Aw Kai Shin·Oct 31, 2022Signing and Verifying Ethereum Hashed MessagesOne exciting feature of Ethereum is the ability to prove consent directly between parties. In other words, you can easily validate that someone agreed to something without the need for a third party. …Ethereum6 min readEthereum6 min read
QuillAudits - Web3 Security 🛡️·Oct 21, 2022Moola Market $9 Million Price Manipulation Attack | QuillAuditsTable of Content: 1. Summary 2. Introduction to Moola Market 3. Vulnerability Analysis 4. The Attack flow 5. After the Exploit 6. Status of Funds 7. Preventions Measures 8. Reference Summary: On the 18th of October, 2022, Moola Market (Liquidity Protocol on the Celo Blockchain) was exploited for approximately $9 million…Web34 min readWeb34 min read
ScruffyStudiosinCoinmonks·Sep 19, 2022Offensive Smart Contract Hacking Part1I recommend cloning the repo of this course so you can follow along. https://github.com/JEflyer/Offensive-Smart-Contract-Hacking-Course Challenge 1 — Staking Scenario — There is a staking contract which allows you to stake & withdraw your staked ETH. There is currently 100 ETH staked in this contract. Goal — Steal all the ETH! …Solidity Contract Audit3 min readSolidity Contract Audit3 min read
TrustChain·Aug 8, 2022Best Smart contract hacking tool (Round 1)Here is the list of the most known Ethereum hacking tools used for auditing smart contracts: Slither: https://github.com/crytic/slither Mythril: https://mythril-classic.readthedocs.io/en/master/installation.html Mythix: https://mythx.io/ Remix solidity static analysis plugin: https://remix.ethereum.org Are they reliable? Can you REALLY hack a smart contract by pressing a button? We’ll see that. Note: If you’re on Windows…Ethereum4 min readEthereum4 min read
Mitchell TelatnikinCoinsBench·Aug 21, 2022Member-onlyThree Open-Source Blockchain Smart Contract Vulnerability ScannersIn the traditional IT security world, vulnerability scanning has become a relatively mature space, with vendors such as Tenable, Rapid7, and Qualys providing tools to scan IT devices and report back vulnerabilities. Web application scanners that can identify vulnerabilities in code are also relatively common. …Blockchain3 min readBlockchain3 min read
lunaray·Feb 23, 2022Detailed explanation of Ethereum smart contract vulnerabilities — — On-chain Vulnerability…Detailed explanation of Ethereum smart contract vulnerabilities — — On-chain Vulnerability Recurrence -Self-Destructing Vulnerability Detailed explanation of Ethereum smart contract vulnerabilities — On-chain Vulnerability Recurrence -Self-Destructing Vulnerability Welcome to follow and discuss with us Author: support@lunaray.co 0x01 Introduction Malicious contracts can be used to selfdestruct to force sending Ether to any contract.Blockchain2 min readBlockchain2 min read
Jtriley.eth·Jan 3, 2022Damn Vulnerable DeFi — Naive ReceiverThis the second of a series of walkthroughs on the DVDF smart contract war games. If you missed it, here is the start of the series with some basic setup instructions. Challenge #2 — Naive Receiver “There’s a lending pool offering quite expensive flash loans of Ether, which has 1000 ETH in balance. You also…Smart Contract Security5 min readSmart Contract Security5 min read
Jtriley.eth·Jan 2, 2022Damn Vulnerable DeFi — UnstoppableThis is the beginning of a series of walkthroughs on the Damn Vulnerable DeFi smart contract war game. This has been a lot of fun so far, and I’m looking forward to documenting my analysis, exploit development, and reviewing the vulnerabilities for newcomers to smart contract security. …3 min read3 min read
Nitesh Dhanjani·May 31, 2022Release: PROOF of Concept Exploit for the Moonbirds NFT Smart ContractToday, I’m releasing a proof of concept exploit contract for the Moonbirds NFT collection. The exploit code is here https://github.com/dhanjani/MoonbirdsSploit/blob/main/MoonbirdsSploit.sol. Don’t worry. The bad guys and girls don’t need my proof of concept code. They have either already figured it out, or can figure it out on their own. …Nft6 min readNft6 min read
SlowMist·Jul 4, 2022Intro to Smart Contract Security Audits | Delegatecall (2)Background In our previous post, “Insert previous article,” we learnt about the common vulnerability known as the DelegateCall function. To further our understanding of the delegate call function, we will be expanding on what we learned in the previous article. Introduction to DelegateCall Check out our precious article. Vulnerability example …Smart Contracts4 min readSmart Contracts4 min read
Fairyproof TechinCoinmonks·Apr 21, 2022Security Considerations in EIP-4626 by FairyproofLed by DeFi application Fei Protocol’s co-founder Joey Santoro, recently an EIP to create a new token standard for tokenized vaults was proposed. And it is EIP-4626[1]. Although it was just proposed in December 2021, it soon garnered significant attention and great support from the Ethereum community and has been…Blockchain Security5 min readBlockchain Security5 min read
SlowMist·Jun 28, 2022XCarnival NFT lending protocol vulnerability analysisAccording to SlowMist, on June 27, 2022, hackers exploited a critical flaw in the XCarnival project and made off with 3,087 ETH (about $3.8 million). XCarnival is a decentralized NFT lending platform that was built on the Ethereum network. The team working on the project has been made aware of…Nft4 min readNft4 min read
BeosininCoinmonks·Apr 30, 2022Loss Exceeds $80M Due to Reentrancy Vulnerability in Contract: Beosin’s Analysis of the FeiProtocol ExploitOn April 30, 2022, according to Beosin EagleEye, FeiProtocol’s Rari Fuse Pool was exploited for about 28,380 $ETH. Beosin security team analyzed the incident and the findings are shown below. FeiProtocol Introduction Rari Capital empowers individuals to break free by creating new opportunities, communities and financial products. The official website: https://rari.capital/ Relevant Information As…Reentrancy Bug3 min readReentrancy Bug3 min read
BeosininCoinmonks·May 16, 2022Beosin’s Detailed Analysis of FEGtoken Flashloan Attack: 3,280 $BNB and 144 $ETH LostOn May 16, 2022, Beosin EagleEye monitored that FEGtoken’s FEGexPRO contract on both Ethereum and BNB Chain was exploited for about 3,280 BNB and 144 ETH by a flashloan attack. Beosin security team analyzed the incident and the findings are shown below. FEGtoken Introduction The FEGtoken project consists of the…Blockchain4 min readBlockchain4 min read
Beosin·Jun 14, 2022How to Steal User’s Signature in NFT Phishing AttacksPhishing attacks aimed at Opensea users On February 21, 2022, Opensea suffered a phishing attack, and some users have had their NFTs stolen due to the approval they signed to the hackers. The relevant information of the attacker is as follows: Attacker’s address (Fake_Phishing5169): 0x3e0defb880cd8e163bad68abe66437f99a7a8a74 Attacker’s Contract (Fake_Phishing5176): 0xa2c0946ad444dccf990394c5cbe019a858a945bd6 min read6 min read
Beosin·Jun 24, 2022Harmony Bridge Hacked for $100M due to Suspected Private Key CompromiseOn June 24, Harmony Bridge was hacked for about $100M due to suspected private key compromise. Here’s our analysis of this incident. Background Harmony Bridge is a cross-chain bridge with five validators for operational verification. The main reason for this attack is that the private keys of two validators are suspected…Blockchain3 min readBlockchain3 min read
Beosin·Jun 24, 2022A Research Into NFT Whitelist Bypass Vulnerability (1/2)The lifecycle of an NFT is usually divided into phases such as issuance, circulation and burning, among which many of the security issues can be seen in the issuance phase. The purchase of NFT is usually divided into two cases: pre-sale and official sale. In the pre-sale stage, NFT projects…Blockchain6 min readBlockchain6 min read
QuillAudits - Web3 Security 🛡️inQuillHash·Jun 11, 2022‘Be Optimistic!’: Hacker Returns $15M In ‘Optimism’ Tokens🚨Events Under the Spotlight 🔎 Trader Joe was exploited for ~$1M Trader Joe, leading DEX on Avalanche blockchain was exploited for $1M. The vulnerability lies in the protocol transaction fees process.Blockchain3 min readBlockchain3 min read
Zvinodashe MupambireiinCoinsBench·Jun 9, 2022Ethernaut Solutions: Challenge 16 PreservationChallenge 16 on Ethernaut requires us to take over ownership of a contract by understanding how delegatecall, libraries, storage slots work. contract AttackLibrary { address public timeZone1Library; address public timeZone2Library; address public owner; function setTime(uint256 /*_time*/) public { owner = tx.origin; } } /* Library will have same variable layout as…Solidity1 min readSolidity1 min read
QuillAudits - Web3 Security 🛡️inQuillHash·Jun 10, 2022DeFi Application Exploit Hidden for Seven Months ⚠️Events Under the Spotlight 🔎 BNB Chain Protocol Hacked Due to a Bug in safeTransferFrom CoFiX Protocol on BNB Chain was exploited due to a bug in safeTransferFrom function which resulted in the attacker draining $140,000 from the DeFi platform. The development team later added a safety check in the smart contract. Terra Luna’s Price…Blockchain2 min readBlockchain2 min read
