ChainLight

smart contract audit & token regulation and compliance | 8-time winner @defcon | winner @paradigm_ctf 23 | member @_SEAL_Org | est. 2016

[ChainLight @ChainLight_io]

We did it again.

We are thrilled to announce that ChainLight has won @defcon 32, the Olympics of CTF.

This marks our 8th victory and the first time any team has won 3 consecutive years in the DEF CON history.

🧵For those new to ChainLight, here’s a little thread about us:

[Theori @theori_io]

🤝 New partnership: Theori x @okta
https://t.co/fezhAKqeJW
We’re bringing red-team firepower + automated pentesting as Okta’s trusted security service provider.
Raising the bar for identity threat resilience 🚀

[ChainLight @ChainLight_io]

Thank you for reading.

To stay up-to-date with the latest report and research from our award-winning security researchers:

👉 Subscribe Newsletter: https://t.co/C4miHX1FMI
👉 Join Discord: https://t.co/JLtmTXIXXr

(6/6)

[ChainLight @ChainLight_io]

Which rug pulls, exploits, and security breaches happened this week?

Read this 2-minute weekly summary to stay in the loop 🧵👇

(1/6)

[ChainLight @ChainLight_io]

3️⃣ @th3r0ar Loses $780K

• Using a backdoor function in the staking contract, the deployer manipulated the token balance of a specific address by directly altering the storage.
• The team attributed the responsibility to an external developer.

(5/6)

[R0AR @th3r0ar]

Earlier today, the $1R0R staking contract had tokens removed and dumped on the open market.

At this stage, we do not believe this to be an external exploit. One nefarious developer, external to R0AR core team, is seemingly behind the drain. They have been removed from the project with all accesses revoked.

Some really important points:

- We have a lot more liquidity than what was initially added. There is plenty in the treasury to replace this with.

- Whereas with most projects this would be fatal, it isn't with R0AR, in the slightest. Our 1:1 liquidity promise at presale has transpired to be the ultimate safeguard here. We haven't spent presale funds, so there is plenty there to add back as LP.

Most importantly, don't panic.

There is not a team with more integrity in this space and we will make sure that we do the right thing by the community.

It's a bump in the road, nothing more.

Thankyou to the entire pride for your continued support. Any claims of an external hack or exploit should be ignored.

[RareSkills @RareSkills_io]

When we released the ZK Book over a year ago, we took the ZK education space a huge step forward.

Our book pioneered the approach of "just enough math" to learn ZK.

Today we do it again with a new addition to the ZK Book.

"Circom and Constraint Design Patterns"

This new section focuses on how to design, create, and audit non-trivial ZK circuits.

You've probably seen a lot of tutorials about how to prove you know the evaluation of a polynomial using Circom.

But how do you go from there to designing a ZKVM or proving you know the primage of a traditional hash function (like MD5 or Keccak256)?

The new part of our ZK Book takes you on a journey from multiplying to numbers together to:

- building a ZKVM from scratch
- coding constraints for the MD5 hash function
- learn the recurring design patterns in constraint design

The last part was interesting because some of the established "design patterns" don't even have names for them. We had to invent some terminology!

As usual, we are extremely thoughtful about how we introduce the reader to new ideas to avoid overwhelming someone new. We are careful to ensure we teach the prerequisites in a sensible order and with a lot of examples.

Each chapter shows how to build a circuit for an increasingly complex application. With each chapter, you both review what you learned previously and learn a new design pattern.

Once you build up a collection of these design patterns, you can compose them together to build more complex applications, like the ZKVM or a non-trivial hash function.

We put a huge effort into making sure that the material is both easy to understand and correct without any important omissions.

We'd like to thank @ChainLight_io, @VeridiseInc, @PrivacyScaling, and @zksecurityXYZ for allocating time to review this work and provide suggestions.

We are particularly grateful to @marcobesier from @zksecurityXYZ for working through several revisions to really get the chapters into a polished state.

Special shoutout to @cal_nix for coauthoring the first seven chapters in this new part of the book!

The topics we cover here are extremely fundamental. If you don't understand the materials here, learning the internals of more modern ZKVM or ZK L2 client will be quite challenging. Up until now, the absence of newcomer-oriented explanations for such foundational concepts has held the ZK space back.

This new body of work isn't simply a "better explanation" of existing materials, but the first explanation at all -- outside of academic papers.

We use Circom as the language of instruction since we consider it the most beginner-friendly. However, what you learn here generalizes to other frameworks like Plonky3, Halo2, o1js, and Gnark. The new articles now make the ZK Book over 38,000 words longer.

You do not have to know how a ZK-SNARK works to read this section of the book, but there are a few prerequisites. These are listed in the "Introduction to Circom" chapter.

As usual, the material is completely free with no login required.

[ChainLight @ChainLight_io]

Thank you for reading.

To stay up-to-date with the latest report and research from our award-winning security researchers:

👉 Subscribe Newsletter: https://t.co/C4miHX1FMI
👉 Join Discord: https://t.co/JLtmTXIXXr

(12/12)

[ChainLight @ChainLight_io]

Which rug pulls, exploits, and security breaches happened this week?

Read this 2-minute weekly summary to stay in the loop 🧵👇

(1/12)

[ChainLight @ChainLight_io]

9️⃣ A security engineer exposed as a DPRK scammer

• Further investigations of @tanuki42_ revealed his activities: @aqualoan_io, which he contributed to, rugged and deleted its GitHub.
• Nick Franklin initially denied the allegations but has now deleted his X and TG.

(11/12)

[tanuki42 @tanuki42_]

@0xNickLFranklin UPDATE: The liquidity protocol @aqualoan_io which @0xNickLFranklin was a contributor to has pulled all of it's liquidity overnight (~$800k) and deleted it's Github.

https://t.co/Hd7puf49LS
hxxps[://]aqualoan[.]io/ (site still online)

H/t @blackbigswan