My journey from the Central Bank to the world of web3 security or from a 9-5 job to a 24/7 adventure, from fully centralized to completely decentralized - you name it!
I spent more than 9 years working at the Central Bank, the last two years as the head of risk management
📢📢📢 Exciting news! I’ve embarked on a mission to create a comprehensive collection of web3 security vulnerabilities in smart contracts, blockchains, and zero knowledge.
We’ve already documented around 300 vulnerabilities! Now, with the sponsorship of
@hexensio
, we’re making
Today we are finding all contracts in a given chain that have `_burn` function "mistakenly" set as public without any modifiers or requirements, allowing unrestricted access:
Hey folks! 🙌 In case you haven’t heard, my team and I embarked on a mission to create Web3 Vulnerapedia, aiming to build the most extensive library housing known vulnerabilities. From the outset, I envisioned this as a community-driven effort, understanding that only together
🚀 Ever wondered what bug hunting feels like? Picture this: you found a cool vulnerability and now you're eager to know if any other contracts out there share the same weakness. You start your hunt, digging through the code to find similarities... 😵💫
Over the past 18 months, my
Security tip 🧑🌾
When you see a project using Solady's libraries, pay close attention to the comments, they often highlight potential issues and bugs.
For example, if the contract imports SignatureCheckerLib.sol or ECDSA.sol, you might find a comment stating: "This
There are a lot of articles about EVM storage, but this one is brilliant.
Just read an insightful article by
@DeGatchi
. Really appreciate the in-depth analysis and helpful explanations.
As you may know, besides security, I am involved in martial arts. I'm so excited to share that I participated in the Abu Dhabi’s AJPTour Brazilian Jiu-Jitsu international tournament this past Sunday and achieved gold in No-GI (without a kimono) and a silver medal for GI (with a
Exploring sqrtPriceX96 from Uniswap V3
While writing a POC for a finding, I needed to calculate the price of ETH in USDC from the Uniswap V3 Pool's slot0 struct's sqrtPriceX96. Yes, it is not recommended to derive the price from slot0's sqrtPriceX96, as it can be easily
Hey everyone! Yesterday we announced the Security Wiki, your one-stop-shop for web3 security knowledge!
It is supposed to be a public good and it isn't just our wiki; it's a community effort. With around 300 articles, we're calling on you and asking you to contribute. Share
Reflecting on One Year of My Career Journey
It has been a year since I left my governmental position and joined
@hexensio
as a full-time security researcher. It was a challenging transition, having spent the previous 10 years in a government role, and now finding myself
For those starting web3 security and wondering what to read next:
Nothing. Just head over to today's contests. Today, you have a chance to choose from 19 live contests. It's time to start real audits instead of getting lost in endless reading and forgetting it the next day.
Smart contract auditing journey: from white belt to master!
In smart contract auditing, there are moments that feel like those early days in Brazilian jiu-jitsu.
Just like on the mats, you start with enthusiasm. Everything seems possible. But then, you hit that point where
Surprise promotion on the mats! 🥋 Thrilled to announce that I've been promoted to blue belt in Brazilian Jiu-Jitsu, just before the upcoming competition next month (yeah, now I'll be competing with blue belts 🥲)!
This is one more proof that if you love something and keep
Who needs Alice and Bob when you have Raju and Ramu? 🇮🇳
Just stumbled upon them in the tests while auditing a project. Looks like they're the Indian counterparts of our favorite testers! 😄
We finally wrapped up a huge scope at
@hexensio
. It was a great experience. Big scopes always require a lot more focus, imo. Now diving into another 12-week scope plus several smaller ones every week.
I feel like I'll need a vacation after this 🤯
🙌 Just wanted to share a recent funny experience. I came across a project that
@FindAudit
posted about and decided to take a closer look. Noticed some issues in one of their contracts and reached out to
@bytes032
for contacts. After my work, went home, prepared a small report,
Security tip about ERC20Permit💀
ERC-2612 Permit plays a pivotal role in allowing users to modify the allowance mapping using a signed message rather than relying solely on the msg.sender (more detailed: ).
However, the way some implementations handle
Woah, top 3 on
@Karak_Network
!
Teamed up with my friends (co-workers)
@0xSkylice
and
@M3talDrag0n
to help each other review this for more than a day, in between our scopes at
@hexensio
. Gotta say I'm impressed by the professionalism of
@code4rena
. I’d seen the posts and polls
I am thrilled to share a monumental moment:
@DevDacian
, a beacon in the security field, has made the first contribution to !
His insightful articles have been a guiding light in my learning journey, and it's an honor to host his work on the Security Wiki.
Accepted the challenge from
@chrisdior777
and
@RealJohnnyTime
! 💪 Thanks for the challenge, managed to do 26 pull-ups 🥷 Nothing like a friendly pull-up competition to strengthen those auditor muscles!🏋️
Who’s next ?
Exciting update! Last week, I shared the spotlight with our top contributors of the year to our , the ultimate resource compiling Web3 vulnerabilities.
Many of you have been keen to contribute, which is amazing as Vulnerapedia is a community-driven
Just some late night thoughts and from my own past experience I decided to share here.
If you want to excel at everything, the 24 hours in a day won't cut it, and you might not excel in anything. You should always remember that there's a limit to what you can accomplish in a day
In many cases, the difference in skill level among auditors isn't the depth of knowledge, but rather the experience of navigating large codebases efficiently. Give the same scope, say 10 issues, to both a seasoned auditor and a less experienced one. The seasoned auditor may find
Last evening in Dubai 🌃
So hungry to dive back into work. As promised no code reviews during vacation, but the closer it gets to the end, the more eager I am to work. Full of energy, I didn't even hit the gym and slept 10 hours a day. What a vacation 🧘♂️
Will enjoy the last 2
As promised to
@windhustler
a month ago, when
@zigtur
did muscle-ups, I was on vacation and found a bar where I couldn’t do them because it wasn’t straight.
But I’m ready for ROUND 2 OF THE PULL-UPS CHALLENGE.
Last time I maxed out on pull-ups was during last year's challenge,
Long story short:
Security expert: "You have a vulnerability in your code."
@ubiqsmart
: "We're using the same code as Ethereum. Report it to Vitalik, scammer."
Security expert: "No, it's not the exact same code."
@ubiqsmart
: "Then exploit it. Goodbye."
Also,
@ubiqsmart
:
Decided to have a look at
@CodeHawks
and managed to report a couple of issues with a couple of my co-workers. Not sure if we can dive deep into this contest since we're juggling three scopes in parallel now, but I couldn't help but give kudos to
@CodeHawks
for their fantastic UI
Security tip about Chainlink oracles 🩺
When it comes to securing your assets, ensuring accurate price feeds is paramount. However, a potential vulnerability window exists in the code implementations of using ChainlinkOracle.sol.
A pretty common issue is when using Chainlink to
When someone's performance seems unreachable, it doesn't mean it is. All you need to reach that level is consistency. You'll level up without even realizing how much you've grown with just consistent work.
For example, when I started jiu-jitsu, blue belts seemed so powerful and
Smart contract auditing pro tip:
When hunting for bugs, intense concentration is key. It's more productive to spend a focused hour reviewing code than a distracted three hour. So, it’s better to start a bit later, to grab that extra cup of coffee, but remember to review the code
A year ago, I was at the Central Bank, leading the risk management division. I was offered the position of department head overseeing three divisions, including mine, a fantastic opportunity, possibly making me the second manager of a department under 30 to hold such a role.
My journey from the Central Bank to the world of web3 security or from a 9-5 job to a 24/7 adventure, from fully centralized to completely decentralized - you name it!
I spent more than 9 years working at the Central Bank, the last two years as the head of risk management
GM everyone! 🌞 We're here at
@TheTrustX
and ready to dive into the world of web3 security. Come join us at our boutique, let's chat about all things security, share insights, and make this event unforgettable!
@xyz_remedy
@hexensio
Over three months ago, I reported a bug on
@BugRap_Team
regarding missing slippage protection and deadline in the protocol's swap.
Check out the detailed history of the bug discussions in the attached images. To uphold complete ethical transparency, I even gave them a heads-up
If something doesn't go as planned, like not taking first place in a competition or finding a bug that later seems invalid, and you feel sad, then go to sleep to end the day, and the next day forget about it, that's actually a failure.
But if you face the issue, start to think
I always feel that auditing is like a sport. Just like how if you want to do 20 pull-ups, you need to train for it and keep doing them regularly, or else the number will decrease, the same goes for work.
If you're able to audit, X SLOC in a day, it doesn't mean you'll always be
Planning a much-needed vacation after completing three parallel audits only just this year. The past year has been a grind, but the drive for more still burns so bad.
Standing on the edge of FOMO, I'm challenging myself to step away from the code during this break. But leaving
Another exciting update 🚀
In the latest updates on ,
@ustas_eth
has contributed valuable articles covering various topics, including zero knowledge, adding insightful content to our knowledge base 🔥
Topics covered:
1. Lack of Access Control
2.
Second Preimage Attack on Merkle Tree 💡
Merkle Tree Vulnerability is a critical aspect in maintaining the security of blockchain and cryptographic systems. These vulnerabilities arise from flaws in construction, hashing algorithms, or insufficient defenses against malicious
🏆 My debut in the
@paradigm_ctf
was nothing short of remarkable! Teaming up with the incredible folks from
@hexensio
and
@DecurityHQ
, our team Hexurity clinched the 6th place. I was in awe of our brilliant team, effortlessly tackling each challenge. The dedication and
Thrilled to take on a backstage role at
@code4rena
! Looking forward to contributing more value to the secure Web3 and aiming to dive into more contests in 2024 🫡
@dev_chinmayf
It should run out of gas because of an infinite loop that is created in the assembly code. The issue is that the assembly block is setting str to point to a memory location where the string "hello" is stored. However, the length of the string is not specified, and it is assumed
It took me 10 months to understand that in Brazilian jiu-jitsu fights, you must not go for the submission every time; instead, you need to gain points to win the fight. The submission can be pursued within this process.
So, why am I saying this?
You never know what new thing
Don't set deadlines for your achievements, life can sometimes throw such unexpected curveballs. When you are fixed on finishing something by a certain date, it can disrupt your current work. And if you're not close to meeting that deadline, it can sour your mood.
If you're
Sharing an extension I use: Explorer Bookmark is a fantastic VS Code extension for all the
@code4rena
Wardens,
@sherlockdefi
Watsons, and
@CodeHawks
Hawks out there. No more struggling to find contracts in scope among a sea of others. With this extension, you can easily collect
Audit the code not with the mindset of ensuring everything is written correctly, but rather with the mindset that there are numerous bugs in every function. Challenge every line of code and every parameter, aiming to uncover that bugs.
Most of you might have heard about
@xyz_remedy
, but did you know that listing your project here is FREE! We're not just another bug bounty platform. Remedy is your ticket to a safer Web3 space.
We're relentless in our mission to fortify Web3 security. With Remedy, we're creating
Security tip: Solmate's SafeTransferLib ⚡️
When utilizing Solmate's SafeTransferLib, it's important to acknowledge that the library lacks inherent verification of a contract's existence at the token address.
This oversight can lead to significant risks, especially in scenarios
Excited to be a speaker at
@TheTrustX
! I'll be sharing more about the Web3 Security Wikipedia project. Stay tuned for details on how we're building a valuable resource for the community. 🚀🫡
Lately, I've found myself more focused on auditing code on my laptop's desktop rather than connecting it to a big monitor. Not sure why, even with a 13-inch screen.  🤷
Debating whether to switch to a 16-inch or just get used to the monitor. What works best for you?
Exciting Update!
During our New Year Contest on ,
@0xMorph
has truly excelled with numerous valuable contributions, including 5 outstanding articles that I can't wait to share with you! 🚀
The stellar articles cover diverse topics:
1. Cross-Domain
If this picture no longer appears as difficult and unattractive as it did the first time you looked at it, it signifies that you are on the right path 🚀
The recent analysis of the Heco Bridge Hack is covered in by
@Olympix_ai
🔥
Thank you for this valuable contribution 🙌
You can read it by following the link provided in the reply 🫡
What I've learned from martial arts recently applies to life in every sphere: today, while rolling with a much more powerful and experienced opponent, I managed to submit him twice in a round. Now reflecting on why I was able to do so, I realize that I no longer panicked when in
I decided to share a recent experience. I found two high-severity issues on the
@BugRap_Team
bug bounty platform. However, the protocol quickly downgraded them to low and medium severity. They even argued on the low one that the checks are implemented in their DApp front-end and
🚀 Exciting news! We're introducing a security contact list on our Security Wiki. We've noticed instances where individuals discover bugs or breaches but struggle to reach out to the respective protocol. To streamline this process, we're compiling all protocol contacts in one
🎉 Happy to announce the conclusion of our New Year mini-contest! 🚀
One more step forward to the absolute Web3 security hub:
Massive kudos to our winners
@0xMorph
,
@ustas_eth
,
@officer_cia
,
@0xpolarzero
, Hacktivist and blockchainwolf for their
Another analogy of smart contract auditing and martial arts, or auditing philosophy volume 2, you name it.
Learning smart contract auditing is like learning martial arts; it's all about practice. If we put two people together and ask them to practice BJJ, it can take over 10
I recently participated in a judging contest on
@sherlockdefi
and I wanted to share my experience. 🕵️♂️
It's safe to say that for newcomers, this contest offers an excellent opportunity to review a substantial number of reports, learn the ropes, and even earn rewards. My primary
Today, our CTO
@k3mmio
surprised us with a challenging yet exciting gift: a Lego Ferrari 488 GTE 🏎️ boasting around 1700 intricate details 🤯 Building it was quite the journey😵💫
Any fellow Lego enthusiasts here?
Who needs a portkey when you've got a magic book that whisks you away to the wonders of Web3? Say goodbye to the ordinary and hello to decentralized adventures! Get ready to surf the blockchain wave and unlock a world of limitless possibilities. Abracadabra, Web3 here we come! 🚀
In auditing, like in martial arts, competing drives progress. You can be strong in the gym, but those who compete often will outpace you. If you are just reading and following roadmaps without real audits, you are ngmi.
Great news, everyone! 🚀 Our pull request with the critical issues from the
@0xPolygonLabs
zkEVM audit has been merged into the absolute alpha source 0xPARC/zk bug tracker. We're thrilled to share our knowledge, as it's a significant step toward a more secure ecosystem. You can
Yesterday, we were discussing the
@Ledger
hack. Today, it’s live on our Security Wiki.
Yesterday we talked about having a real hacks section on Wiki. Today it covers the newest information.
Huge kudos to
@0xmorph
for swiftly filling it with valuable info, your contribution is
Once you start loving your job and prioritize making Web3 safer over simply earning money, that's when you truly grow as a security researcher. Success follows passion, not just profit. 🫡
Another milestone on our 🚀
A massive shoutout to
@0xpolarzero
for swiftly transforming an idea shared in our recent meeting into reality. Your addition of a new block on "Real-life exploits: video explainers" is a significant step forward in consolidating
A Tale of Views, Pures, and Unraveling Gas Mysteries! 🚀
Once upon the blockchain, Alice and Bob, our intrepid duo, set out to explore the enigmatic realm of gas efficiency. Armed with the wisdom that view and pure functions elegantly waltz through the blockchain without
Thrilled to share another milestone! 🚀 A huge shoutout to
@ustas_eth
for an outstanding contribution, elevating the quality and look of our articles. 🔥 Your work is exceptional, and it's a privilege to have you shaping our .
Thank you for your