deth

81 audits done, 244 issues found

Founder @EgisSec
Ex-@Certora
Lead Auditor @sherlockdefi

Our work

[deth @dethSCA]

Will I be unemployed by the end of the year?

The desired answer is Yes

Hey, I'm deth, founder of @EgisSec and ex-Certora security researcher

I've felt that auditing/web3sec twitter has been pretty stale recently, so as an introvert and someone who is shit at writing I plan to change that

For the next ~4 months I'll be building Egis in public with concrete numbers, concrete methodologies, what I learned, what I did good and things I did bad

The above question has a loaded answer, so if I fail with Egis I'll be forced to get a job, which is a no-no for me

The North Star for this "challenge" is purposely vague, but it's the only one that makes sense to me and how I set goals

> Will there be a point working on Egis in 2027?

If it's yes then I'll continue with the series and continue being unemployed, if it's no then I'll be looking for a job

This community, and auditing itself, has given me so much, I've made so many friends and it's genuinely changed mine and my family's lives

With this series I hope I can bring back a small spark of that community back, at the very least there will be someone you can talk shit about on the regular

So follow me if you want to follow my, hopefully not short, journey as a businessman and follow @EgisSec for technical content, bug breakdowns, tools and AI in web3 security

Stay safe

[Egis Security @EgisSec]

If your backend or relayer acts on an emitted event, it can be lied to.

The EVM never checks that a log matches the state it claims. A contract can emit a transfer that moved nothing.

EventSpec reproduced it on bridge relayers.
https://t.co/XVg8cG32sd

A log is a claim, not a receipt.

[Egis Security @EgisSec]

Does your protocol give out anything per address?

High severity issue we found while auditing a raffle project. An address with one Wei staked had the same odds of winning as the largest staker.

1️⃣ Project summary
Lotus is a staking protocol. You lock LOTUS, your position earns shares, and five percent of every reward distribution funds a separate raffle pool. Every two weeks that pool pays its whole jackpot, in TITANX, to one staker, drawn with Chainlink VRF.

2️⃣ The bug
The pool holds its participants as a set of addresses, and the draw is one line, index into that set with the random word. One address, one ticket. Stake size doesn't appear in that line.

Entering the set was a side effect of staking, with no threshold of its own. One share put an address in, and one share was one wei of LOTUS. The randomness was never the problem. What the random number indexed into was.

3️⃣ The attack path
1. Stake a wei of LOTUS from an address. That address is now a ticket.
2. Repeat from a substantial number of addresses.
3. Every honest staker's odds drop, whatever they locked.

The protocol priced a raffle ticket in gas and priced everything else in stake.

4️⃣ Fix
The client shipped a minimum stake to enter the draw.

Run the split test on anything you weight. If splitting one position across ten addresses beats holding one, you don't have a weighting, you have a headcount.

If you have the same pattern in your codebase, contact us so you don't repeat the same mistake.

https://t.co/XjjwUNFSV0

[deth @dethSCA]

Can't afford an audit? Talk to us anyway

Although we are a boutique firm and our prices are higher than most, passionate founders that are very invested in what they are building deserve our time, even if they don't have the budget for us

[deth @dethSCA]

@0xenzo_eth “Ser”

[deth @dethSCA]

This is still happening btw

[deth @dethSCA]

If you want to succeed

Learn how to sell yourself

Over the past week I've gotten at least 10 messages of auditors offering to work with me and I notice people don't know how to sell themselves

> Show your experience in the first few lines of the DM
> No links, unless someone asks for them
> Be short and to the point

Don't do this

[deth @dethSCA]

@RealJohnnyTime Congratulations man!

[deth @dethSCA]

@im_kosta Listen to the man everyone ⬆️

[deth @dethSCA]

@im_kosta Sales is a numbers game, 100%

I meant how do you improve your odds by how you format you messages

[deth @dethSCA]

@im_kosta What advice would you give?

[deth @dethSCA]

@im_kosta It matters, but opening with this is not the way imo

[Egis Security @EgisSec]

Do you review your own contracts before an audit?

@AwareXone has skills that cover 10 different bug classes using a knowledge base consisting of target scoring, bug patterns, grep arsenal, PoC templates and real case studies.

Check them out below ⬇️

[deth @dethSCA]

@kyan_novoyd Gotta keep pushing

[deth @dethSCA]

Day in a life of an auditor

> Cold DM protocol
> Protocol is interested and wants a quote
> Quote is sent
> Ghosted

Bruh

[Egis Security @EgisSec]

If every user of your protocol delegatecalls into one shared helper contract, this affects you too.

On 1st of September, four forgotten Reflexer vaults were drained for 5.9436 ETH by two rules that are both correct.

1️⃣ Summary
Reflexer's GEB is the engine behind RAI, a stablecoin you mint by locking ETH in your own vault.

Nobody calls the vault manager directly. You delegatecall a shared helper from your own proxy, so address(this) is your proxy, recorded as the owner.

2️⃣ The bug
Rule one, record address(this) as the owner. Correct under delegatecall.

Rule two, let only the recorded owner move a vault's balance. Correct on its own.

In 2020 someone reached the helper as a plain call instead of through a proxy. address(this) was then the helper itself, so vaults 3, 5, 8 and 18 ended up owned by a shared contract whose migration function, quitSystem, is public and unchecked.

The manager compares the caller to the recorded owner, sees the helper on both sides, and says yes. Nothing was bypassed.

3️⃣ Attack path
1. Reflexer has been in permanent settlement since January 2021, so anyone may cancel a vault's debt. Do that for all four, leaving debt free ETH in each.
2. Call that migration function directly, once per vault, moving every balance to a handler you control, then exit through the ETH adapter.

Four vaults, one transaction, five years after that owner field was written.

Delete either rule and the ETH is still there. An access check is only as trustworthy as whatever filled in its owner field.

If you have the same pattern in your codebase, contact us so you don't repeat the same mistake.

https://t.co/XjjwUNFSV0

[deth @dethSCA]

There's no shortage of audits

There's a shortage of reasons to pick you

[deth @dethSCA]

My man cooking

[J4X @J4X_Security]

I've been cooking hard over the last few weeks to get my new project @Stature_finance up and running. After billions of tokens and not seeing the sun for a while, I submitted the first version for the @solana Stocklana hackathon today. Stature will be the easiest and cheapest way for end users to buy tokenized stocks.

Now I still have about 2 weeks left to add more functionality, start the beta, and get the first people to actually invest using the app before I hand it in for the big Colloseum hackathon.

I'm a complete newbie at videos, but my assistant (he loves to eat tokens) and I got it to look really decent, so I'll share it here with all of you

Also, check out the website/waitlist -> https://t.co/n3lJe0JsRp

[J4X @J4X_Security]

I've been cooking hard over the last few weeks to get my new project @Stature_finance up and running. After billions of tokens and not seeing the sun for a while, I submitted the first version for the @solana Stocklana hackathon today. Stature will be the easiest and cheapest way for end users to buy tokenized stocks.

Now I still have about 2 weeks left to add more functionality, start the beta, and get the first people to actually invest using the app before I hand it in for the big Colloseum hackathon.

I'm a complete newbie at videos, but my assistant (he loves to eat tokens) and I got it to look really decent, so I'll share it here with all of you

Also, check out the website/waitlist -> https://t.co/n3lJe0JsRp

[deth @dethSCA]

> Be Bob
> Bob conducts an audit
> Audit finds Critical
> Bob waves it off as “out of scope”
> Bob gets drained the moment he deploys live
> Don’t be Bob

[deth @dethSCA]

"This video will restore your faith in humanity"

The feeling I get from watching those videos is the same one I get using Opus 5.5

[deth @dethSCA]

> Be Bob
> Bob conducts an audit
> Audit finds Critical
> Bob waves it off as “out of scope”
> Bob gets drained the moment he deploys live
> Don’t be Bob