Founder @ https://xitter.cf/t.co/gcgrMm5l8P, JohnnyTime @ Youtube, Securing Web3 @ https://xitter.cf/t.co/wJdpJyYK5y & https://xitter.cf/t.co/3d9aL8nDvG
Web3
Joined February 2012
- Tweets10.6K
- Following1.5K
- Followers12.8K
- Likes37.1K
An upgradeable proxy holds state; its implementation supplies code. Deploying the implementation doesn't initialize the proxy.
Initialize the proxy during deployment. Verify owner/roles, block repeat initialization, lock implementation and test upgrade permissions.
4/4 Euler Labs' account of the historical V1 exploit and recovery:
euler.finance/blog/war-peace…
Euler V2 has a different architecture.
3/4 The attacker self-liquidated for a bonus larger than the donation loss.
Review the whole sequence: can an attacker reduce collateral, trigger liquidation and recover more through the bonus than they gave up?
2/4 donateToReserves reduced the account's collateral without a health check.
The remaining collateral no longer supported the debt, making the account liquidatable.
Lending protocols pay a liquidation bonus to accounts that repay unhealthy debt.
In Euler V1's March 2023 exploit, an attacker made an account eligible for liquidation, then collected that bonus through self-liquidation. 1/4
4/4 Three Foundry cases pass in this AI-assisted educational example: lost credit in the vulnerable version, preserved credit after the fix, and a valid payment.
When reviewing a withdrawal, test a receiver that rejects ETH.
3/4 Requiring the call to succeed makes the rejected payment revert the transaction and restore the user's credit.
A separate test confirms a normal receiver gets paid. An unpaid user must keep their claim in this design.
2/4 A low-level ETH call returns a success flag. Failed payment doesn't automatically revert the caller's transaction.
A receiver rejects ETH: the transaction completes, 1 ETH stays in the vault, and the user's credit is erased.
A Solidity withdrawal can complete without paying the user.
In this toy vault, credit records the ETH owed to a user. The function clears it before a low-level payment call and ignores the success flag. 1/4
An ERC-20 approval lets a spender move tokens from your wallet. Before signing, check:
- Chain
- Token
- Spender address
- Amount
NFT operator approvals, permits and signed orders can have different scopes and cancellation rules. Check the permission type too.
The SCH dashboard now shows your current course, progress and next lesson together. Open your dashboard to continue from where you stopped.
🎯🎯🎯🎯🎯🎯
These global Codex resets are genuinely frustrating.
A “free reset” sounds great until you realize it can wipe your remaining usage nd restart your 7 day timer.
So people who carefully manage their quota can actually end up losing out.
And the higher your subscription tier, the more unused usage you potentially sacrifice.
The solution is simple:
- give a bank the reset
- don't restart our weekly timer
- at least give us an opt out
And please announce resets inside Codex, not through some employee's X account. LOL
Even after paying, managing usage shouldn't feel like gambling.
@thsottiaux
AI changed the tools around smart contract auditing.
The route into the field looks much the same: read code, break small contracts, write tests, and document bugs clearly.
That is the roadmap I made in 2024:
youtube.com/watch?v=rpnFJMYb…