𐌋𐌄Ꝋ

𐌂Ꝋ𐌍𐌔𐌉𐌔𐌕𐌄𐌍𐌂𐌙 𐌊𐌉𐌋𐌋𐌔 𐌂𐌓𐌄𐌀𐌕𐌉ᕓ𐌉𐌕𐌙!

[Charles Guillemet @P3b7_]

The first ZK exploits happened...
https://t.co/inIT3s8z2I

[Vitto Rivabella @VittoStack]

https://t.co/2uI4EiqNxg

[chrisdior @chrisdior777]

Auditing feels impossible at first.

Here’s what progress actually looks like:

0–100h -> lost most of the time
200–300h -> start spotting patterns
500–700h -> can handle big codebases
1000h+ -> it clicks, bugs stand out instantly

The skill compounds over time. Keep going🙏

[Bernhard Mueller @muellerberndt]

Here’s my new article on finding soundness bugs in ZK circuits, with concrete examples in Circom, Cairo, and Rust. Link in reply.

[𐌋𐌄Ꝋ @CipherShade]

@RealJohnnyTime @StarknetFndn @Om_Santoshwar @MSG_Encrypted @ayur_27 @0xaudron @1techhunter @Pelz_Dev @rejwar @0xLegendaire @AnmolSirola @Icon_70 @dmtrbch Appreciate the chance! Can't wait to dive in with the CSCH community and @Starknetfndn! 🔥

[𐌋𐌄Ꝋ @CipherShade]

Something big is brewing. Eyes on #cantinapectra. 🕶️🖤

[Cantina 🪐 @cantinasecurity]

The next chapter of @ethereum security begins 🪐

Today marks the beginning of a new competition: a comprehensive review of Pectra, in partnership with the @ethereumfndn.

�� $2,000,000 USDC
📆 Live now - March 24th
🔗 Below

[𐌋𐌄Ꝋ @CipherShade]

@angelinarusse @Alchemy Excuse me, ma’am, I’ll take some alchemy fries with my order.

[𐌋𐌄Ꝋ @CipherShade]

@angelinarusse What a ride it’s been since '22! All the love for alchemy — onwards and upwards. LFG! 🥳

[zokyo @zokyo_io]

Level up your cybersecurity knowledge!

A compilation of the best Web3 security alpha from our top engineers 🧵

📚 Blog Posts

1️⃣ Preparing for the Challenges of Smart Contract Audits
🔗 https://t.co/MTdjiuv1Bo
Compilation of essential tips for pre-audit preparation

2️⃣ The Power of Penetration Testing
🔗 https://t.co/tCBcT3WQxL
Why penetration testing is crucial for identifying security gaps in Web3 systems

3️⃣ Understanding Subdomain Takeovers
🔗 https://t.co/vdcb2wXyyg
A comprehensive guide to subdomain takeovers in the context of Web3

4️⃣ Design: Push vs. Pull Pattern in EVM
🔗 https://t.co/ifDcwHTDU8
The benefits and trade-offs of different smart contract design patterns within the Ethereum Virtual Machine

5️⃣ Bug Bounty Programs
🔗 https://t.co/CQ8F2iv7We
The evolution and critical role of bug bounty programs in cybersecurity

6️⃣ AI & Smart Contract Security
🔗 https://t.co/m0jA8TkSqn
How AI is reshaping security practices in smart contract coding and auditing

7️⃣ Under the Hacker’s Hood: JSON Injection in NFTs
🔗 https://t.co/OpY2cpRct2
Understanding vulnerabilities in NFT metadata and risks from JSON injection attacks

8️⃣ The Role of Invariant Testing in Cybersecurity
🔗 https://t.co/hVc3AinQPa
How invariant testing ensures robustness in smart contracts

9️⃣ Flash Loan Attacks
🔗 https://t.co/g4zgZ7FjWt
How flash loan attacks work, their impact on DeFi, and strategies to avoid them

🔟 Chainlink VRF
🔗 https://t.co/Sl53U112w6
An examination of Chainlink’s VRF and the security considerations for its use

1️⃣1️⃣ The Top 10 Vulnerabilities in Large Language Models (LLMs)
🔗 https://t.co/mWKelIfVvD
Insights into the top vulnerabilities in AI models and the security measures to consider

1️⃣2️⃣ Best Practices for Web3 Wallet Security
🔗 https://t.co/lyfyEz46qD
Guidelines to securing private keys and wallet security

1️⃣3️⃣ Web3: A Promising Frontier Fraught with Deception
🔗 https://t.co/7q8P8BaGZs
Lessons from a recent YouTube-promoted crypto scam case study

💬Twitter Threads

1️⃣ Recap of OpenSense Interview
🔗https://t.co/rtvYVXXnMV
Key insights from top engineer @SakshamGuruji on Web3 security, hackathon competitions, AI in auditing, and best practices

2️⃣ Boss goes on NASDAQ TradeTalks
🔗https://t.co/bzXyE2Ygq7
Our CEO Hartej discusses Generative AI, asset auditing challenges, and the future of cybersecurity

3️⃣ Top 10 Security Issues Discovered by Zokyo
🔗https://t.co/ucEqa0LRED
Our top audit findings of 2024, from rounding errors to DoS vulnerabilities

4️⃣ Fuzz Testing:All You Need to Know About
🔗https://t.co/WaBczx7hi6
Why fuzz testing is a practical alternative to formal verification for blockchain Virtual Machines

5️⃣ Zokyo's Top Security Insights on Solodit
🔗https://t.co/s9Gd7EoA0m
A deep dive into 1,200+ expert audit findings on Solodit

[𐌋𐌄Ꝋ @CipherShade]

@ShieldifySec To the Moon 🚀🫡

[𐌋𐌄Ꝋ @CipherShade]

@cryptodavidw Yes serrr 🫡

[𐌋𐌄Ꝋ @CipherShade]

@ShieldifySec The wild part is I just quit my job two days ago to go all-in on Web3 security. 😂

[𐌋𐌄Ꝋ @CipherShade]

@angelinarusse Who needs therapy when Angelina’s tweets hit the soul like that every day? 😌

[CharlesWang @0xCharlesWang]

Ether Transfers in Solidity: transfer(), send(), and call()

In Solidity, there are three primary ways to transfer Ether between contracts or to external accounts: transfer(), send(), and call(). Each method has different behaviors, including safety mechanisms and gas consumption, so it's important to understand when and how to use each one.

1. transfer()

The transfer() method is the simplest and most secure way to send Ether. It forwards 2300 gas to the recipient, preventing reentrancy attacks and ensuring that only basic operations (like logging) can be performed in the recipient’s fallback function. If the transfer fails, it automatically reverts the transaction.

Key Points:

Gas forwarding: Only 2300 gas is forwarded, which protects against reentrancy.

Auto-revert: The transaction reverts on failure, so you don’t need to handle errors.

Simple to use, but can fail if the recipient's fallback function requires more than 2300 gas.

Many auditors think it's an issue if a smart contract wallet is interacting with a contract and the transfer method transfers funds to the smart contract wallet. This will however only revert if there is gas-consuming logic in the fallback/receive function.

2. send()

The send() method works similarly to transfer(), but it does not automatically revert if the transaction fails. Instead, it returns a boolean (true on success, false on failure). You must manually handle the failure case.

Key Points:

Gas forwarding: Like transfer(), it only forwards 2300 gas.

Error handling: It does not revert on failure, so you must check the return value and handle failures manually.

3. call()

call() is the most flexible and method for sending Ether. It allows arbitrary interactions with contracts, including sending Ether and invoking functions. Unlike transfer() and send(), it forwards all available gas, which makes it more prone to reentrancy attacks.

However, it's useful when dealing with contracts that require more than 2300 gas to execute their logic.

To avoid security risks, call() should always be followed by a check of the return value and, ideally, a proper gas management or protection against reentrancy attacks.
One can also forward a custom gas value, if desired.

Key Points:

Gas forwarding: Forwards all available gas by default, making it flexible but potentially dangerous.

Error handling: Like send(), it returns a boolean that must be checked to ensure the transaction succeeded.

Reentrancy risk: Since all gas is forwarded, it’s vulnerable to reentrancy attacks unless guarded with checks like the nonReentrant modifier.

[𐌋𐌄Ꝋ @CipherShade]

@sherlockdefi anonymous ditches the signature, keeps it cheap, but tracking? Nah, good luck with it lol. 😂

[𐌋𐌄Ꝋ @CipherShade]

@CharlesWangP The code wrongly uses balanceOf(address(this)) to check the token balance.

[SHERLOCK @sherlockdefi]

Spot this bug, and you might become a Sherlock Lead Senior Watson (LSW) one day.

The winner will be picked in 24 hours.

This code is a simplified version of an actual vulnerability found in a Sherlock contest.

Hint: Look closely at the disableMaxLock function, consider all the edge cases.

Good luck!

[𐌋𐌄Ꝋ @CipherShade]

@_TheNFTDaily Gm

[𐌋𐌄Ꝋ @CipherShade]

@pashov

[𐌋𐌄Ꝋ @CipherShade]

@vukan0x Add me to the list serrr ;)