CryptoKitties, an Ethereum blockchain-powered game allows players to collect and breed digital cats for creating the “purrfect furry friend.” The game claims that each cat is entirely unique and owned by individual owners. A crypto kitty cannot get duplicated, taken away or destroyed as per the company. Emin Gün Sirer, a professor at Cornell University and co-director of IC3 recently tweeted about the reverse engineering of the CryptoKitty birthing process.
“Cryptokitty birthing process has been reverse engineered. You can time the birth to get a better kitty. Every hour interval generates a new kitty, like a zodiac sign. #Cryptoastrology,” tweeted Sirer.
The possibility of such reverse-engineering has been demonstrated in a paper that was included in the proceedings of the 27th USENIX Security Symposium held in the USA between 15th and 17th August. The paper has been presented under the title of ‘Erays: Reverse Engineering Ethereum’s Opaque Smart Contracts.’
This paper has been published to explore the possibility of a tool that can reverse-engineer smart contracts to audit them as has been called for frequently by regulatory bodies worldwide. Eray has attempted to provide a “high-level pseudocode” for performing manual analysis with an aim to introduce transparency in the ecosystem.
The paper notes that even as a sizeable part of the CryptoKitties source code is available publically, a core component has “deliberately” been kept opaque “in order to alter gameplay.” Such gameplay prevents the users from putting together the smart contract and thus makes it challenging for them to breed a rare cat.
As of January of this year, the top 10 kitties were worth $2.5 million combined, given their unique and rare features. After approximately three hours of reverse-engineering with Erays, the team was able to fabricate a contract with an output that exactly matched that of the mixGenes function on blockchain.
“To clarify, the game is designed to prevent this from being exploited, with a mandatory fee that subsidises ppl to call “giveBirth” as soon as possible,” replied Andrew Miller on Sirer’s tweet. Miller is a professor at the University of Illinois at Urbana-Champaign and associate director at IC3.