on a forked mainnet allows you to avoid a lot of issues you might encounter when you actually deploy it the mainnet. In this tutorial we will also learn to impersonate an account on mainnet and send transactions from it to test your contract (only if you could do it on mainnet 😉). I will keep everything as beginner friendly as possible so everyone can follow along. You can refer to this Github repository if you get stuck or reach out to me here

In this tutorial we're gonna interact with the USDC contract on ethereum mainnet, unlock a user's account and impersonate that account and drain some USDC. So let's get to it 🚀

Before, head to Alchemy and get your API key. You can refer to this tutorial to learn how to get your key.

Let's open the terminal, create a folder to start with, move into it and install hardhat, initialise the project and open it in our code editor and also install dotenv package.

mkdir mainnet-fork-tutorial
cd mainnet-fork-tutorial
npm i dotenv
code .

npm install --save-dev hardhat
npx hardhat

We'll be creating a javascript project for this tutorial

Install the dependencies needed

Now create a file named .env in your root folder and paste the key that you grabbed from alchemy. Your .env file should look something like this now :

ALCHEMY_API_KEY = `NtZu1RjBg--your API KEY---_B678`

Now that we're done setting up the project, head to hardhat.config.js file and make the following changes so the file looks something like this now :

require("@nomicfoundation/hardhat-toolbox");
require("dotenv").config();

module.exports = {
  solidity: "0.8.17",
  networks: {
    hardhat: {
      forking: {
        enabled: true,
        url: `https://eth-mainnet.g.alchemy.com/v2/${process.env.ALCHEMY_API_KEY}`,
      },
    },
  },
};

Now create a folder named IERC20.sol inside your contracts folder and paste the following code into it. This is the ERC20 interface we will need to interact with the USDC contract. You can also find this code here

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.6.0) (token/ERC20/IERC20.sol)

pragma solidity ^0.8.0;

/**
 * @dev Interface of the ERC20 standard as defined in the EIP.
 */
interface IERC20 {
    /**
     * @dev Emitted when `value` tokens are moved from one account (`from`) to
     * another (`to`).
     *
     * Note that `value` may be zero.
     */
    event Transfer(address indexed from, address indexed to, uint256 value);

    /**
     * @dev Emitted when the allowance of a `spender` for an `owner` is set by
     * a call to {approve}. `value` is the new allowance.
     */
    event Approval(address indexed owner, address indexed spender, uint256 value);

    /**
     * @dev Returns the amount of tokens in existence.
     */
    function totalSupply() external view returns (uint256);

    /**
     * @dev Returns the amount of tokens owned by `account`.
     */
    function balanceOf(address account) external view returns (uint256);

    /**
     * @dev Moves `amount` tokens from the caller's account to `to`.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * Emits a {Transfer} event.
     */
    function transfer(address to, uint256 amount) external returns (bool);

    /**
     * @dev Returns the remaining number of tokens that `spender` will be
     * allowed to spend on behalf of `owner` through {transferFrom}. This is
     * zero by default.
     *
     * This value changes when {approve} or {transferFrom} are called.
     */
    function allowance(address owner, address spender) external view returns (uint256);

    /**
     * @dev Sets `amount` as the allowance of `spender` over the caller's tokens.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * IMPORTANT: Beware that changing an allowance with this method brings the risk
     * that someone may use both the old and the new allowance by unfortunate
     * transaction ordering. One possible solution to mitigate this race
     * condition is to first reduce the spender's allowance to 0 and set the
     * desired value afterwards:
     * https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729
     *
     * Emits an {Approval} event.
     */
    function approve(address spender, uint256 amount) external returns (bool);

    /**
     * @dev Moves `amount` tokens from `from` to `to` using the
     * allowance mechanism. `amount` is then deducted from the caller's
     * allowance.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * Emits a {Transfer} event.
     */
    function transferFrom(address from, address to, uint256 amount) external returns (bool);
}

Since we will be working with USDC, the address of USDC on Ethereum mainnet is 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48

Go to the tracker here and click the "holders" tab and find an account that holds a good amount of USDC. Make sure the address you choose is not a smart contract. At the time of writing this this address holds some USDC :
0x203520F4ec42Ea39b03F62B20e20Cf17DB5fdfA7

Unlock an account to be impersonated in hardhat :

{
    await network.provider.request({
      method: "hardhat_impersonateAccount",
      params: [USDC_WHALE],
    });
  }

Where USDC_WHALE is the address that holds a large amount of USDC tokens. Once the account has been unlocked, some ether should be sent to it so it can pay for the gas fees. After this transactions can be carried out.

Now, go to the scripts folder and create a javascript file. I named it transfer.js

Paste this code into the file :

const { ethers, network } = require("hardhat");

const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";

const USDC_WHALE = "0x203520F4ec42Ea39b03F62B20e20Cf17DB5fdfA7";

async function main() {
  {
    await network.provider.request({
      method: "hardhat_impersonateAccount",
      params: [USDC_WHALE],
    });
  }

  const whale = await ethers.getSigner(USDC_WHALE);
  const usdc = await ethers.getContractAt("IERC20", USDC);

  const accounts = await ethers.getSigners();
  const attacker = accounts[0];

  const HUNDRED_THOUSAND = ethers.utils.parseUnits("100000", 6);

  let whaleBal = await usdc.balanceOf(USDC_WHALE);
  let attackerBal = await usdc.balanceOf(attacker.address);

  console.log(
    "Initial USDC balance of whale : ",
    ethers.utils.formatUnits(whaleBal, 6)
  );

  console.log(
    "Initial USDC balance of attacker : ",
    ethers.utils.formatUnits(attackerBal, 6)
  );

  await accounts[0].sendTransaction({
    to: whale.address,
    value: ethers.utils.parseEther("50.0"), // Sends exactly 50.0 ether
  });

  await usdc.connect(whale).transfer(accounts[0].address, HUNDRED_THOUSAND);

  let newWhaleBal = await usdc.balanceOf(USDC_WHALE);
  let newAttackerBal = await usdc.balanceOf(attacker.address);

  console.log(
    "Final USDC balance of whale : ",
    ethers.utils.formatUnits(newWhaleBal, 6)
  );

  console.log(
    "Final USDC balance of attacker : ",
    ethers.utils.formatUnits(newAttackerBal, 6)
  );
}

main().catch((error) => {
  console.error(error);
  process.exitCode = 1;
});

This script is responsible for unlocking the USDC_WHALE account and sending USDC to another account. The balances will be logged into your terminal when you run this.

Next, open up your terminal and enter the following :

npx hardhat node --fork https://eth-mainnet.g.alchemy.com/v2/<YOUR_ALCHEMY_API_KEY>

You'll find something like this appear on the terminal :

Started HTTP and WebSocket JSON-RPC server at http://127.0.0.1:8545/

Accounts
========

WARNING: These accounts, and their private keys, are publicly known.
Any funds sent to them on Mainnet or any other live network WILL BE LOST.

Account #0: 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266 (10000 ETH)
Private Key: 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80

Account #1: 0x70997970C51812dc3A010C7d01b50e0d17dc79C8 (10000 ETH)
Private Key: 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d

Account #2: 0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC (10000 ETH)
Private Key: 0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a

Account #3: 0x90F79bf6EB2c4f870365E785982E1f101E93b906 (10000 ETH)
Private Key: 0x7c852118294e51e653712a81e05800f419141751be58f605c371e15141b007a6

Account #4: 0x15d34AAf54267DB7D7c367839AAf71A00a2C6A65 (10000 ETH)
Private Key: 0x47e179ec197488593b187f80a00eb0da91f1b9d0b13f8733639f19c30a34926a

Account #5: 0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc (10000 ETH)
Private Key: 0x8b3a350cf5c34c9194ca85829a2df0ec3153be0318b5e2d3348e872092edffba

Account #6: 0x976EA74026E726554dB657fA54763abd0C3a0aa9 (10000 ETH)
Private Key: 0x92db14e403b83dfe3df233f83dfa3a0d7096f21ca9b0d6d6b8d88b2b4ec1564e

Account #7: 0x14dC79964da2C08b23698B3D3cc7Ca32193d9955 (10000 ETH)
Private Key: 0x4bbbf85ce3377467afe5d46f804f221813b2bb87f24d81f60f1fcdbf7cbf4356

Account #8: 0x23618e81E3f5cdF7f54C3d65f7FBc0aBf5B21E8f (10000 ETH)
Private Key: 0xdbda1821b80551c9d65939329250298aa3472ba22feea921c0cf5d620ea67b97

Account #9: 0xa0Ee7A142d267C1f36714E4a8F75612F20a79720 (10000 ETH)
Private Key: 0x2a871d0798f97d79848a013d4936a73bf4cc922c825d33c1cf7073dff6d409c6

Account #10: 0xBcd4042DE499D14e55001CcbB24a551F3b954096 (10000 ETH)
Private Key: 0xf214f2b2cd398c806f84e317254e0f0b801d0643303237d97a22a48e01628897

Account #11: 0x71bE63f3384f5fb98995898A86B02Fb2426c5788 (10000 ETH)
Private Key: 0x701b615bbdfb9de65240bc28bd21bbc0d996645a3dd57e7b12bc2bdf6f192c82

Account #12: 0xFABB0ac9d68B0B445fB7357272Ff202C5651694a (10000 ETH)
Private Key: 0xa267530f49f8280200edf313ee7af6b827f2a8bce2897751d06a843f644967b1

Account #13: 0x1CBd3b2770909D4e10f157cABC84C7264073C9Ec (10000 ETH)
Private Key: 0x47c99abed3324a2707c28affff1267e45918ec8c3f20b8aa892e8b065d2942dd

Account #14: 0xdF3e18d64BC6A983f673Ab319CCaE4f1a57C7097 (10000 ETH)
Private Key: 0xc526ee95bf44d8fc405a158bb884d9d1238d99f0612e9f33d006bb0789009aaa

Account #15: 0xcd3B766CCDd6AE721141F452C550Ca635964ce71 (10000 ETH)
Private Key: 0x8166f546bab6da521a8369cab06c5d2b9e46670292d85c875ee9ec20e84ffb61

Account #16: 0x2546BcD3c84621e976D8185a91A922aE77ECEc30 (10000 ETH)
Private Key: 0xea6c44ac03bff858b476bba40716402b03e41b8e97e276d1baec7c37d42484a0

Account #17: 0xbDA5747bFD65F08deb54cb465eB87D40e51B197E (10000 ETH)
Private Key: 0x689af8efa8c651a91ad287602527f3af2fe9f6501a7ac4b061667b5a93e037fd

Account #18: 0xdD2FD4581271e230360230F9337D5c0430Bf44C0 (10000 ETH)
Private Key: 0xde9be858da4a475276426320d5e9262ecfc3ba460bfac56360bfa6c4c28b4ee0

Account #19: 0x8626f6940E2eb28930eFb4CeF49B2d1F2C9C1199 (10000 ETH)
Private Key: 0xdf57089febbacf7ba0bc227dafbffa9fc08a93fdc68e1e42411a14efcf23656e

WARNING: These accounts, and their private keys, are publicly known.
Any funds sent to them on Mainnet or any other live network WILL BE LOST.

Now open a new terminal and run the following :

hh run scripts/transfer.js

You'll find that the attacker's balance has been increased by 100,000 USDC.

Initial USDC balance of whale :  45274535.206439
Initial USDC balance of attacker :  0.137975
Final USDC balance of whale :  45174535.206439
Final USDC balance of attacker :  100000.137975

I hope you learnt to fork the mainnet for testing your applications in this tutorial. If you have any doubts or errors feel free to reach out to me on Twitter.

Cheers