Ahmed

Blockchain Security Researcher @NethermindSec

[Ahmed @ahmedaghadi]

@immunefi .

[Ahmed @ahmedaghadi]

@MrBeast 12,121,212

[Nethermind Security @NethermindSec]

Our auditors check for second preimage vulnerabilities in every Merkle-related review. The pattern repeats.

The contract accepts a raw 64-byte leaf. An attacker submits two concatenated child nodes as a single leaf. It hashes to the value of the internal node. The proof passes. The data was never authorized.

Libraries process whatever leaf you hand them. The vulnerability is in construction, not verification, and it survives code review more often than it should.

@ahmedaghadi breaks down the full mechanism and the two standard mitigations: https://t.co/k84G0qmiU5

[Ahmed @ahmedaghadi]

@mdothassan @0xSimao In simple words, the fuzzing test suite will be executing functions in different order with different input arguments and will try to break the invariants.

[Ahmed @ahmedaghadi]

@WhiteHatMage @dan__vinci How to do 27 hours per day?

[Ahmed @ahmedaghadi]

@sockdrawermoney AI related?

[Ahmed @ahmedaghadi]

@wavey0x It's because timestamp is treated as constant

[Ahmed @ahmedaghadi]

@wavey0x Compiler optimizes this. It's known bug

[Ahmed @ahmedaghadi]

@PatrickAlphaC Please check return value of `transfer(...)` in `increment(...)`. How much is the bounty for this critical issue?

[Ahmed @ahmedaghadi]

@PatrickAlphaC @aviggiano @swissknifexyz Simply host the UI in ipfs. Wdyt?

[Ahmed @ahmedaghadi]

@DevDacian @_wizardev What about me?👀

[Ahmed @ahmedaghadi]

@0xSlowbug @code4rena Honestly, there's no exact strategy. I think the simplest strategy which I aim for is: Learn, do contest, repeat. Try to push yourself out of the comfort zone. Remember, it's a marathon, not a sprint.

[Ahmed @ahmedaghadi]

Did 1 audit in last 90 days in @code4rena and got rank of 60 in 90 days leaderboard. I think I should give more time to public contests.

[Ahmed @ahmedaghadi]

@halalauditor @code4rena Barakallahu feek! 🙌

[Ahmed @ahmedaghadi]

@0xSlowbug @code4rena The only thing I did was participated in a tough contest and found few issues.

[Ahmed @ahmedaghadi]

@KoolexC Is it because of some recent issue? 🤔 ifykyk 🙂

[Ahmed @ahmedaghadi]

@0xnirlin @m4rio_eth You want to convert md files to web pages, right?

[Ahmed @ahmedaghadi]

@0xnirlin @m4rio_eth Have you tried Hugo ( written in Go ) Or Zola ( written in Rust )? They are static site generators.

[Ahmed @ahmedaghadi]

@hot_girl_spring You can avoid loop like this. Let me know if this solves the issue.

[Ahmed @ahmedaghadi]

@tluzat @mattpocockuk Fixed!