Formal verification for fun and profit
https://youtube.com/playlist?list=PLKtu7wuOMP9XHbjAevkw2nL29YMubqEFj

Formal verification of WETH
https://www.zellic.io/blog/formal-verification-weth

Verify emails with the same trust assumption as the email domain i.e. without trusting our server (because it doesnt exist)
dev.zkemail.xyz

Learn to be not idiot:) http://blockworksresearch.com/research/we-do-a-little-counter-exploit

🔴High severity
“The use of setYieldSource leaves the contract in a temporary inconsistent state because it changes the underlying yield source, but doesn’t (yet) transfer the underlying balances, while the shares stay the same.

The function balanceOfToken will show the wrong results, because it is based on _sharesToToken, which uses yieldSource.balanceOfToken(address(this)), that isn’t updated yet.

More importantly supplyTokenTo will give the wrong amount of shares back: First it supplies tokens to the yieldsource. Then is calls _mintShares, which calls _tokenToShares, which calculates the shares, using yieldSource.balanceOfToken(address(this)) This yieldSource.balanceOfToken(address(this)) only contains the just supplied tokens, but doesn’t include the tokens from the previous YieldSource. So the wrong amount of shares is given back to the user; they will be given more shares than appropriate which means”

“they can drain funds later on (once transferFunds has been done).

@securlydevv

“Vulnerability Details

The Pools.swap function does not check if base is one of the base tokens. One can transfer tokens to the pool and set base=token and call swap(token, token, member, toBase=false).

The _actualInput = getAddedAmount(base, token); will return the token amount added but use the ratio compared to the base reserve calcSwapOutput(_actualInput=tokenInput, mapToken_baseAmount[token], mapToken_tokenAmount[token]); = tokenIn / baseAmount * tokenAmount which yields a wrong swap result.”
@securlydevv

https://mprimi.github.io/portable-secret/

As an opposite solution

ERC 4337 is

1. Key recovery
2. Wallet 2FA
3. Transaction bundling
4. Pay with any token
5. Security and fraud monitoring
6. Decentralized wallet recovery
7. Autopay crypto
8. Sponsored transactions
10. Multiple parties to sign a transaction

Code security scanning tool (SAST) that discover, filter and prioritize security risks and vulnerabilities leading to sensitive data exposures (PII, PHI, PD).
https://docs.bearer.com/
@EthSecurity1

Happy persian new year
2582 achaemenid

"noroz be shadi sal 2582 hakhamaneshi"

Zan zendegi azadi

Woman life freedom