Haruka🌸

Professional Bug Generator 🐞

[Haruka🌸 @dev_haruka]

@definidude @velocorexyz @WombatExchange That's why we did not use your code and implemented from scratch, referencing your whitepaper! I still admire your work on AMM btw.

[Haruka🌸 @dev_haruka]

@definidude @velocorexyz @WombatExchange Copyright law does not protect mathematical ideas.

[Haruka🌸 @dev_haruka]

The attacker specified USDC/MATIC/... as the WETH address, and "transferFrom(victim, attacker, X)" as the instruction to unwrap it.

[Haruka🌸 @dev_haruka]

3 days ago, the team deployed a new "route" contract, WrappedTokenSwapperImpl(0xCC5fDA5e3cA925bd0bb428C8b2669496eE43067e). It is used to wrap/unwrap WETH.

[Haruka🌸 @dev_haruka]

WETH address or the call data for unwrapping is is not hardcoded, but supplied from the user. However, there was no validation logic.

[Haruka🌸 @dev_haruka]

Socket/Bungee Hack analysis🧵:

SocketGateway(0x3a23F943181408EAC424116Af7b7790c94Cb97a5) is a router contract, delegatecalls into developer-approved "route" contracts.

[Haruka🌸 @dev_haruka]

$WAIFU

[Haruka🌸 @dev_haruka]

That sounds like a lot of work. Oh noes

[Velocore | veDEX on zkSync Era / Linea ▪️ @velocorexyz]

🔥 Introducing our game-changing #roadmap release for Velocore!
Say goodbye to all the rug pulls and secure your #bluechip $VC in this unpredictable #zkSyncEra !
7 detailed categories, focused on May ONLY! Not an empty 2Q/3Q promises.
Details : https://t.co/TO34MlgqWV
@zksync

[Haruka🌸 @dev_haruka]

This is just a bad practice in general, but in the zkSync era, it breaks your contract. I can't believe this contract has raised 900 ETH. #Gemholic #REKT

[Haruka🌸 @dev_haruka]

🌸