- Exchange Rate Manipulation in ERC4626 Vaults @EthSecurity1

- (Breaking) Circuits on Ethereum- Circuit Breakers - Liquid Staking challenge - Exploring Cosmos: A Security Primer
@EthSecurity1

sorra staking lost 43 k$. why? because of in every withdraw userRewardDistributed increasing. hacker withdraw 1wei multiple time. https://app.blocksec.com/explorer/tx/eth/0x6439d63cc57fb68a32ea8ffd8f02496e8abad67292be94904c0b47a4d14ce90d @EthSecurity1

- ERC1271 Replay - 15+ Teams Affected - Audit of a ZK application on example: Tornado Cash - Merkle Trees in Blockchain: A Study of Collision Probability and Security Implications @EthSecurity1

unilend exploited 197.6 $k. https://etherscan.io/tx/0x44037ffc0993327176975e08789b71c1058318f48ddeff25890a577d6555b6ba @EthSecurity1

cyvers 2024 Web3 Security Report


CertiK The Web3 Security Report 2024

Slowmist stolen fund analysis
@EthSecurity1

- Blockchain Bribing Attacks and the Efficacy of Counterincentives. - Undetectable Selfish Mining
- Bribe & Fork: Cheap Bribing Attacks via Forking Threat
- Optimism superchain audit report
@EthSecurity1

odosprotocol on ETH and Base, hacked for ~$50k . The root cause is arbitrary call vulnerability. attack tx: https://app.blocksec.com/explorer/tx/base/0xd10faa5b33ddb501b1dc6430896c966048271f2510ff9ed681dd6d510c5df9f6 @EthSecurity1

- Generating unit tests from broken stateful invariant tests - The Fuzzing Book: Tools and Techniques for Generating Software Tests @EthSecurity1

DeepSeek has been hacked: all of their data in the public domain - secret keys, unencrypted chats, logs, and even the backend.

Researchers from wiz.io were performing a normal infrastructure check when they unintentionally uncovered a database that is fully open, allowing anyone to obtain access.

I cannot confirm or deny their conclusions at this time. But I think it's interesting enough news to share: x.com/officer_cia/status/1884740598579540060

#ai #news #security

1 Million Deepseek Data Breach

DeepSeek AI Data Breach Exposes Over 1 Million Logs and Sensitive Secrets - Chinese AI startup DeepSeek left a database exposed online, leaking over 1 million log lines, chat histories, API keys, and sensitive backend details

Seems service had backdoor
@EthSecurity1

- Uniswap V4: Hooks Security Considerations
- kyberswap hacker arrested - crypto losses in janurary 2025 @EthSecurity1

New Patrick Collins course

https://m.youtube.com/watch?v=nWsLw_1OpE0&pp=ygUMRnJlZWNvZGVjYW1w
@EthSecurity1

250 LBTC hacked form ionicmoney. why? because ionic listed fake LBTC on mode chain

Thus, the attacker can call mint() with fabricated inputs and pass the check. @EthSecurity1

Web3 Security Auditor's 2024 Rewind - The Highlights https://blog.openzeppelin.com/web3-security-auditors-2024-rewind @EthSecurity1

Zklend been hacked for ~3600 ETH on starknet @EthSecurity1

ZKlend Hack rootcause: The attacker manipulated the "lending_accumulator" to be very large at 4.069297906051644020, then took advantage of the rounding error during ztoken mint() and withdraw() to repeatedly deposit 4.069297906051644021 wstETH getting 2 wei then withdraw 4.069297906051644020*1.5 -1 = 6.103946859077466029 wstETH to expend just 1 wei. @EthSecurity1

an issue found by zellic in the Cairo VM during a recent audit of Starknet OS.

This bug has been fixed as an immediate patch to Starknet's current version 0.13.3.

https://community.starknet.io/t/remediating-a-potential-sequencer-prover-inconsistency-in-the-cairo-vm/115313
@EthSecurity1

SlowMist founder: we discovered that the hacker who attacked zkLend has a close connection to the hacker who attacked EraLend in July 2023, and we suspect they are the same person: x.com/officer_cia/status/1890132436589445291?12

#security #privacy #investigation

Urgent Update for Geth Users!
Attention validators! If you are running Geth v1.15.1, upgrade to v1.15.2 immediately to prevent potential financial loss! @EthSecurity1

Seems Abstract wallets are being drained !
cardex_space involved
~ 180 ether loss
@EthSecurity1