- solidity Audit challenges - Exploring Finality Risks of Ethereum L2 From a CEX Perspective - Smart Contracts | Tale of Little Bugs @EthSecurity1

DCF token hacked because of wrong transfer logic.

In "transfer" function, if target address is pancake pair, it exchanges 5% of tokens to USDT and adds liquidity to DCT-USDT pancake pair. This can be used for exploit. Hacker borrowed a huge amount of USDT and exchanged them to DCF and DCT. After that he transferred some of DCF to pancake pair. Liquidity added and he exchanged DCT to USDT again, gained 600k more USDT. Also, because of unnecessary burn functionality, pancake pair lost almost all DCF tokens. Developers, be careful when making new transfer logic, it should be audited. https://app.blocksec.com/explorer/tx/bsc/0xb375932951c271606360b6bf4287d080c5601f4f59452b0484ea6c856defd6fd @EthSecurity1

GFT was recently delisted by Binance, and now they're minting over 1 billion tokens and dumping them on exchanges lol
https://bscscan.com/token/0x72ff5742319ef07061836f5c924ac6d72c919080?a=0x0000000000000000000000000000000000000000 @EthSecurity1

Clipper DEX is hacked due to API vulnerability (like private key leak). $500K+ loss and $6.5M at risk right now. Withdraw immediately.

• https://x.com/officer_cia/status/1863108671221157985

#security #alert

- Past Permissions, Present Problems: Analysis of Theft through Authorized Malicious Contracts - Cryptographic Asymmetry and How To Shut Down A Cosmos-Ethereum Bridge - SoK: Security of Cross-chain Bridges: Attack Surfaces, Defenses, and Open Problems @EthSecurity1

Malware in the @solana/web3.js
Seen some similar cases of npm takeover in the past. Be careful💫

https://x.com/anza_xyz/status/1864085236432134264?s=46

Linkedin post

- Permission denied - The story of an EIP that sinned - Beanstalk Insufficient Input Validation Bugfix - What Are Elliptic Curve Pairings @EthSecurity1

Vestra Dao hacked. 73 m $vstr stolen. Root cause: there's no code for remove user staking info, this means anyone who staked some amount can unstake several times. Hacker just called "unStake" several times @EthSecurity1

Users lost millions due to AlpacaFinance
allegedly using manual CoinGecko price updates instead of real oracles. When questioned, they asked "which faster oracle would you have used?" https://rekt.news/false-prophet/ @EthSecurity1

Use this list of fantastic telegram channels I've put together in order to discover them as your own personal Web3-Google!

Link: t.me/addlist/uesom31GM1I4Yjgy

Feel free to use this folder to onboard your non-web3 friends to Web3, as the majority of the channels are maintained by independent researchers. There are also additional channels for news, CT reviews, and more!

A small tip to subscribooors: if you find a channel interesting, move it out of the folder into your main list of chats. That way you’ll view content you’re interested in more often, and channels get more views instead of just subscribers!

#crypto #web3

- Web3 tutorials for Python - The Invariant That Wasn’t - Quick tips to start your next invariant test campaign @EthSecurity1

https://web3-sec.gitbook.io/art-of-auditing @EthSecurity1

- Exchange Rate Manipulation in ERC4626 Vaults @EthSecurity1

- (Breaking) Circuits on Ethereum- Circuit Breakers - Liquid Staking challenge - Exploring Cosmos: A Security Primer
@EthSecurity1

sorra staking lost 43 k$. why? because of in every withdraw userRewardDistributed increasing. hacker withdraw 1wei multiple time. https://app.blocksec.com/explorer/tx/eth/0x6439d63cc57fb68a32ea8ffd8f02496e8abad67292be94904c0b47a4d14ce90d @EthSecurity1

- ERC1271 Replay - 15+ Teams Affected - Audit of a ZK application on example: Tornado Cash - Merkle Trees in Blockchain: A Study of Collision Probability and Security Implications @EthSecurity1

unilend exploited 197.6 $k. https://etherscan.io/tx/0x44037ffc0993327176975e08789b71c1058318f48ddeff25890a577d6555b6ba @EthSecurity1

cyvers 2024 Web3 Security Report


CertiK The Web3 Security Report 2024

Slowmist stolen fund analysis
@EthSecurity1

- Blockchain Bribing Attacks and the Efficacy of Counterincentives. - Undetectable Selfish Mining
- Bribe & Fork: Cheap Bribing Attacks via Forking Threat
- Optimism superchain audit report
@EthSecurity1

odosprotocol on ETH and Base, hacked for ~$50k . The root cause is arbitrary call vulnerability. attack tx: https://app.blocksec.com/explorer/tx/base/0xd10faa5b33ddb501b1dc6430896c966048271f2510ff9ed681dd6d510c5df9f6 @EthSecurity1

- Generating unit tests from broken stateful invariant tests - The Fuzzing Book: Tools and Techniques for Generating Software Tests @EthSecurity1