Differential Fuzzing On Solidity Fixed-Point Libraries link


Pre-deployment Analysis of Smart Contracts -- A Survey link


With Trail to Follow: Measurements of Real-world Non-fungible Token Phishing Attacks on Ethereum. link

@EthSecurity1

Arbiter - EVM logic simulator for security and performance testing @EthSecurity1

Do not miss officercia articles

Short types in solidity: Rare tricks

http://officercia.mirror.xyz/SnmH8v6QV6jHa64boANXySxBZsem8oiSP7zxgss_BEU

Amm integration

http://blog.pessimistic.io/amm-automatic-market-makers-integration-tips-e42fe275e13c?1

@EthSecurity1

What is Caracal?
Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts.

What about its Features?
👉Detectors to detect vulnerable Cairo code
👉Printers to report information
👉Taint analysis
👉Data flow analysis framework
👉Easy to run in Scarb projects

Any overview of its detectors?

1) controlled-library-call
Library calls with a user controlled class hash

2) unchecked-l1-handler-from
Detect L1 handlers without from address check

3) reentrancy
Detect when a storage variable is read before an external call and written after

4) unused-events
Events defined but not emitted

5) unused-return
Unused return values

6) unenforced-view
Function has view decorator but modifies state

7) unused-arguments
Unused arguments

8) reentrancy-benign
Detect when a storage variable is written after an external call but not read before

9) reentrancy-events
Detect when an event is emitted after an external call leading to out-of-order events

10) dead-code
Private functions never used


More info on how to install it and its limitations can be found in the repo below 👇
https://github.com/crytic/caracal

@ethers_security

Variaty in Role of Access Control in Solidity Smart Contracts. (this is cool)

Protecting the Decentralized Future: An Exploration of Common Blockchain Attacks and their Countermeasures
@EthSecurity1

Unveiling Transaction Simulation Challenges: Blowfish Case Study by Tiago Assumpcao (Coinspect).

An Empirical Study of Impact of Solidity Compiler Updates on Vulnerabilities in Ethereum Smart Contracts.

Typical vulnerabilities in LSD protocols by kasimonagasaki (Decurity)

@EthSecurity1

Smashing bugs using Certora Prover: A hands on approach to Formal Verification of Smart Contracts

What's inside a node? Malicious IPFS nodes under the magnifying glass


@EthSecurity1

Pink drainer learned new tricks such as using private sales on Blur to prevent frontrunning by 0xQuit.
https://drops.scamsniffer.io/post/pink-drainer-steals-3m-from-multiple-hack-events-including-openai-cto-orbiter-finance/

Learn EVM Course by 0xMacro

Blockchain Censorship

Signature Malleability PoC by pcaversaccio.


@EthSecurity1

EVM CFG - a fast and accurate CFG generator for EVM bytecode using symbolic stack analysis

CheckTheChain - a ChatGPT plugin that lets AI do blockchain analysis.

Uniswap V3 TWAP: Assessing TWAP Market Risk by Omer Goldberg.

Immunefi Bug Bounty Writeups List by sayan011.

@EthSecurity1

Price & Reward Manipulation Attacks Distilled by Officercia

Numerical Analysis - Security Tips and Tricks for DeFi Audits by Spearbit.

Saving $100M at risk in KyberSwap Elastic by 100 Proof.

Election Fraud? Double Voting in Celer’s State Guardian Network by Felix Wilhelm.

@EthSecurity1

Satacom delivers browser extension that steals cryptocurrency by Kaspersky


Towards Understanding Crypto Money Laundering in Web3 Through the Lenses of Ethereum Heists

@EthSecurity1

Understanding Signature Replay Attack

@EthSecurity1

Critical problems of ERC20 token standard 2017


Known problems of ERC-20 token standard 2023

@EthSecurity1

Struggling with codebases? Try this:

1) Manage workload in bite-size sections daily

2) Interact with code through comments

3) Understand the code before the docs

4) Use state machines to track variable changes. Stay organized, stay efficient.

@EthSecurity1

huff vs yul

inline assembly???

In a way, yes. Yul is an assembly language, but it is designed to be used in conjunction with Solidity as a lower-level alternative to Solidity's high-level syntax. but Huff is not inline assembly

optimization???

Huff provides even greater efficiency and optimization at the cost of more complex programming. it is great to manage jumps and stacks

@EthSecurity1

6 security sins of Web3 bridges by Damian Rusinek.

Catch me if you can! Learning about edge cases of Solidity's try/catch while I explored Account Abstraction by matta.

@EthSecurity1

All things reentrancy! workshop by Jsec Security.

Intro to Smart Contract Security Audit — Front Running by SlowMist

ArbiNet is the MEV detection model that doesn't require knowledge about DeFi smart contracts.

@EthSecurity1

GM! Check out my latest piece!

I'll describe Web3 audits, CTFs, and compare the corresponding security methodologies in it.

Also presenting a new project from my friend’s team r(dot)xyz - go check it out as well fam!

• officercia.mirror.xyz/VmSJDoV3c8xKDMRjTOl4DQ7KPgBTlb8cVdcTlOJxj1g

#security #web3

https://medium.com/@unsnarl_secure/8-common-smart-contract-vulnerabilities-found-throughout-audit-contest-b421b80b08b5

@EthSecurity1

intro to zkp Security.this promoted by spearbit
https://www.youtube.com/watch?v=8wsR7o0rOxU&feature=youtu.be
@EthSecurity1