The next-gen bug bounty platform for web3. Join our Discord: https://xitter.cf/t.co/rVeBCG040s
Joined August 2022
- Tweets193
- Following201
- Followers857
- Likes463
Pinned Tweet
We've put together a @NotionHQ dashboard for web3 security researchers!
It contains heaps of resources and a neat template to help you organise your findings and navigate codebases.
Let us know what you like or whats missing below!
protective-stranger-59a.noti…
We are honoured to be among such names!
Exciting things coming soon! 🤠
Here are 3 more resources where you can test your auditing skills through competitive audits and get your name out while possibly earning some well deserved bounties🤩
♦️ @sherlockdefi
♦️ @saloonfinance
♦️ @code4rena
7
962
Are you familiar with the challenges borrowing and lending protocols face?
Dive into:
- Illiquid liquidations
- Collateral Safeness
- The dangers of governance
- Oracle risk and cost of manipulation
And much more...
article by: @0xnikceth
tokeninsight.com/en/research…
Having a dashboard with details about all DeFi exploits to help you become an exploit master mind sounds almost too good to be true.
But @DefiLlama has got you covered!
defillama.com/hacks
Incredibly valuable resource with foundry tests to help you understand and replicate vulnerabilities worth more than $1B (B for billions)!
You can find many more resources like this within our security researcher dashboard (pinned).
github.com/coinspect/learn-e…
In the span of a few days:
1. USDC depeg making us re-evaluate our dependency on fiat.
2. Vulnerability in SHA3(keccak) eprint.iacr.org/2023/331.pdf
3. Euler $197m exploit.
xitter.cf/peckshield/status/1635…
4. What's next?
Don't let your guard down.
@realgmhacker credit for SHA3 news.
1/ @eulerfinance was exploited in a flurry of txs on Ethereum (one hack tx: etherscan.io/tx/0xc310a0affe…), leading to the lost of ~$197m from the project.
Euler under attack. There is no rest in crypto.
3/ updated two more attack transactions. The total loss is around 197 Million USD
docs.google.com/spreadsheets…
1
429
The Saloon retweeted
There are still some ongoing attacks on the SwapX contract over the past few days.
More than 20,000 addresses have approved to 0x6D8981847Eb3cc2234179d0F0e72F6b6b2421a01
⚠️Pls revoke your approval ASAP.
It should be illegal for devs/auditors to not know this:
How to prevent MEV frontrunners from stealing your funds with bytecode obfuscation.
Learn how to protect your smart contract's alpha with a deep dive into bytecode obfuscation techniques!
degatchi.com/articles/smart-…
Many protocols allow users to create contracts for others to interact with.
In this C4 audit for @escherxyz , auditor @hansfriese et al. highlights how things can go wrong if contract creation is not carefully implemented.
🧵4
Bug: For all sales, creators create new sales contracts with arbitrary data. Malicious creators can create fake contracts that implemented IEscher721 and fake buyers to get free earnings because there is no check to verify if the contract was deployed through the Escher Factory.
1
2
329
Operational Security practices is like brushing your teeth.
Takes a little discipline.
Sometimes you just don't want to, sometimes you forget about it.
But you always need to, unless you want to end up looking like you haven't brushed your teeth in a long time.
4
370
Just a reminder that keeping your code concise helps with:
1. Readability
2. Gas Cost
3. Deployment cost
4. Decreasing audit costs!
6
367
Regardless what model you fall under, staking a % of the audit payment in a post-audit bounty would differentiate you from the competition and mitigate the issue below.
The classic: "Put your 💸 where your 👄 is"
Different audit models and their issues:
Pay-per-finding:
- No guarantees of any findings. You pay what you get
Traditional auditing firms:
- No guarantee that any real effort has been put in
C4, Sherlock:
- No guarantee talented auditors will show up
1
3
519
$800M were lost in 2022 due to stolen private keys.
It seems there is a gap in the market needing to be fulfilled.
Operational security is out-of-scope for smart contracts audits, but shouldn't be ignored.
Tag an operational security consultant/auditor below (if you can)👇
1/4
One important distinction to make when building or auditing a protocol is between economic and code security.
Simple way to differentiate them:
Code security: expected code functionality matches implementation.
Economic security: soundness of economic mechanism design.
Flaws in economic mechanisms are usually a much bigger deal than issues with code. They usually imply refactoring large spans of codebases and sometimes even having to go back to the drawing board.
1
1
316
@SmolQuants gives a great talk in this
@SpearbitDAO workshop about economic security!
youtube.com/watch?v=_E5juBbF…
3
267