NFT attacks https://0xvolodya.hashnode.dev/nft-attacks
@EthSecurity1

In this example, the _asset can be an ERC20 (!= address(0)) or ETH (== address(0)).
When transferring ERC20 tokens, it's crucial to ensure that the user doesn't send msg.value during that transaction. Otherwise, the value they send will be lost.
t's also important to check if the msg.value is equal to the amount when the asset is actually ETH (== address(0)). @EthSecurity1

https://medium.com/immunefi/intro-to-cryptography-and-signatures-in-ethereum-2025b6a4a33d @EthSecurity1

https://ethscriptions.com

It's cheaper and more decentralized than using contract storage.

Also protocol guarantees global uniqueness of the content of all valid Ethscriptions!

Plus it's skating to where the puck is going in an L2 world. https://ethereumpunks.net
@EthSecurity1

ESIP-1: Smart Contract Support

Specification

Incorporate two new smart contract events into the Ethscriptions Protocol:

- TransferEthscription(address indexed recipient, bytes32 indexed ethscriptionTxHash)

- CreateEthscription(address indexed initialOwner, string dataURI)

When a contract emits TransferEthscription, the protocol should register a valid ethscription transfer from the contract to recipient of the ethscription created in transaction hash ethscriptionTxHash, provided the contract owns that ethscription when emitting the event.

When a contract emits CreateEthscription, the protocol should register a valid ethscription creation, provided the dataURI is valid and unique. The initial owner will be initialOwner.

Rationale

Ethscriptions can be transferred to any address, which means smart contracts can own them. However, smart contracts cannot currently transfer or create ethscriptions themselves.

This inhibits the creation of protocol-native apps that require smart contracts, such as marketplaces. Further, it makes the protocol difficult to use for smart contract wallet users.

This proposal lays out a simple and low gas mechanism for enabling smart contracts to transfer and create ethscriptions, thereby creating parity between smart contracts and EOAs under the protocol.

Indexing these events across all contracts increases the burden of operating an indexer, but this extra cost is incremental given that indexers must inspect the calldata of every transaction anyway.
⚙️what triggers the creation would be the calldata of the transaction where you told the contract to do that—only that transaction gets a real transaction hash, which is the ethscription id.
@EthSecurity1

Bridge Bug Tracker https://github.com/0xDatapunk/Bridge-Bug-Tracker
Alloy: Fast, battle-tested and well-documented building blocks for Ethereum, in Rust https://github.com/alloy-rs/core/releases/tag/v0.2.0

@EthSecurity1

Vulnerability Detection with Automatic Semantical Oracles

Finding Permission Bugs in Smart Contracts with Role Mining Access Control

AChecker: Statically Detecting Smart Contract Access Control Vulnerabilities Access Control

@EthSecurity1

https://www.propellerheads.xyz/blog/blockchain-and-llms @EthSecurity1

Last week, Shido Global was exploited on BSC through a flash loan attack, allowing the attacker to steal around 977 WBNB from the pool. https://explorer.phalcon.xyz/tx/bsc/0x72f8dd2bcfe2c9fbf0d933678170417802ac8a0d8995ff9a56bfbabe3aa712d6I
@EthSecurity1

https://mindsets-of-auditing.netlify.app/ @EthSecurity1

Mastering Fuzzing

https://github.com/Elpacos/mastering-fuzzing
It provides several practical examples of fuzzing using both Echidna & Foundry, two popular property based testing tools @EthSecurity1

These results are from a 1-hour long bot-race & not a full-fledged audit.

Wake up to the reality anon, ChatGPT & bots will soon eradicate the lower rungs of bugs from any codebase.

Only the auditors that dare to dive deep will survive this battlefield.

https://gist.github.com/liveactionllama/27513952718ec3cbcf9de0fda7fef49c
@Ethsecurity1

This POC shows you how to perform view-only reentrancy

Just copy paste the code into your tests as an integration test

For Auditors: Apply the check to test if an oracle is safe or not (test against all uses, see sturdy) https://github.com/sherlock-audit/2022-12-sentiment-judging/issues/7
@EthSecurity1

Doing it right: the FREI-PI pattern #Defi_security
https://www.nascent.xyz/idea/youre-writing-require-statements-wrong @EthSecurity1

poly chain hack https://dedaub.com/blog/poly-chain-hack-postmortem
security alerts channel because of twitter restriction https://t.me/web3_security_alerts @EthSecurity1

Vulnerability Detection with Automatic Semantical Oracles

Towards Automated Verification of Smart Contract Fairness Fairness Property
Clockwork Finance: Automated Analysis of Economic Security in Smart Contracts @EthSecurity1