Fred Gitonga

Maths and Code.
Building @topizzy_
Ambassador @Cyfrin

[Fred Gitonga @fredgitonga_ke]

1 bug. 10 years ago. 3.6 million ETH stolen.

That was The DAO hack. June 2016.

And the bug had already been identified before the attack happened.

I am 24% done with the @CyfrinUpdraft Smart contract Security course and @ethereum history is unraveling.

[Fred Gitonga @fredgitonga_ke]

May is almost done.
46% into the @cyfrinupdraft Smart Contract Security course.
Started the month at 24%. Slow? Maybe.
But every percent is a concept that will protect real money. Here is what I learned this month

[Fred Gitonga @fredgitonga_ke]

@am_kiplagat 👏🏼👏🏼👏🏼

[Fred Gitonga @fredgitonga_ke]

@robinsoncodes @iCog_Labs Congratulations 👏🏼👏🏼

[allanrobinson.onchain 📍ShanhaiWoo 🇸🇬 @robinsoncodes]

New month 😎. New opportunities. 🚀

Starting June with an exciting challenge: joining @iCog_Labs as an AI Intern on the Hyperion MOSES Team.

Time to learn, build, experiment, and get deep into Symbolic AI, MeTTa, and Hyperon.

Let's see where this journey leads.

[Fred Gitonga @fredgitonga_ke]

@nyagoh_ @Kelvinmwendwa__ @robinsoncodes

[Maina @nyagoh_]

Friends🥰

[Fred Gitonga @fredgitonga_ke]

@Blockchain047 @CyfrinUpdraft @ethereum That was a great question, just googled that testnet was launched in 2021.

[Fred Gitonga @fredgitonga_ke]

1 bug. 10 years ago. 3.6 million ETH stolen.

That was The DAO hack. June 2016.

And the bug had already been identified before the attack happened.

I am 24% done with the @CyfrinUpdraft Smart contract Security course and @ethereum history is unraveling.

[Fred Gitonga @fredgitonga_ke]

@CRoQs47 The community to follow is @Web3Clubs

[Fred Gitonga @fredgitonga_ke]

@Mutisyia Fair question😁
Tbh the products are already on our timelines daily

checkout @Topizzy_ , @minisendapp ,
communities like @Web3WayAfrica @Web3Clubs visit @Web3Clubs , hub for founders and builders

A Space is a great idea

[Fred Gitonga @fredgitonga_ke]

1 bug. 10 years ago. 3.6 million ETH stolen.

That was The DAO hack. June 2016.

And the bug had already been identified before the attack happened.

I am 24% done with the @CyfrinUpdraft Smart contract Security course and @ethereum history is unraveling.

[Fred Gitonga @fredgitonga_ke]

@Iam_abelle @CyfrinUpdraft ⚡️⚡️

[Fred Gitonga @fredgitonga_ke]

@irankundaMusa @CyfrinUpdraft mentor ⚡️ web3 comrade

[Fred Gitonga @fredgitonga_ke]

May is almost done.
46% into the @cyfrinupdraft Smart Contract Security course.
Started the month at 24%. Slow? Maybe.
But every percent is a concept that will protect real money. Here is what I learned this month

[Fred Gitonga @fredgitonga_ke]

@am_kiplagat @blackie_360 @CapwellMurimi @AngelofVerdant @KenyaTechEvents ⚡️⚡️

[Musa @irankundaMusa]

@fredgitonga_ke @CyfrinUpdraft Keep shipping & learning 🚀

[Fred Gitonga @fredgitonga_ke]

@irankundaMusa @CyfrinUpdraft yes sir⚡️ we continue shipping <> building

[Fred Gitonga @fredgitonga_ke]

co-authored: https://t.co/EUJivBS6OH

[Fred Gitonga @fredgitonga_ke]

3. I had a big audit mindset shift:
I stop asking "does this function work?" and started asking "what assumptions break when the components interact?"
The "two rights make a wrong" lesson.
Component A and Component B works perfectly separate. Together they create a vulnerability.

[Fred Gitonga @fredgitonga_ke]

The Sushi batch() vulnerability showed how dangerous this gets.
Imagine buying unlimited coffee for the price of one.
ETH sent: 1
ETH credited: 3
delegatecall preserved msg.value across every call. Same ETH counted three times.

[Fred Gitonga @fredgitonga_ke]

2. There is delegatecall.
Normal call creates a new execution context.
delegatecall preserves the caller's context, i.e the msg.sender, msg.value, storage all stay the same.

Think of it as: run another contract's function without leaving your own house.

[Fred Gitonga @fredgitonga_ke]

Every input is either user controlled or validator influenced.
The Meebits exploit proved it.
Larva Labs used on-chain randomness to assign rare NFTs.
An attacker figured out the pattern:
Mint → check rarity → bad rarity? → revert() → retry