Hazem

Tech Lead & Digital assets Expert & web3 developer @KPMG

[Hazem @Hazem_dh]

@etherscan a long awaited feature, FINALLY !

[Hazem @Hazem_dh]

@Zun2025 but there's a workaround 😏(💥💥💥)

[Hazem @Hazem_dh]

@SolidityScan a smart contract can deposit eth but can’t withdraw it resulting in eth being locked in the smart contract forever

[Hazem @Hazem_dh]

@rosarioborgesi @Uniswap @CyfrinUpdraft One way to learn and grasp some complex concepts is to learn from different sources/explanations so you can have a clear understanding , don't let a big codebase scare you , for uniswap V2 i started from here https://t.co/AsfZdaGuh3
best of luck 🖖

[ddimitrov22 @ddimitrovv22]

We finally have an EVM storage tool that is easy to use and reads storage slots from on-chain contracts.

Very useful for auditing and debugging, and eliminates all the manual work required (after https://t.co/sm9LpXkqIf was taken down).

Check it out

https://t.co/7Qv3Z2Z6dz

[Skilled Coder @theskilledcoder]

Microservices Patterns Cheatsheet

[Adarsh Gupta @Adarsh____gupta]

Backend development is simple, you just need to learn these

HTTP methods
Status codes
Request headers
Response headers
Authentication
Authorization
JWT tokens
Session management
Cookies
OAuth 2.0
API design
RESTful APIs
GraphQL
WebSockets
Server-side rendering
Database design
SQL queries
NoSQL databases
Database indexing
Query optimization
ACID properties
CAP theorem
Normalization
Denormalization
ORM (Object-Relational Mapping)
Connection pooling
Transactions
Migrations
Seeding data
Caching strategies
Redis
Memcached
CDN integration
Rate limiting
Throttling
API versioning
Middleware
Error handling
Logging
Monitoring
Application performance monitoring (APM)
Load balancing
Horizontal scaling
Vertical scaling
Microservices architecture
Monolithic architecture
Service-oriented architecture (SOA)
Message queues
Pub/Sub patterns
Event-driven architecture
CQRS pattern
Saga pattern
API Gateway
Service mesh
Docker containers
Kubernetes orchestration
CI/CD pipelines
Environment variables
Configuration management
Secrets management
CORS (Cross-Origin Resource Sharing)
CSRF protection
XSS prevention
SQL injection prevention
Input validation
Output sanitization
Password hashing
Bcrypt/Argon2
Salt and pepper
Two-factor authentication (2FA)
Single sign-on (SSO)
RBAC (Role-Based Access Control)
ABAC (Attribute-Based Access Control)
File uploads
Streaming data
Pagination
Filtering and sorting
Full-text search
Elasticsearch
Background jobs
Cron jobs
Task scheduling
Worker processes
Async/await patterns
Promises
Callbacks
Thread pools
Process management
Memory management
Garbage collection
Performance profiling
Benchmarking
Testing (unit, integration, E2E)
Mocking and stubbing
API docs (Swagger/OpenAPI)
Postman/Insomnia
Version control (Git)
Code review practices
Debugging techniques
Production deployment strategies

[Hazem @Hazem_dh]

Key takeaway:
Solidity types and ABI rules are enforced by the compiler, not by the EVM. Once you interact at the low level (assembly, .call, raw calldata), you’re dealing with bytes only. If contract logic assumes ABI guarantees while reading raw calldata, it’s already broken.

[Hazem @Hazem_dh]

Today we’re solving the Ethernaut challenge HigherOrder.
A small Solidity 0.6.x contract with a simple goal: become the commander. On the surface, everything looks safe , a uint8 parameter, a treasury value, and a straightforward condition. But a single inline assembly block completely changes the rules.

[Hazem @Hazem_dh]

Once you reason at the EVM level instead of the Solidity level, the solution follows naturally: control the raw calldata and the uint8 assumption collapses.

This is why I love smart contract CTFs ,you stop thinking in syntax and start thinking in mechanics. Bytes, memory, storage. It feels like playing with Lego bricks at a low level 🧱

[Hazem @Hazem_dh]

@OpenZeppelin Ethernaut is still a great learning resource, but some challenges are broken due to outdated Solidity versions or deployment issues.
Updating the repo would significantly improve the experience , plenty of issues and PRs are already waiting.

[Hazem @Hazem_dh]

2 years ago I completed Ethernaut. Since then, many new challenges have been added.
This time I revisited everything using a cleaner setup with Foundry instead of Remix.
Speedran the old levels, now tackling the new ones.
I’ll be tweeting solutions over the next few days.
GitHub: https://t.co/ScjCUItYWf

[Hazem @Hazem_dh]

💡 Theory without practice is like a ship without sails. Absorbing insights from audit reports on crypto attacks in the past couple of weeks , I dove into the Ethernaut challenges and it was a lot of fun solving them . 🚀

[Hazem @Hazem_dh]

Thanks for the heads up , in the past several weeks i was contacted by many scammers , they always share a repo and ask you to install and launch the project and give feedback , they are easy to spot especially if you can distinguish code written by AI , the project will generally have 2 or 3 commits , they rush you to do things and make interviews with the camera off

[Hazem @Hazem_dh]

Interesting article 👀
Auditing FHE-based smart contracts adds a completely new perspective compared to traditional audits.
You’re no longer just preventing logic bugs, but also ensuring encrypted values can’t be inferred or accidentally exposed through side effects, ACL misuse, or async patterns.
Definitely worth a read

[OpenZeppelin @OpenZeppelin]

Confidential smart contracts unlock new possibilities - and new security challenges 🔒

If you are building on @zama FHEVM or exploring it, this guide helps you avoid critical pitfalls like:
• Encrypted overflow bugs
• ACL misuse leading to data leaks
• Async callback replays

[Hazem @Hazem_dh]

@randhindi IMO , It doesn’t fully protect privacy, but it does mitigate risk. You can still infer whales from wrapped amounts and on-chain flows , encryption raises the bar, it doesn’t make you invisible

[Artem Chystiakov @Arvolear]

As a Solidity engineer, please don't learn syntax.

Learn core EVM concepts, smart contract design patterns, and O(1) algorithms.

Read EIPs, audit reports, and exploit post-mortems.

Study basic cryptography, key management, and established DeFi protocols.

[Hazem @Hazem_dh]

@Bouchut_ i know you're a fan of onchain analysis

[Hazem @Hazem_dh]

Great resource for anyone interested in on-chain forensics

[SlowMist @SlowMist_Team]

Recently, we’ve shipped a small but solid update to the Crypto Asset Tracing Handbook! 📘✨

📖Updated version on GitHub:
https://t.co/yizPo1auUU

🚀These additions expand the handbook’s coverage of cross-chain and laundering patterns — topics that many readers have been asking for:

1️⃣More bridge explorer links🔗:
• Squid
• Orbiter
• TeleSwap

2️⃣Two new case studies🔍:
• BTC Laundering Loops via Hyperunit
• Cross-Chain Source Analysis via Stargate Finance

If you’ve already read the handbook, this update makes it even more actionable. If you haven’t yet — now’s a great time to dive in.

🛡️We’ll keep refining the handbook over time to make on-chain tracing knowledge accessible to everyone in the crypto ecosystem.