Ankur raj

@iitbombay graduate. Solidity • EVM • DeFi security

[Brian Armstrong @brian_armstrong]

Very soon there are going to be more AI agents than humans making transactions.

They can’t open a bank account, but they can own a crypto wallet. Think about it.

[Ankur raj @gearhead_ETH]

@isawsukul 1350

[Ankur raj @gearhead_ETH]

@blok_cap Yes, I am interested

[Ankur raj @gearhead_ETH]

@0xaudron Well explained

[Ankur raj @gearhead_ETH]

@arsen_bt Defendor

[Ankur raj @gearhead_ETH]

@panditdhamdhere Maybe

[Ankur raj @gearhead_ETH]

4. User B deposits 100 tokens and receives 100 / 101 ≈ 0.99 shares.

5. User A withdraws their 1 share and receives ≈101 tokens, extracting most of User B’s deposit.

[Ankur raj @gearhead_ETH]

Vault Inflation Attack (Share Price Manipulation):
The value per share is artificially inflated by directly transferring tokens to the vault without minting new shares.
Steps:

Steps:
1. User A deposits 1 token into the vault and receives 1 share.

[Ankur raj @gearhead_ETH]

2. User A donates 100 tokens directly to the vault using token.transfer(address(vault), 100) (no shares are minted).

3. The vault now holds 101 tokens with only 1 share, so the share price becomes 101 tokens per share.

[Ankur raj @gearhead_ETH]

🧠 Key takeaway

External call + unfinished state = reentrancy risk
Even for view functions.

Read-only ≠ safe.

[Ankur raj @gearhead_ETH]

🧵 Read-Only Reentrancy Attack (Exploit Walkthrough)

This repo demonstrates a read-only reentrancy attack using a stETH–ETH Curve pool and a vulnerable reward contract, based on learnings from the Hack Solidity playlist by Smart Contract Programmer.

[Ankur raj @gearhead_ETH]

🎯 Result

Reward calculation uses an artificially high LP price

Attacker receives excess rewards

No storage corruption, no balance drain

Just bad assumptions.

[Ankur raj @gearhead_ETH]

SLOAD reads contract storage from the transaction’s state view
SSTORE writes only to transaction-local state not the world state
If the transaction succeeds, changes are committed in the block
If it reverts, everything is discarded
Consensus happens at block level, not per opcode

[Ankur raj @gearhead_ETH]

This works because, during contract deployment, the contract’s code size is zero.

[Ankur raj @gearhead_ETH]

Today I learned about the zero code size contract from the Hack Solidity playlist.

What I understood:

1. Some contracts try to restrict function calls so that only EOAs can call them, not other contracts.

[Ankur raj @gearhead_ETH]

4. This check can be bypassed by calling the target contract from a constructor in the same transaction (deploy + call).

constructor(address _addr) {
target = ITarget(_addr);
target.pwn();
}