Impact:

In passThruGate function, msg.value is checked to be greater than the required cost, but the excess amount is not returned to the sender.
mitigation:
Return excess eth to sender
function passThruGate(uint index, address) override external payable {
uint price = getCost(index);
require(msg.value >= price, 'Please send more ETH');

// bump up the price
Gate storage gate = gates[index];
// multiply by the price increase factor
gate.lastPrice = (price * gate.priceIncreaseFactor) / gate.priceIncreaseDenominator;
// move up the reference
gate.lastPurchaseBlock = block.number;

// pass thru the ether
if (msg.value > 0) {
// use .call so we can send to contracts, for example gnosis safe, re-entrance is not a threat here
(bool sent, bytes memory data) = gate.beneficiary.call{value: msg.value}("");
require(sent, 'ETH transfer failed');
}
} @EthSecurity1

Demystifying Exploitable Bugs in Smart Contracts https://www.cs.purdue.edu/homes/zhan3299/res/ICSE23.pdf @EthSecurity1

https://dacian.me/exploiting-developer-assumptions @EthSecurity1

https://medium.com/@balakhonoff_47314/how-to-access-real-time-smart-contract-data-from-python-code-using-lido-as-an-example-38738ff077c5
@EthSecurity1

Somebody: Hey all, I made this simple flashbots bundler app to help people with white hat recoveries of compromised accounts http://flashbots-bundler.surge.sh/

You can use the UI to generate a new flashbots rpc, build the bundle by sending eth for gas, then the recovery TX, then withdraw remaining funds. Then when you hit submit bundle it goes through a relayer i maintain

I’ve used it to help a few people that had leaked wallets and sweeper bots. If you know anyone who has this issue feel free to send them my way!

Here’s a video walkthrough https://www.youtube.com/watch?v=itPz35FGGJk

If you use it, I recommend paying around 3x the gas price to get included. And make sure your bundle is over 42k gas or it will be ignored by the network or see http://whitehat.flashbots.net
@EthSecurity1

Zipped contracts
Compressed contracts that automatically self-extract when called
https://github.com/merklejerk/zipped-contracts

GasBad is an open-source project that evaluates gas efficiency in Solidity libraries
https://github.com/ciwines/gas-bad
@EthSecurity1

https://medium.com/@spearbit/numerical-analysis-tips-and-tricks-for-defi-audits-9965db8ac5de

https://blog.decurity.io/typical-vulnerabilities-in-lending-and-cdp-protocols-e778e540e215
@EthSecurity1

We reached to 1000 members thank you all.
Special thanks to officercia.eth who support me at first.

Hey team, I am working on https://web3sec.news which is an open source initiative for web3 security. It tracks of all latest hacks, news, events, roadmaps, challenges, blogs etc for the community as an aggregator. It would be very helpful if you can help me getting the community feedbacks & spreading the cause together 💪🏻🔥

Ethereum investigation tools. #osint Google Dorks
Blacklists
Storage Platforms
Explorers
Scoring
https://github.com/moonIighted/OSINT-MindMaps/blob/main/Ethereum%20Investigation.png
Transaction monitoring @Ethsecurity1

Auditing resources part 3:
Immunify Forge POC
EVM Security ReposPractice Secureum Races
Web3 Security DAO
Tomo Labo Bugs - Medium | High
Auditor Roadmap by Razzor
All things Reentrancy
Checks while Hacks
rareskills common vulners
@EthSecurity1

Here are some key auditing tips and insights :
1. Understand the System: Before starting the audit, it's important to understand the
system you're auditing. This includes understanding the high-level overview of the system, how it works, and what makes it unique. In the case of Asteria, understanding the roles of different players in the system, how vaults exist, how loans are represented, and how liquidations work was crucial.
2. Identify Complexities: Identify the complexities in the system. For example Asteria, the
complexities included calls going back and forth between contracts, the system being almost entirely stateless, and the need for accurate total assets of the vault.
3. Look for Vulnerabilities: Look for vulnerabilities in the system. In the case of Asteria, vulnerabilities were found in the delegate role, the stateless system, the Seaport auctions, and the ERC4626 calculations.
4. Learn from Mistakes: Learn from the mistakes made in the system. For Asteria, mistakes were made in not using EC recover properly, having a lot of data inputted, having many different entry points using shared back-end logic, and not resetting variables when changing hands.
5. Implement Fixes: Implement fixes for the vulnerabilities found. For Asteria, fixes included adding checks, getting rid of certain functions, adding unchecked blocks, and changing the way the Seaport liquidations work.
6. Test Thoroughly: Ensure thorough testing is done to cover all edge cases. In the case of Asteria, while they had done the hard parts of testing, they could have done more thorough testing to ensure all edge cases were covered.
7. Rebuild if Necessary: If the product has evolved a lot and more features have been added, it might be beneficial to rebuild or rethink the system from first principles. This
can help ensure that all functionalities are encoded in shared logic and that all validations are rock solid.
8. Stay Updated: Stay updated with the latest vulnerabilities and fixes in the blockchain and smart contract space. This can help you identify potential vulnerabilities in the system you're auditing.
Remember, auditing is a complex process that requires a deep understanding of the system, a keen eye for detail, and a thorough approach to testing. @EthSecurity1

On May 28, @jimbosprotocol
fell victim to a significant flash loan attack, resulting in a staggering loss of $7.5M.

In this article we offer a concise analysis, unveiling key details and implications of this incident. https://medium.com/@auditone.io/the-7-5-million-flash-loan-unveiled-analyzing-jimbos-protocol-attack-25cf7fd55079 @EthSecurity1

The math behind Defi is not as hard as you think
https://cryptocutie.medium.com/the-math-behind-defi-is-not-as-hard-as-you-think-60e1ba39ee2a
Immunefi bug bounty writeups list
https://github.com/sayan011/Immunefi-bug-bounty-writeups-list
Huff vs Yul for EVM Smart Contracts
https://medium.com/@jtriley15/huff-vs-yul-for-evm-smart-contracts-620d1d618197
@EthSecurity1

Compound v2 visualisation

https://betterprogramming.pub/compound-v2-in-depth-6227c0528b5?gi=4e5180ce876b
@EthSecurity1

Signed signature always should have an expiration.

The expiration ensures that the signature becomes invalid once the specified time has passed. @EthSecurity1

GM!

Today, we will try to understand what a bug bounty is, why it’s important, and why it can complement auditing rather than replace it in order to increase security!

• officercia.medium.com/web3-security-distilled-9ff4b2f778c5

Please share 🫡️️️️️️

#security #bugbounty #web3

Cool idea 💡 Tornado v2 🧵
https://twitter.com/bi_gly/status/1667094239132655618?s=21
@EthSecurity1

If you watched patrick's hardhat edition course either foundry edition you will found only thing has diffred is👇

how good question

I recommend to everybody who intend to watch foundry edition

swallow this repo instead watch it:)) https://github.com/selfteaching/How-To-Ask-Questions-The-Smart-Way

@EthSecurity1

Fully repaying a loan will result in debt payment being lost.When a loan is fully repaid the loan storage is deleted. Since loan is a storage reference to the loan, loan.lender will return address(0) after the loan has been deleted. This will result in the debt being transferred to address(0) instead of the lender. Some ERC20 tokens will revert when being sent to address(0) but a large number will simply be sent there and lost forever.In Cooler#repay the loan storage associated with the loanID being repaid is deleted. loan is a storage reference so when loans[loanID] is deleted so is loan. The result is that loan.lender is now address(0) and the loan payment will be sent there instead.

Recommendation:
Send collateral/debt then delete:

- if (repaid == loan.amount) delete loans[loanID];
+ if (repaid == loan.amount) {
+ debt.transferFrom(msg.sender, loan.lender, loan.amount);
+ collateral.transfer(owner, loan.collateral);
+ delete loans[loanID];
+ return;
+ }
@EthSecurity1