Vulnerability Detection with Automatic Semantical Oracles

Finding Permission Bugs in Smart Contracts with Role Mining Access Control

AChecker: Statically Detecting Smart Contract Access Control Vulnerabilities Access Control

@EthSecurity1

https://www.propellerheads.xyz/blog/blockchain-and-llms @EthSecurity1

Last week, Shido Global was exploited on BSC through a flash loan attack, allowing the attacker to steal around 977 WBNB from the pool. https://explorer.phalcon.xyz/tx/bsc/0x72f8dd2bcfe2c9fbf0d933678170417802ac8a0d8995ff9a56bfbabe3aa712d6I
@EthSecurity1

https://mindsets-of-auditing.netlify.app/ @EthSecurity1

Mastering Fuzzing

https://github.com/Elpacos/mastering-fuzzing
It provides several practical examples of fuzzing using both Echidna & Foundry, two popular property based testing tools @EthSecurity1

These results are from a 1-hour long bot-race & not a full-fledged audit.

Wake up to the reality anon, ChatGPT & bots will soon eradicate the lower rungs of bugs from any codebase.

Only the auditors that dare to dive deep will survive this battlefield.

https://gist.github.com/liveactionllama/27513952718ec3cbcf9de0fda7fef49c
@Ethsecurity1

This POC shows you how to perform view-only reentrancy

Just copy paste the code into your tests as an integration test

For Auditors: Apply the check to test if an oracle is safe or not (test against all uses, see sturdy) https://github.com/sherlock-audit/2022-12-sentiment-judging/issues/7
@EthSecurity1

Doing it right: the FREI-PI pattern #Defi_security
https://www.nascent.xyz/idea/youre-writing-require-statements-wrong @EthSecurity1

poly chain hack https://dedaub.com/blog/poly-chain-hack-postmortem
security alerts channel because of twitter restriction https://news.1rj.ru/str/web3_security_alerts @EthSecurity1

Vulnerability Detection with Automatic Semantical Oracles

Towards Automated Verification of Smart Contract Fairness Fairness Property
Clockwork Finance: Automated Analysis of Economic Security in Smart Contracts @EthSecurity1

common Smart contract vulnerabilities by Raiders
https://blog.web3sec.news/posts/common-smart-contract-vulnerabilities-audit-checklist/

https://crosschainriskframework.github.io
Crosschain Risk Framework @EthSecurity1

How to diff contracts against Etherscan verified code https://blog.theredguild.org/how-to-diff-smart-contracts-etherscan/

https://github.com/lidofinance/diffyscan

@EthSecurity1

The zero-knowledge attack of the year might just have happened, or how Nova got broken @EthSecurity1

BrutePrint: Expose Smartphone Fingerprint Authentication to Brute-force Attack.

2 Hours Web3 Smart Contract Security Interview with Dravee.

@EthSecurity1

still stuck using csv? well there’s a new tool for anyone that enjoys rust, parquet, or crypto data…

❄️🧊cryo🧊❄️

you can use cryo to easily extract:
- blocks
- txs
- logs
- call traces
- slot traces
- balance traces
- nonce traces
- code traces
- vm traces

cryo can extract all historical uniswap trades with this command:

cryo logs --topic0 0xc42079f94a6350d7e6235f29174924f928cc2ac818eb64fed8004e115fbcca67

@EthSecurity1

Patch Thursday — Security risks due to exchange rate manipulation of ibToken


From Exploit to Recovery: Unraveling DeFi Incidents with Spreek


Secrets of Successful Bug Hunting: Insights from Pro Whitehats and Immunefi with Mackenzie

@EthSecurity1

Guide To Advanced Calldata | Everything You Need To Know

Behind the Scenes of Smart Contract Security Reviews - Engn33r

smart contract audit tools

@EthSecurity1

Differential Fuzzing On Solidity Fixed-Point Libraries link


Pre-deployment Analysis of Smart Contracts -- A Survey link


With Trail to Follow: Measurements of Real-world Non-fungible Token Phishing Attacks on Ethereum. link

@EthSecurity1

Arbiter - EVM logic simulator for security and performance testing @EthSecurity1