Tetragaze

Smart contract and blockchain solutions audit.

[Tetragaze @Tetragaze]

Each day brings another bridge hack?

[De.Fi Antivirus Web3 🛡️ @De_FiSecurity]

🚨 Massive Funds Movements are Occurring From the Multichain Bridge 🚨

57.5 million $USDC, 1,023.8 Bitcoin and 7,214 ETH have been transferred to various EOAs

Lack of communication from the team suggests a possible leakage of private keys.

Here are the transactions 👇

[Tetragaze @Tetragaze]

Interestingly, the triggering of a hook is not determined by a variable or similar mechanism. Instead, it is based on the initial bytes of the hook contract's address.

[banteg @banteg]

in uniswap v4, you have to mine a specific hook deploy address that contains your desired config stored as bit flag at the beginning of the address. even though it saves on gas, this design sounds a bit cursed.

[Tetragaze @Tetragaze]

Great analysis! It's important to identify vulnerabilities and potential risks in code.

[Daniel DACA Cohen Hillel @0xDACA]

I found a cool vulnerability in @OpenZeppelin 's Merkle tree implementation and reported it to them on @immunefi 🌲🌲🌲

𝐋𝐞𝐭'𝐬 𝐝𝐢𝐯𝐞 𝐢𝐧! 🧵🪡

[Tetragaze @Tetragaze]

Stay vigilant, adopt best security practices, and collaborate with auditors and security researchers to ensure the safety of smart contracts. #SmartContractSecurity #ReentrancyAttacks

[Tetragaze @Tetragaze]

🔒 Reentrancy attacks remain a significant problem in smart contracts, despite increased awareness. Recent events, like the Fei's Rari Fuse Pools incident, have resulted in the loss of millions of dollars.

[Tetragaze @Tetragaze]

Preventing reentrancy requires implementing checks-effects-interactions (CEI) patterns and avoiding the use of transfer and send functions. Additionally, considering the introduction of new opcodes and disabling reentrancy by default at the compiler level can enhance security.

[laurence @functi0nZer0]

The SEC suing the same company that the US government is selling Bitcoin through is so astonishingly funny I might have a stroke

[wassieloyer @wassielawyer]

Ok I don't want to fuel a bank run but I am getting a bunch of questions around whether to pull funds from Binance.

Here is a handy decision-making matrix.

[Tetragaze @Tetragaze]

💀💀💀

[U.S. Securities and Exchange Commission @SECGov]

Today we charged Binance Holdings Ltd. (Binance); U.S.-based affiliate, BAM Trading Services Inc., which, together with Binance, operates https://t.co/swcxioZKVP; and their founder, Changpeng Zhao, with a variety of securities law violations.

https://t.co/H1wgGgR5ir

[Tetragaze @Tetragaze]

This statement emphasizes the significance of effective communication and the accessibility of senior leadership in addressing concerns and ensuring the smooth operation of the company's systems.

[Multichain (Previously Anyswap) @MultichainOrg]

In the past two days, the Multichain protocol has experienced multiple issues due to unforeseeable circumstances. The team has done everything possible to maintain the protocol running, but we are currently unable to contact CEO Zhaojun and obtain the necessary server access for maintenance.

This afternoon, there was an issue with the scanning node network of Router5, which has affected the normal cross-chain service of some chains. Furthermore, this problem is beyond the team's current permissions and ability. In order to protect the interests of our users, we have decided to suspend the corresponding cross-chain service for the affected chain on the UI. Last week, the same issue happened on Router2.

We appreciate the user’s understanding and request that our partners stop directly calling the Multichain protocol smart contracts on/to the affected chain for cross-chain operations.

All the affected chains are:

Kekchain, PublicMint, Dyno Chain, Red Light Chain, Dexit, Ekta, HPB, ONUS, Omax, Findora, Planq.

[Tetragaze @Tetragaze]

The article is excellent, particularly in its focus on traditional security researchers.
https://t.co/4gWsT7T517

[Tetragaze @Tetragaze]

@moverxyz @Ghostiez_NFT @meckyeth @bangid0s LFG! Let's ignore that and move forward!

[Tetragaze @Tetragaze]

Both Hardhat and Foundry can be used together in a repository. One acts as the main framework, while the other is utilized for specific purposes. In OpenZeppelin contracts, Hardhat is the primary test framework, and Foundry is used for fuzz testing.

[Tetragaze @Tetragaze]

By addressing the following issues - insufficient testing coverage, limited rollback capabilities, and inadequate monitoring - one can significantly improve their confidence in deploying software and achieve a greater sense of sanity.

[Tetragaze @Tetragaze]

VRF, the most popular random number generator in Web3, has fulfilled over 15.8 million requests for more than 6,300 smart contracts on various chains.
VRF 🤝 NFTs
https://t.co/aJIGFuDv4t

[Tetragaze @Tetragaze]

The comments section of this post has sparked an engaging conversation. What are your thoughts on the matter?

[TrustSec @TrustSecAudits]

Should audit firms add a CONFIDENCE RATING in the executive summary report, i.e. "we estimate there's X likelihood we've missed a high severity issue"?

[Tetragaze @Tetragaze]

Project momentum can quickly dissipate, so it is essential to deliver a functional product the first time.

[Tetragaze @Tetragaze]

When creating an NFT contract, your main focus differs from that of a DeFi contract. The NFT's mechanics are usually straightforward, and losing people's money is avoidable (RIP to Akutar). Your primary responsibilities are centered around minting and revealing.

[Tetragaze @Tetragaze]

For the reveal, your objectives are to support the project's business objectives, ensure that users and the team cannot game the reveal, and guarantee that the metadata functions properly.