One exciting feature of Ethereum is the ability to prove consent directly between parties. In other words, you can easily validate that someone agreed to something without the need for a third party. …

Table of Content: 1. Summary 2. Introduction to Moola Market 3. Vulnerability Analysis 4. The Attack flow 5. After the Exploit 6. Status of Funds 7. Preventions Measures 8. Reference Summary: On the 18th of October, 2022, Moola Market (Liquidity Protocol on the Celo Blockchain) was exploited for approximately $9 million…

I recommend cloning the repo of this course so you can follow along. https://github.com/JEflyer/Offensive-Smart-Contract-Hacking-Course Challenge 1 — Staking Scenario — There is a staking contract which allows you to stake & withdraw your staked ETH. There is currently 100 ETH staked in this contract. Goal — Steal all the ETH! …

Here is the list of the most known Ethereum hacking tools used for auditing smart contracts: Slither: https://github.com/crytic/slither Mythril: https://mythril-classic.readthedocs.io/en/master/installation.html Mythix: https://mythx.io/ Remix solidity static analysis plugin: https://remix.ethereum.org Are they reliable? Can you REALLY hack a smart contract by pressing a button? We’ll see that. Note: If you’re on Windows…

In the traditional IT security world, vulnerability scanning has become a relatively mature space, with vendors such as Tenable, Rapid7, and Qualys providing tools to scan IT devices and report back vulnerabilities. Web application scanners that can identify vulnerabilities in code are also relatively common. …

Detailed explanation of Ethereum smart contract vulnerabilities — — On-chain Vulnerability Recurrence -Self-Destructing Vulnerability Detailed explanation of Ethereum smart contract vulnerabilities — On-chain Vulnerability Recurrence -Self-Destructing Vulnerability Welcome to follow and discuss with us Author: support@lunaray.co 0x01 Introduction Malicious contracts can be used to selfdestruct to force sending Ether to any contract.

This the second of a series of walkthroughs on the DVDF smart contract war games. If you missed it, here is the start of the series with some basic setup instructions. Challenge #2 — Naive Receiver “There’s a lending pool offering quite expensive flash loans of Ether, which has 1000 ETH in balance. You also…

This is the beginning of a series of walkthroughs on the Damn Vulnerable DeFi smart contract war game. This has been a lot of fun so far, and I’m looking forward to documenting my analysis, exploit development, and reviewing the vulnerabilities for newcomers to smart contract security. …

Today, I’m releasing a proof of concept exploit contract for the Moonbirds NFT collection. The exploit code is here https://github.com/dhanjani/MoonbirdsSploit/blob/main/MoonbirdsSploit.sol. Don’t worry. The bad guys and girls don’t need my proof of concept code. They have either already figured it out, or can figure it out on their own. …

Background In our previous post, “Insert previous article,” we learnt about the common vulnerability known as the DelegateCall function. To further our understanding of the delegate call function, we will be expanding on what we learned in the previous article. Introduction to DelegateCall Check out our precious article. Vulnerability example …

Led by DeFi application Fei Protocol’s co-founder Joey Santoro, recently an EIP to create a new token standard for tokenized vaults was proposed. And it is EIP-4626[1]. Although it was just proposed in December 2021, it soon garnered significant attention and great support from the Ethereum community and has been…

According to SlowMist, on June 27, 2022, hackers exploited a critical flaw in the XCarnival project and made off with 3,087 ETH (about $3.8 million). XCarnival is a decentralized NFT lending platform that was built on the Ethereum network. The team working on the project has been made aware of…

On April 30, 2022, according to Beosin EagleEye, FeiProtocol’s Rari Fuse Pool was exploited for about 28,380 $ETH. Beosin security team analyzed the incident and the findings are shown below. FeiProtocol Introduction Rari Capital empowers individuals to break free by creating new opportunities, communities and financial products. The official website: https://rari.capital/ Relevant Information As…

On May 16, 2022, Beosin EagleEye monitored that FEGtoken’s FEGexPRO contract on both Ethereum and BNB Chain was exploited for about 3,280 BNB and 144 ETH by a flashloan attack. Beosin security team analyzed the incident and the findings are shown below. FEGtoken Introduction The FEGtoken project consists of the…

Phishing attacks aimed at Opensea users On February 21, 2022, Opensea suffered a phishing attack, and some users have had their NFTs stolen due to the approval they signed to the hackers. The relevant information of the attacker is as follows: Attacker’s address (Fake_Phishing5169): 0x3e0defb880cd8e163bad68abe66437f99a7a8a74 Attacker’s Contract (Fake_Phishing5176): 0xa2c0946ad444dccf990394c5cbe019a858a945bd

On June 24, Harmony Bridge was hacked for about $100M due to suspected private key compromise. Here’s our analysis of this incident. Background Harmony Bridge is a cross-chain bridge with five validators for operational verification. The main reason for this attack is that the private keys of two validators are suspected…

The lifecycle of an NFT is usually divided into phases such as issuance, circulation and burning, among which many of the security issues can be seen in the issuance phase. The purchase of NFT is usually divided into two cases: pre-sale and official sale. In the pre-sale stage, NFT projects…

Events Under the Spotlight 🔎 Trader Joe was exploited for ~$1M Trader Joe, leading DEX on Avalanche blockchain was exploited for $1M. The vulnerability lies in the protocol transaction fees process.

Challenge 16 on Ethernaut requires us to take over ownership of a contract by understanding how delegatecall, libraries, storage slots work. contract AttackLibrary { address public timeZone1Library; address public timeZone2Library; address public owner; function setTime(uint256 /*_time*/) public { owner = tx.origin; } } /* Library will have same variable layout as…

Events Under the Spotlight 🔎 BNB Chain Protocol Hacked Due to a Bug in safeTransferFrom CoFiX Protocol on BNB Chain was exploited due to a bug in safeTransferFrom function which resulted in the attacker draining $140,000 from the DeFi platform. The development team later added a safety check in the smart contract. Terra Luna’s Price…