Uniswap v4 research, here are some interesting observations that have been noted by our development team so far :

1️⃣ The behavior of a hook can vary.
To ensure the pool works correctly with the hook, it is necessary to deploy the hook in a way that obtains the correct initial bits of its address. This requires mining the addresses for hooks contracts: https://github.com/Uniswap/v4-core/blob/2f9b30663b53c0165cd6d34651d8ff13287667c4/contracts/libraries/Hooks.sol#L8

2️⃣ Another interesting point: the Uniswap team implemented the SafeTransfer part in a similar way to Algebra V2.0, which caused some integration issues on zksync Era:
https://github.com/Uniswap/v4-core/blob/2f9b30663b53c0165cd6d34651d8ff13287667c4/contracts/libraries/CurrencyLibrary.sol#L36-L56

(Luckily enough, zkSync ended up releasing a compiler update)

3️⃣ It is worth noting that Uniswap chose to keep the bitmap as the data structure for the ticks, while we prefer using a doubly linked list, which makes large swaps cheaper with our model: https://github.com/Uniswap/v4-core/blob/main/contracts/libraries/TickBitmap.sol

Without the doubly linked list, there are additional iterations during the swap, which is not seen in the Algebra V2 code:
https://github.com/Uniswap/v4-core/blob/2f9b30663b53c0165cd6d34651d8ff13287667c4/contracts/libraries/Pool.sol#L422

4️⃣ What’s more? #UniV4 decided to remove all the side information from the ticks. Previously, it contained additional data that could be used to calculate various statistics, but traders had to pay for it. In the fourth implementation of Uniswap, such data will not be stored:
https://github.com/Uniswap/v4-core/blob/2f9b30663b53c0165cd6d34651d8ff13287667c4/contracts/libraries/Pool.sol#L80-L89

5️⃣ It is not entirely clear why the #Uni team prefers to initialize this structure in memory with every iteration of the loop, instead of making one and reusing it. Maybe they prefer to sacrifice gas efficiency for a more ‘readable’ code?
https://github.com/Uniswap/v4-core/blob/2f9b30663b53c0165cd6d34651d8ff13287667c4/contracts/libraries/Pool.sol#LL417C37-L417C41

Check it out 🙏

Long time no see. More tips🔥🔥🔥

https://0xvolodya.hashnode.dev/nft-attacks

@ethers_security

"Wallet Security Rating Report to make informed choices about your wallet security". Worth a read🙏

Key insights:
▪️ Incident frequency in bug bounty presence
▪️ How to detect the next Atomic Wallet
▪️ Open- & closed-source incidents comparison & more 👇

https://cer.live/post/crypto-wallet-security-rating-report-key-insights-findings

@ethers_security

New toys

ZK Bugs Tracker.
"A community-maintained collection of bugs, vulnerabilities, and exploits in apps using ZK crypto"

https://github.com/0xPARC/zk-bug-tracker


Auditing zkEVM and it's attack surfaces
https://www.youtube.com/watch?v=cxx7PJ4vhZM

Algebraic attacks on zk hash functions
https://www.zellic.io/blog/algebraic-attacks-on-zk-hash-functions


@ethers_security

A Diffusc tool from TrailOfBits for Differential fuzzing


"It's a differential fuzzer built on top of Echidna and Slither to ease the review of smart contracts upgrades"

https://blog.trailofbits.com/2023/07/07/differential-fuzz-testing-upgradeable-smart-contracts-with-diffusc/

@ethers_security

Arbiter is a tool build by Primitivefinance in order to rigorously test the performance and security of their own protocol. Arbiter is pure Rust. It uses a Rust-based EVM called revm in order to run smart contracts directly (revm is used inside of the Anvil testnet and RETH client).

They use revm without any overhead of a network, thus providing a speed benefit and allowing to directly test contracts so that you:
- Do not have to re-implement a copy protocol in another language
- Can test every aspect of the protocol with EVM parity
- See how contracts behave in a realistic on-chain-like scenarios with agents and other contracts

@ethers_security

The tool: https://github.com/primitivefinance/arbiter

Arbiter - EVM logic simulator for security and performance testing @EthSecurity1

What is Caracal?
Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts.

What about its Features?
👉Detectors to detect vulnerable Cairo code
👉Printers to report information
👉Taint analysis
👉Data flow analysis framework
👉Easy to run in Scarb projects

Any overview of its detectors?

1) controlled-library-call
Library calls with a user controlled class hash

2) unchecked-l1-handler-from
Detect L1 handlers without from address check

3) reentrancy
Detect when a storage variable is read before an external call and written after

4) unused-events
Events defined but not emitted

5) unused-return
Unused return values

6) unenforced-view
Function has view decorator but modifies state

7) unused-arguments
Unused arguments

8) reentrancy-benign
Detect when a storage variable is written after an external call but not read before

9) reentrancy-events
Detect when an event is emitted after an external call leading to out-of-order events

10) dead-code
Private functions never used


More info on how to install it and its limitations can be found in the repo below 👇
https://github.com/crytic/caracal

@ethers_security

Web3 DevSecOps is very important!
https://twitter.com/1nf0s3cpt/status/1684573117765898242

Some people are still unaware of this masterpiece. Hopefully, you ain't one of them. If you are, it's not too late to start using it 🙏

https://medium.com/cyfrin/the-best-security-education-tool-in-web3-dd23717fbe58

@ethers_security

2nd part is out 👀

Link: officercia.mirror.xyz/AoRdvL3Lp5K5JHjlgpWaOHo_CehH-amZSAm9pxuFdwQ

More at @officercia 🫡️️

#security #audit