gm, I built a tool to help people detect metamorphic smart contracts.
What’s a metamorphic smart contract? Why is detecting them important? And how does the tool work? A thread 🧵
Reminder to mint your Proof of Merge NFT before the Merge! An NFT
@0xMasonH
and I created!
* Free
* 100% On-Chain
* Non-Transferable
* Dynamic
Learn more here :)
Proof of Merge Phase 3 is complete! The Merge is complete! 42.5 K Proof of Merge NFTs were minted. Thank you so much to everyone who minted to be a part of this historic event ☯️
My colleague
@0xMasonH
and I decided to create an experimental NFT that changes as The Merge happens. The NFT has 3 phases:
1. Two separate circles
2. Half merged circles
3. Post-merge Yin-Yang
Metamorphic contracts are mutable, meaning developers can change the code inside them. This poses a serious risk to web3 users who put their trust in code which they expect to run with absolute consistency.
HT to
@z0age
for his amazing write-up here
A critical Ethereum security assumption is that smart contract code is immutable and therefore cannot be changed once it is deployed on-chain. In practice, some smart contracts can change – even after they’ve been deployed!
The NFT artwork will switch to phase two on September 14th. We detect The Merge on-chain by checking if the DIFFICULTY opcode returns 0 according to EIP3675.
You can imagine an attacker using the technique to “rug” people who are staking tokens in a smart contract they don’t realize is metamorphic. Luckily, by understanding what makes metamorphic contracts possible, you can detect them.
You need 3 smart contracts in total to pull off the metamorphism trick: A “Factory” (1) that deploys an Implementation Contract (2) which hosts code destined for the Metamorphic Contract (3).
Here’s how the parts interact.
Today we are announcing a16z crypto Fund 4. We’ve raised $4.5B to invest in promising web3 founders and startups, bringing our total crypto funds raised to more than $7.6B. 💪
My tool looks for 6 indicators of metamorphism in a contract:
1. Was it deployed with metamorphic bytecode?
2. Can it self-destruct?
3. Does it contain DELEGATECALLs?
4. Was it deployed by another contract?
5. Does the deployer contract contain CREATE2?
6. Did the code change?
Today, we're announcing the creation of
@a16z
crypto research 💥
Research labs like DeepMind and OpenAI have elevated the field of AI to new heights.
We are setting out to do the same for crypto and web3 👇
Today we’re thrilled to announce the launch of our new accelerator, Crypto Startup School.
The program will include:
Investment from
@a16zcrypto
($500k)
Mentorship from leading founders
Advice from domain experts
Network of fellow builders
Apply:
Today, we are very excited to share that
@a16zcrypto
is leading
@alongsidefi
’s $11M seed round! 🔥
Alongside is building products that make crypto investing simpler and more accessible for anyone.
One way to create a metamorphic contract involves using the CREATE2 opcode to deploy this specific metamorphic bytecode created by
@z0age
, depicted below. (Yes, my tool scans for this specific code.)
🏆 Announcing Forta’s Bot of the Year Awards!
#fortaversary
The Most Innovative Bot Award goes to
@blauyourmind
from
@a16z
for his creative NFT sleep minting bot!
🤖
Think of ZKPs like a great magic trick.
Check out the demo below, and read on for an overview of the defining properties (scalability and privacy) of ZKPs – and how all of this plays out using magic.
@blauyourmind
:
My Metamorphic Contract Detector builds on the work of
@z0age
&
@jasoncarver
. Consider it just a first step in an analysis of whether a smart contract contains metamorphic properties.
CREATE2 ensures the Metamorphic Contract always deploys to the same predetermined blockchain address. The metamorphic bytecode can replace itself with any arbitrary code by copying code from another contract address, in this case, the Implementation Contract.
The detector isn’t foolproof. It won’t catch everything, and many of the flags can result in false positives.
Still, the tool provides valuable information. It can raise suspicions and provide a reason to scrutinize a contract further.
My blog post walks through the process in detail. The upshot is a developer can self-destruct the Metamorphic Contract, repeat the steps involved with new implementation code, and thereby replace the code inside the Metamorphic Contract with anything they desire.
🚀LET'S GET ROLLING! 🚀
📣We're excited to announce our public beta! 🎉
Starting today, Dynamic is open to everyone (hint hint - those with and without wallets 😉)
📹 We have a lot to cover - let's start with a quick video sneak peek (sound on! 🔊)
1/ Today we’re thrilled to be launching a slate of open sourced “Can’t be Evil” NFT licenses. These licenses are designed specifically for NFTs and were inspired by 20-plus years of work by the Creative Commons.
1/ We started Arpeggi Labs to create a better way to make music.
Today, we are proud to announce a $5.1M seed round for open-source music creation led by
@a16z
.
Here’s what you need to know ⬇️🧵
1/ We’ve got some exciting news to share!
Applications for Crypto Startup School (CSS) Spring 2024 in London are now OPEN!
Ready to fast-track your crypto startup journey?
Apply here:
Learn more👇
Event logs are one of the most important sources of historical data on Ethereum. Learning how they are structured, and how to access them, is critical for anyone who wants to analyze smart contract interactions. Here’s what I’ve learned. 🧵👇
At
@a16zcrypto
research, we're looking for interns for summer '23! Our lab is an amazing environment both for fundamental research and for close collaborations with the best web3 startups. Learn more and apply here (ideally by Nov 15):
Proof-of-stake (PoS) is a captivating area of research. It’s been great to get a chance to show you a snapshot of it with a16z crypto research team:
Talk
#1
Talk
#2
How are magic and crypto connected?
A classic of magic is giving someone an envelope as a prediction, asking them to name a playing card, then opening the envelope to show you accurately predicted the named card. Basically…I have been using hash commitments for years.
You no longer need to integrate with every wallet in the ecosystem manually. Dynamic takes care of that for you and allows MetaMask, Phantom, Coinbase Wallet, etc., to connect to your dApp out of the box with a clean wallet selection UI/UX.
It takes a special intellect to stand out among crypto technologists, and we’re fortunate to have one of those people on our team. I’m happy to share that
@eddylazzarin
has been promoted to Chief Technology Officer for
@a16zcrypto
.
If you’re an artist experimenting with web3 & tokenization today…
You’re shaping the future for the next generation of creatives & empowering them to succeed 💎
Just a few things we're excited for in crypto ↓
- Blockchain's mobile moment
- ZK, MPC, Post-quantum crypto
- Developer onboarding for ZK
- On-chain games
- Non-transferable tokens
- Decentralized energy
More directly from our partners here:
In the end, you can't go across the street to buy a pizza with your arcade tokens...yet. So you just put them in your wallet until your next arcade visit.
Event logs are one of the most important sources of historical data on Ethereum. Learning how they are structured, and how to access them, is critical for anyone who wants to analyze smart contract interactions. Here’s what I’ve learned. 🧵👇
The agent checks to see if the address that sent a transaction to transfer an NFT differs from the “from” address emitted in a Transfer Event log. If they are different, there is a possibility that the NFT in question was sleep minted.
This scavenger hunt will have 3 riddles that need to be solved. I have hid 3 NFC tags around NYC at very special locations, each having to do with Ethereum in some way.
Start solving riddles now here:
Good Luck :)
Hi frens, I have some exciting news to share on this fine Monday! We’re leading the Series A round in
@Mysten_Labs
, which is building foundational infrastructure to fully unlock the potential of web3 👷♀️🛠👷♂️
With the Dynamic SDK, developers can copy and paste a few lines of code into their React apps (more libraries soon) and instantly get a pre-built “connect wallet” and user onboarding experience.
A Transfer Event log is a message sent to the outside world by a smart contract containing details about an NFT transfer and provides an efficient way to check an NFT's provenance.
An arcade is a small ecosystem detached from the outside world governed by tokens/tickets and full of autonomous games. To participate in the arcade, you must exchange your USD for the arcade's native token (for example, on Coinbase).