Dynamic Array Double-Access Attack in Ethereum

Abstract

We propose a new type of variable coverage method called Dynamic Array Double-Access Attack (DADA Attack) in Ethereum Virtual Machine (EVM). Such attack can read and write operations anywhere in the storage area, resulting in abnormal execution of contract and out of control. Vulnerable contracts with such attacks will directly lead to the loss of a large amount of property. To evaluate the effectiveness of such Double-Access Attack, we conducted theoretical analysis and experimental verification, finding attack success rate is 100% under the condition that dynamic array length is controllable.