๐ Want to learn Solidity step by step?
You can literally build along with me, Michealking.
Check out my 30 Days Solidity Challenge repo:
๐ https://t.co/nrqaIniqae
Already learning on @CyfrinUpdraft?
This repo is the perfect place to practice next and sharpen your skills.
Argus thought like an attackerโฆ and it changed how I see my own code.
While learning from @PatrickAlphaC@CyfrinUpdraft course, I built a raffle contract. Solid, tested, and working as expected โ or so I thought.
Then I ran Argus on it.
@PatrickAlphaC@CyfrinUpdraft Thatโs the kind of issue you donโt catch by just โtesting functionality.โ
You catch it by thinking like an attacker.
โ
This is exactly what Iโm building Argus to do:
Not just analyze codeโฆ but reason about how it can fail in the real world.
@PatrickAlphaC@CyfrinUpdraft This attack only requires the malicious contract to win. With a small number of players, the odds are far from negligible. And hereโs the twist:
๐ This doesnโt even require a malicious actor.
๐ Any contract without a payable fallback can unintentionally brick the system.
@PatrickAlphaC@CyfrinUpdraft 4. The ETH transfer fails โ the entire transaction reverts.
5. The raffle gets stuck in the CALCULATING stateโฆ permanently.
No winners.
No refunds.
All funds locked.
Even worse โ this isnโt purely theoretical.
@PatrickAlphaC@CyfrinUpdraft Attack Scenario
1. An attacker deploys a malicious contract with no "receive()" function (or one that reverts).
2. That contract enters the raffle like any normal user.
3. When a winner is picked via Chainlink VRF, the malicious contract gets selected.
@PatrickAlphaC@CyfrinUpdraft Instead of just scanning for obvious bugs, Argus approached the contract like an adversary. It didnโt stop at โdoes this work?โ โ it asked, โhow can this break?โ
And what it found was subtleโฆ but dangerous.
@only01Essential@HackenProof Congratulations @only01Essential more Wins ๐
I'd love to learn a lot from you, I know you're a very busy person , if possible please share your roadmap with me and how I can grow and identify bugs like you currently do.
Thank you so much.
+1 today.
365 days ago, I chose a hard path โ programming.
Tired? I showed up.
Sick? I showed up.
Broke? I criedโฆ then showed up.
This year broke me and built me at the same time.
Iโm still going.
Iโm still building.
I am a King. I am limitless.
Happy Birthday to me.
Argus caught a Critical vulnerability pattern in Compound Finance's codebase
I'll start by apologizing for announcing Argus v1.0.0
last week before it was ready. That was premature.
Today I'm announcing Argus v0.6.0-beta โ live at
https://t.co/E6gff4U3wH
I'm looking for auditors to stress-test it. Run Argus
alongside your security research, bug bounties, and
audits โ then tell me what it misses.
Static analysis: free and unlimited
Deep Analysis: AI exploit construction
Still in beta. Still improving. But it's real.