gbaleeee

愚钝之人 ｜ SR @ sec3dev

[gbaleeee @gbaleeeee]

Inspired by the "two parser bug," I identified a vulnerability related to precision loss during the audit. If you're interested in precision loss or fuzz testing, check this out:
https://t.co/lgZuXSMJ6F

[Daniel Von Fange @danielvf]

I call it a "two parser bug".

Two different implementations tracking the same input, and parsing differences cause diverging behavior from different parts of a system. Here's two recent examples used in hacks, and how to avoid.

🧵1/5

[S3v3ru5 @S3v3ru5_]

I used property testing during a Solana AMM audit. This blog post walks through the seven properties and their reasoning, the sequence-based test structure, and a case where my own test had a bug that looked like a real finding: https://t.co/lgyDEI30WK

[OpenZeppelin @OpenZeppelin]

https://t.co/vnZSNTZ3GZ

[OpenAI @OpenAI]

Introducing EVMbench—a new benchmark that measures how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities. https://t.co/op5zufgAGH

[OpenZeppelin @OpenZeppelin]

https://t.co/8cIXwkfWse

[ControlZ @ControlZ_1337]

I’ve been getting a lot of questions about how this bug was found, so here are the answers:
https://t.co/DeHgmRK44o

This is a technical review of how Claude Code was used to uncover this crazy bounty, and more broadly how AI can be leveraged to find Critical and High-severity issues.

[gbaleeee @gbaleeeee]

@ret2basic @brandon_shi @taichiaudit “没有～”

[UPD.IO | Universal Private Dollar @UPD_io]

⚠️ The full technical postmortem for the USPD exploit is now live.

The root cause was not contract logic, but deployment atomicity.

Our forensic analysis indicates this is an industrial-scale operation: we identified ~200 other proxies on mainnet infected by the same infrastructure.

👉 Read it here: https://t.co/YsBZhDLjl1

We deployed the proxy in one transaction and initialized it in another. In that brief window, an attacker installed a "shim" that forwarded calls to our legitimate code while retaining admin control.

This allowed the protocol to function normally for 3 months, passing verification checks, until we attempted a routine upgrade.

We break down the specific architectural decisions—specifically regarding deterministic addresses—that created the window for the CPIMP attack. Full analysis and data in the article. 👇

V2 architecture is already in motion, moving to strictly atomic deployments to eliminate this vector entirely. Simplified modular architecture, DeFi-compatible yield design, and more. We will share further details as we progress. Next steps: Recovery Tokens and closed group affected holders, protocol adjustments and re-launch preparation.

🤝 Special thanks to @SEAL_911 for their immediate assistance in helping us navigate the aftermath.

[yearn @yearnfi]

Post-Mortem Analysis of the yETH Exploit - 1 December 2025

https://t.co/kxYTy32r8D

[gbaleeee @gbaleeeee]

@ret2happy @lzhou1110 It’s time to start studying plumber 101😇.

[Anthropic @AnthropicAI]

New on our Frontier Red Team blog: We tested whether AIs can exploit blockchain smart contracts.

In simulated testing, AI agents found $4.6M in exploits.

The research (with @MATSprogram and the Anthropic Fellows program) also developed a new benchmark: https://t.co/QpGPMqlDRG

[BlockSec Phalcon @Phalcon_xyz]

.@Balancer and several forked projects were attacked a few hours ago, resulting in losses exceeding $120M across multiple chains. This was a highly sophisticated exploit. Our initial analysis suggests the root cause was an invariant manipulation that distorted the BPT price calculation, allowing the attacker to profit from a specific stable pool through a single batch swap.

Take an attack TX on Arbitrum as an example, the batchSwap operation can be broken down into three phases:
1. The attacker swaps BPT for underlying assets to precisely adjust the balance of one token (cbETH) to the edge of a rounding boundary (amount = 9). This sets up the conditions for precision loss in the next step.
2. The attacker then swaps between another underlying (wstETH) and cbETH using a crafted amount (= 8). Due to rounding down when scaling token amounts, the computed Δx becomes slightly smaller (8.918 to 8), leading to an underestimated Δy and thus a smaller invariant (D from Curve’s StableSwap model). Since BPT price = D / totalSupply, the BPT price becomes artificially deflated.
3. The attacker reverse-swaps the underlying assets back into BPT, restoring balance while profiting from the deflated BPT price.

Attack TX on Arbitrum: https://t.co/wt1luPaA0F

[gbaleeee @gbaleeeee]

@ret2basic pls issue the ret2basic token😁

[gbaleeee @gbaleeeee]

@ret2basic 叮咚鸡

[gbaleeee @gbaleeeee]

@Xor0v0 用力活着用力爱哪怕肝脑涂地

[ret2basic.eth @ret2basic]

https://t.co/ly9J6O5auD

[Dedaub @dedaub]

Just mitigated: The CPIMP Attack – a stealthy front-running exploit infecting 100s of DeFi proxies across many protocols

Attacker inserts hidden proxies that self-restore, spoof Etherscan, and lie dormant for high-value strikes

Tens of millions at risk

https://t.co/b4UX9KayL0

[gbaleeee @gbaleeeee]

@ret2basic @CertiK 🤣

[gbaleeee @gbaleeeee]

@QiuhaoLi @immunefi dddd

[Neodyme @Neodyme]

@GMX_IO V1 has been hacked. Here is how: