degensec.eth

[degensec.eth @degensec]

With this trick you can call internal functions with any state mutability (even in an internal pure function).

However if the contract was entered externally in a view context (STATICCALL), then execution will revert on state mutations, making this trick unsafe.

4/4
h/t @z0age

[degensec.eth @degensec]

Did you know that you can cast the state mutability of a function pointer in Solidity.

You can use it to:
- have a view function appear as pure
- override an internal virtual function's state mutability without modifying the inherited contract

But how does it work?

1/4

[degensec.eth @degensec]

Function calls in Solidity work like this:

1. If the address is external, it makes a CALL or STATICCALL to the address.
2. If the function is internal (present in the bytecode of the calling contract) it executes a JUMP to the JUMPDEST marking the start of the function.

3/4

[degensec.eth @degensec]

@bytes032 @eulerfinance V2

[degensec.eth @degensec]

@GeorgeHNTR forget 10x, you’re in 100x territory

[degensec.eth @degensec]

@certora @Cryptonicle1 @TheTrustX You guys rock! Thank you so much :)

[degensec.eth @degensec]

Solidity 0.8.22 will ship with an optimization rule for simple loop increments. I can't believe it took so long to do this.

No more ugly unchecked blocks.

[degensec.eth @degensec]

Like all high-leverage endeavors, Web3 security follows the pareto principle. The hustle is to get to the top 20%. After that scale happens by itself.

[pashov @pashov]

Yeah please don’t start with web3 security you are too late, there are only $2M of rewards in security contests for the next few weeks and also Immunefi pays just >$2M on a monthly basis.

YOU ARE TOO LATE

[degensec.eth @degensec]

Managed to get an easy $500 Medium on the @centrifuge audit on @code4rena.

Always check if the protocol implements an ERC to spec, especially if it’s an obscure standard (ERC1404 in this case)

[degensec.eth @degensec]

@GalloDaSballo @noah_eth @ScrapingBits Perhaps even a simple “flattener” that lets you see the complete call flow of a function in one file. I think it would be quite useful to avoid all the context switching back-and-forth

Maybe also extract all storage reads/writes in the order they are made?

[degensec.eth @degensec]

.@noah_eth made a remark on the @ScrapingBits podcast about the current lack of auditor tooling. I think it really holds back the space.

What sort of auditing tool would you be excited about using? What feature do you dream about having in the tools you already use?

Curious.

[degensec.eth @degensec]

@noah_eth @ScrapingBits Yeah! Natural language specification is really underexplored as an approach to blockchain testing. I’ve heard @aviggiano talk a bunch about how useful it is to put high-level invariants in words before even starting to test.

Cucumber is just that on steroids.

[nader dabit @dabit3]

My controversial programming opinion is that 99% of what everyone argues about on here literally doesn’t even matter when it comes to shipping actual software

Everyone is stumbling, reaching, larping, will say almost anything if they’ve calculated it will bring them attention

[degensec.eth @degensec]

@bytes032 Writing tests in Javascript puts you in the shoes of your frontend developers / integrators. Much easier to give them snippets of code from your test suite.

[degensec.eth @degensec]

@bytes032 I recently had to test that a certain math function implemented in Solidity approximates close enough to the analytical solution.

No easy way to do that in Foundry afaik since you can’t compute the analytical formula in Solidity in the first place.

[degensec.eth @degensec]

@PopPunkOnChain @mafellows @nisedo_ @pashov @code4rena any plans to revamp gas optimization bounties?

[Antonio Viggiano @aviggiano]

This week I shared my experience with invariant testing at @opensensepw

Here are my tips and best practices on to write robust and efficient property tests for your DeFi protocol 🧵

[degensec.eth @degensec]

@0xlucianx0 It’s admittedly a tough question.

Supporting native ETH alongside WETH is undeniably better UX but it introduces complexity and even worse, attack vectors into your code.

Being security-minded, I know that simple code is safer code, but what would the business folks say?

[degensec.eth @degensec]

@deadrosesxyz @__alexxander_ Great job 💜