Starting My Smart Contract Security Journey
Daily posts on real vulnerabilities, exploits, and lessons from audits. Learning in public, one bug at a time.
Let's build a more secure Web3 together
→ Etherpot
→ King of the Ether
Both lost funds because failed transfers weren't handled properly.
Modern rule:
Always check the returned bool.
Always.
Biggest lesson:
Silent failures are some of the most dangerous failures.
#Ethereum#SmartContracts#Web3Security
Your contract may think it sent ETH.
What if it didn't?
Day 95 of my SR Journey 🧵
A dangerous Solidity misconception:
.send() and .call()
DO NOT revert automatically on failure.
Instead they return: bool success
Meaning this can happen: 👇
https://t.co/X1sZDLkSy7{value: amount}("""");
Transfer fails.
But execution continues.
If you never check:
require(success);
Your contract assumes everything worked.
Even when it didn't.
This exact mistake contributed to real incidents including: 👇
Q: Why does Solidity use: constructor() today?
A: Because humans make mistakes.
And naming bugs once compromised real protocols.
#Ethereum#Web3Explained
If your smart contract ignores return values...
You're not writing secure code.
You're writing assumptions.
The difference between "secure code" and "vulnerable code" is often one forgotten keyword.
#SmartContracts#SecurityResearch#Ethereum#Solidity
One forgotten rename gave attackers ownership of an entire protocol.
Day 95 of my SR Journey 🧵
Before Solidity 0.4.22...
Constructors worked differently.
Instead of:
constructor()
You had to name the constructor exactly the same as the contract.
Example: 👇
It became a normal public function.
Meaning anyone could call it.
And become owner.
Just like that.
This bug became one of Ethereum's classic security lessons.
Today Solidity uses:
constructor()
to prevent exactly this mistake.
Biggest lesson: 👇
Most developers fear advanced exploits.
The reality?
Some of crypto's most famous bugs happened because someone forgot to rename a function.
#Solidity#Web3Security
Audit tip
Whenever you see: delegatecall
Ask yourself: "What happens if the target contract disappears?"
The answer might be catastrophic.
#SmartContracts#Ethereum
The funds were still there.
But nobody could access them anymore.
~$150M frozen forever.
Biggest lesson:
Shared dependencies create shared failure points.
One contract.
Thousands of victims.
#Ethereum#SmartContractSecurity#SecurityResearch
A single transaction permanently froze ~$150M worth of ETH 😱
No hack.
No private key compromise.
Just one function call.
Day 93 of my SR Journey 🧵
In November 2017, parity had already suffered one major exploit.
Then disaster struck again.
Here's what happened 👇
The library itself had never been initialized.
Meaning nobody owned it.
So they simply called:
initWallet()
and became owner.
Then they called:
kill()
The library self-destructed.
Gone.
Every wallet depending on that library instantly lost access to its logic.👇
The scariest smart contract exploits don't steal money.
They make it impossible to recover it.
$150M wasn't stolen in the Parity Library incident.
It was frozen forever.
That's arguably worse.
#Ethereum#Web3Security#SmartContracts