“Vulnerability Details

The Pools.swap function does not check if base is one of the base tokens. One can transfer tokens to the pool and set base=token and call swap(token, token, member, toBase=false).

The _actualInput = getAddedAmount(base, token); will return the token amount added but use the ratio compared to the base reserve calcSwapOutput(_actualInput=tokenInput, mapToken_baseAmount[token], mapToken_tokenAmount[token]); = tokenIn / baseAmount * tokenAmount which yields a wrong swap result.”
@securlydevv

https://mprimi.github.io/portable-secret/

As an opposite solution

ERC 4337 is

1. Key recovery
2. Wallet 2FA
3. Transaction bundling
4. Pay with any token
5. Security and fraud monitoring
6. Decentralized wallet recovery
7. Autopay crypto
8. Sponsored transactions
10. Multiple parties to sign a transaction

Code security scanning tool (SAST) that discover, filter and prioritize security risks and vulnerabilities leading to sensitive data exposures (PII, PHI, PD).
https://docs.bearer.com/
@EthSecurity1

Happy persian new year
2582 achaemenid

"noroz be shadi sal 2582 hakhamaneshi"

Zan zendegi azadi

Woman life freedom

Awesome Iran Freedom

Handy for residents of all countries where there are Internet restrictions.

Telegram Proxies lists
Free VPS Providers
VPN/Proxy apps for Android, iOS, Windows, MacOS
Tor, Psiphon, Ultrasurf...

and more.

https://github.com/hiddify/awesome-iran-freedom

Contributor twitter.com/hiddify_com
@Ethsecurity1

Awesome #ChatGPT

Main principles
Prompts
Web Apps
Chrome Extensions
Video Courses
Official Resources
Github Projects

and more.

https://github.com/OpenMindClub/awesome-chatgpt

the Mullvad Browser - built by the Tor Project. A browser allowing anyone to take advantage of the privacy protections of Tor Browser without Tor.
👀 Learn more here: https://t.co/TW9MfXFrK5

Sentiment got hacked for 1m $. Reentrancy Root cause

https://www.coindesk.com/business/2023/04/05/developers-fork-uniswap-v3-protocol-attracts-123m-in-total-value-locked/

What mystery behind growth of forked dapp?

Mev-boost is now semi-permissioned.

A validator blacklist was added as part of the fix last week.

I'm highlighting it because I can find no public announcement or community discussion about this.
github.com/flashbots/mev-…
@EthSecurity1