Doing it right: the FREI-PI pattern #Defi_security
https://www.nascent.xyz/idea/youre-writing-require-statements-wrong @EthSecurity1

poly chain hack https://dedaub.com/blog/poly-chain-hack-postmortem
security alerts channel because of twitter restriction https://t.me/web3_security_alerts @EthSecurity1

Vulnerability Detection with Automatic Semantical Oracles

Towards Automated Verification of Smart Contract Fairness Fairness Property
Clockwork Finance: Automated Analysis of Economic Security in Smart Contracts @EthSecurity1

common Smart contract vulnerabilities by Raiders
https://blog.web3sec.news/posts/common-smart-contract-vulnerabilities-audit-checklist/

https://crosschainriskframework.github.io
Crosschain Risk Framework @EthSecurity1

How to diff contracts against Etherscan verified code https://blog.theredguild.org/how-to-diff-smart-contracts-etherscan/

https://github.com/lidofinance/diffyscan

@EthSecurity1

The zero-knowledge attack of the year might just have happened, or how Nova got broken @EthSecurity1

BrutePrint: Expose Smartphone Fingerprint Authentication to Brute-force Attack.

2 Hours Web3 Smart Contract Security Interview with Dravee.

@EthSecurity1

still stuck using csv? well there’s a new tool for anyone that enjoys rust, parquet, or crypto data…

❄️🧊cryo🧊❄️

you can use cryo to easily extract:
- blocks
- txs
- logs
- call traces
- slot traces
- balance traces
- nonce traces
- code traces
- vm traces

cryo can extract all historical uniswap trades with this command:

cryo logs --topic0 0xc42079f94a6350d7e6235f29174924f928cc2ac818eb64fed8004e115fbcca67

@EthSecurity1

Patch Thursday — Security risks due to exchange rate manipulation of ibToken


From Exploit to Recovery: Unraveling DeFi Incidents with Spreek


Secrets of Successful Bug Hunting: Insights from Pro Whitehats and Immunefi with Mackenzie

@EthSecurity1

Guide To Advanced Calldata | Everything You Need To Know

Behind the Scenes of Smart Contract Security Reviews - Engn33r

smart contract audit tools

@EthSecurity1

Differential Fuzzing On Solidity Fixed-Point Libraries link


Pre-deployment Analysis of Smart Contracts -- A Survey link


With Trail to Follow: Measurements of Real-world Non-fungible Token Phishing Attacks on Ethereum. link

@EthSecurity1

Arbiter - EVM logic simulator for security and performance testing @EthSecurity1

Do not miss officercia articles

Short types in solidity: Rare tricks

http://officercia.mirror.xyz/SnmH8v6QV6jHa64boANXySxBZsem8oiSP7zxgss_BEU

Amm integration

http://blog.pessimistic.io/amm-automatic-market-makers-integration-tips-e42fe275e13c?1

@EthSecurity1

What is Caracal?
Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts.

What about its Features?
👉Detectors to detect vulnerable Cairo code
👉Printers to report information
👉Taint analysis
👉Data flow analysis framework
👉Easy to run in Scarb projects

Any overview of its detectors?

1) controlled-library-call
Library calls with a user controlled class hash

2) unchecked-l1-handler-from
Detect L1 handlers without from address check

3) reentrancy
Detect when a storage variable is read before an external call and written after

4) unused-events
Events defined but not emitted

5) unused-return
Unused return values

6) unenforced-view
Function has view decorator but modifies state

7) unused-arguments
Unused arguments

8) reentrancy-benign
Detect when a storage variable is written after an external call but not read before

9) reentrancy-events
Detect when an event is emitted after an external call leading to out-of-order events

10) dead-code
Private functions never used


More info on how to install it and its limitations can be found in the repo below 👇
https://github.com/crytic/caracal

@ethers_security

Variaty in Role of Access Control in Solidity Smart Contracts. (this is cool)

Protecting the Decentralized Future: An Exploration of Common Blockchain Attacks and their Countermeasures
@EthSecurity1

Unveiling Transaction Simulation Challenges: Blowfish Case Study by Tiago Assumpcao (Coinspect).

An Empirical Study of Impact of Solidity Compiler Updates on Vulnerabilities in Ethereum Smart Contracts.

Typical vulnerabilities in LSD protocols by kasimonagasaki (Decurity)

@EthSecurity1

Smashing bugs using Certora Prover: A hands on approach to Formal Verification of Smart Contracts

What's inside a node? Malicious IPFS nodes under the magnifying glass


@EthSecurity1

Pink drainer learned new tricks such as using private sales on Blur to prevent frontrunning by 0xQuit.
https://drops.scamsniffer.io/post/pink-drainer-steals-3m-from-multiple-hack-events-including-openai-cto-orbiter-finance/

Learn EVM Course by 0xMacro

Blockchain Censorship

Signature Malleability PoC by pcaversaccio.


@EthSecurity1

EVM CFG - a fast and accurate CFG generator for EVM bytecode using symbolic stack analysis

CheckTheChain - a ChatGPT plugin that lets AI do blockchain analysis.

Uniswap V3 TWAP: Assessing TWAP Market Risk by Omer Goldberg.

Immunefi Bug Bounty Writeups List by sayan011.

@EthSecurity1