BrutePrint: Expose Smartphone Fingerprint Authentication to Brute-force Attack.

2 Hours Web3 Smart Contract Security Interview with Dravee.

@EthSecurity1

still stuck using csv? well there’s a new tool for anyone that enjoys rust, parquet, or crypto data…

❄️🧊cryo🧊❄️

you can use cryo to easily extract:
- blocks
- txs
- logs
- call traces
- slot traces
- balance traces
- nonce traces
- code traces
- vm traces

cryo can extract all historical uniswap trades with this command:

cryo logs --topic0 0xc42079f94a6350d7e6235f29174924f928cc2ac818eb64fed8004e115fbcca67

@EthSecurity1

Patch Thursday — Security risks due to exchange rate manipulation of ibToken


From Exploit to Recovery: Unraveling DeFi Incidents with Spreek


Secrets of Successful Bug Hunting: Insights from Pro Whitehats and Immunefi with Mackenzie

@EthSecurity1

Guide To Advanced Calldata | Everything You Need To Know

Behind the Scenes of Smart Contract Security Reviews - Engn33r

smart contract audit tools

@EthSecurity1

Differential Fuzzing On Solidity Fixed-Point Libraries link


Pre-deployment Analysis of Smart Contracts -- A Survey link


With Trail to Follow: Measurements of Real-world Non-fungible Token Phishing Attacks on Ethereum. link

@EthSecurity1

Arbiter - EVM logic simulator for security and performance testing @EthSecurity1

Do not miss officercia articles

Short types in solidity: Rare tricks

http://officercia.mirror.xyz/SnmH8v6QV6jHa64boANXySxBZsem8oiSP7zxgss_BEU

Amm integration

http://blog.pessimistic.io/amm-automatic-market-makers-integration-tips-e42fe275e13c?1

@EthSecurity1

What is Caracal?
Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts.

What about its Features?
👉Detectors to detect vulnerable Cairo code
👉Printers to report information
👉Taint analysis
👉Data flow analysis framework
👉Easy to run in Scarb projects

Any overview of its detectors?

1) controlled-library-call
Library calls with a user controlled class hash

2) unchecked-l1-handler-from
Detect L1 handlers without from address check

3) reentrancy
Detect when a storage variable is read before an external call and written after

4) unused-events
Events defined but not emitted

5) unused-return
Unused return values

6) unenforced-view
Function has view decorator but modifies state

7) unused-arguments
Unused arguments

8) reentrancy-benign
Detect when a storage variable is written after an external call but not read before

9) reentrancy-events
Detect when an event is emitted after an external call leading to out-of-order events

10) dead-code
Private functions never used


More info on how to install it and its limitations can be found in the repo below 👇
https://github.com/crytic/caracal

@ethers_security

Variaty in Role of Access Control in Solidity Smart Contracts. (this is cool)

Protecting the Decentralized Future: An Exploration of Common Blockchain Attacks and their Countermeasures
@EthSecurity1

Unveiling Transaction Simulation Challenges: Blowfish Case Study by Tiago Assumpcao (Coinspect).

An Empirical Study of Impact of Solidity Compiler Updates on Vulnerabilities in Ethereum Smart Contracts.

Typical vulnerabilities in LSD protocols by kasimonagasaki (Decurity)

@EthSecurity1

Smashing bugs using Certora Prover: A hands on approach to Formal Verification of Smart Contracts

What's inside a node? Malicious IPFS nodes under the magnifying glass


@EthSecurity1

Pink drainer learned new tricks such as using private sales on Blur to prevent frontrunning by 0xQuit.
https://drops.scamsniffer.io/post/pink-drainer-steals-3m-from-multiple-hack-events-including-openai-cto-orbiter-finance/

Learn EVM Course by 0xMacro

Blockchain Censorship

Signature Malleability PoC by pcaversaccio.


@EthSecurity1

EVM CFG - a fast and accurate CFG generator for EVM bytecode using symbolic stack analysis

CheckTheChain - a ChatGPT plugin that lets AI do blockchain analysis.

Uniswap V3 TWAP: Assessing TWAP Market Risk by Omer Goldberg.

Immunefi Bug Bounty Writeups List by sayan011.

@EthSecurity1

Price & Reward Manipulation Attacks Distilled by Officercia

Numerical Analysis - Security Tips and Tricks for DeFi Audits by Spearbit.

Saving $100M at risk in KyberSwap Elastic by 100 Proof.

Election Fraud? Double Voting in Celer’s State Guardian Network by Felix Wilhelm.

@EthSecurity1

Satacom delivers browser extension that steals cryptocurrency by Kaspersky


Towards Understanding Crypto Money Laundering in Web3 Through the Lenses of Ethereum Heists

@EthSecurity1

Understanding Signature Replay Attack

@EthSecurity1

Critical problems of ERC20 token standard 2017


Known problems of ERC-20 token standard 2023

@EthSecurity1

Struggling with codebases? Try this:

1) Manage workload in bite-size sections daily

2) Interact with code through comments

3) Understand the code before the docs

4) Use state machines to track variable changes. Stay organized, stay efficient.

@EthSecurity1

huff vs yul

inline assembly???

In a way, yes. Yul is an assembly language, but it is designed to be used in conjunction with Solidity as a lower-level alternative to Solidity's high-level syntax. but Huff is not inline assembly

optimization???

Huff provides even greater efficiency and optimization at the cost of more complex programming. it is great to manage jumps and stacks

@EthSecurity1