David. @iam_davee - Twitter Profile

2 days ago

@0xilomsOnchain Audit with the intention to understand the protocol, if you see a bug in the process , beautiful,if you don't at least you can audit a similar program faster It's gonna be fine bro

1

0

26

David.

@iam_davee

5 days ago

@ProgrammerSmart saw it yesterday and it's really nice what they did

0

4

0

506

David.

@iam_davee

5 days ago

@0xstrikerr niceee

1

0

28

David.

@iam_davee

7 days ago

@HackenProof @Mysten_Labs @Pelz_Dev check this out

0

3

0

118

David.

@iam_davee

8 days ago

just seeing that i need "credits" to participate to submit a report on the PletherFi audit competition ,insane

0

1

0

40

David.

@iam_davee

11 days ago

@rosarioborgesi It's going to be fine

1

0

30

David.

@iam_davee

12 days ago

@0x_FiliSec Thanks bro

0

1

0

13

David.

@iam_davee

13 days ago

Attempted to solve the SideEntranceLenderPool challenge on damn vulnerable Defi and got it The Task ? Drain the lender pool of 1000 Eth and move it to a recovery account . 1st glance : Deposit and withdraw function were fully sealed ,that cannot be the bug 2nd glance :Flashloan function did the needful which is basically get the balance before send the money and assert the balance after is atleast same ( i learnt this when i was learning the UniswapV2Call ) 3rd glance : But i knew the bug was in the flashloan so what? Eureka!! BUG : The function checks if the balance of the contract was same or greater than the balance before,but it doesn't mean the loan was paid Opportunity :Since the pool leaves during the execute function ,i'm able to deposit the loan in the pool via the "deposit" function and the check passes ,now i can withdraw the ether to the recovery account Attached are the pool contract, a diagram explaining the flash loan mechanism and then my Attack Contract and the Proof of Concept would try to create a github repo for it🤍

iam_davee's tweet photo. Attempted to solve the SideEntranceLenderPool challenge on damn vulnerable Defi and got it

The Task ? Drain the lender pool of 1000 Eth and move it to a recovery account .

1st glance : Deposit and withdraw function were fully sealed ,that cannot be the bug

2nd glance :Flashloan function did the needful which is basically get the balance before send the money and assert the balance after is atleast same

( i learnt this when i was learning the UniswapV2Call )

3rd glance : But i knew the bug was in the flashloan so what?
Eureka!!

BUG : The function checks if the balance of the contract was same or greater than the balance before,but it doesn't mean the loan was paid

Opportunity :Since the pool leaves during the execute function ,i'm able to deposit the loan in the pool via the "deposit" function and the check passes ,now i can withdraw the ether to the recovery account

Attached are the pool contract, a diagram explaining the flash loan mechanism and then my Attack Contract and the Proof of Concept

would try to create a github repo for it🤍

2

8

0

2

395

David.

@iam_davee

14 days ago

@millw11488 @joaomendoncaaaa Btw I see the cool stuff you build ,an inspiration fr⭐

0

14

David.

@iam_davee

14 days ago

@chionerin he is coming🤍

0

1

0

22

David.

@iam_davee

14 days ago

@Jenom01 nbl

0

1

0

14

David.

@iam_davee

15 days ago

something that always makes me suprise is that ALL form of bugs no matter how complex it is is still under CIA (Confidentiality, Integrity and Availability)

0

1

0

46

David.

@iam_davee

15 days ago

Studied Lending Protocol , watched a deep dive on how aave works by @rosarioborgesi , refreshed my knowledge on APR and APY Currrently reading a Theory of Lending Protocols In DeFi by Massima Bartoletti and Enrico Lipparini of the University of Caliari , Italy to understand the possibiliites of Lending protocols the pros and cons with it Revisited Rust ,this time learning it with an approach towards building and auditing protocols on @solana

1

2

0

45