SecLat

Security Education and SmartContracts Security Audits. -

[SecLat @SecLat_Security]

Un hilito con los protocolos que hemos ayudado a proteger 😀👇

[SecLat @SecLat_Security]

Nos vemos en el Ethereum Security Day en CDMX

[ETH Cinco De Mayo 🔜 #Incubathon CDMX @ETHCincoDeMayo]

🛡️ @Mike_Bello90 | @SecLat_Security
"Tips to Create More Secure Smart Contracts"

🛡️ Ethereum Security Day CDMX. July 8.
Registration: https://t.co/fmaRKuKBuu

[SecLat @SecLat_Security]

New post in the blog Solving Ethernaut 10 challenge, here we gonna learn about reentrancy and how to detect, attack and patch vulnerable contracts https://t.co/ZeMMzDYJvw

[SecLat @SecLat_Security]

Security takeaway:

Zero slippage protection ≠ convenience.

Zero slippage protection = permissionless value extraction.

One hardcoded 0 can silently transfer value from your users to MEV bots on every transaction.

Audit your integrations.
(13/13)

[SecLat @SecLat_Security]

🚨 Developers are still shipping this Uniswap bug in production.

A single hardcoded 0 can allow MEV bots to steal value from every swap your users make.

Not a protocol bug.
Not a Uniswap bug.
An integration bug.

Here's how it works 🧵👇
(1/13)

[SecLat @SecLat_Security]

Never trust the current pool price.

Between transaction submission and execution:

Prices move
Arbitrage happens
MEV bots compete
Markets change

Your contract must defend users.
(12/13)

[SecLat @SecLat_Security]

It silently removes execution expiry guarantees and increases user exposure to:
• MEV
• sandwich attacks
• stale execution
• slippage extraction
Small code mistake.
Massive security impact. - 12/12
#Ethereum #Solidity #Security #DeFi #SmartContracts #Web3Security

[SecLat @SecLat_Security]

🧵 The dangerous block.timestamp anti-pattern in Uniswap swaps that silently enables MEV attacks and how to solve it 👇

Most devs think deadlines protect users.

In reality, many implementations accidentally remove that protection entirely. - 1/12

[SecLat @SecLat_Security]

For automated systems or router wrappers:

→ use bounded future expiries
→ avoid infinite deadlines
→ combine with MEV protection/private mempools when possible

Takeaway:
block.timestamp as a Uniswap deadline is not a harmless shortcut.
11/12