MkXploit | Smart Contract Security Researcher

Smart Contract Security Audits | Solidity / Ethereum Building daily • Web3 security
I study smart contract failures so builders don’t repeat them

[MkXploit | Smart Contract Security Researcher @mkXploit]

Starting My Smart Contract Security Journey
Daily posts on real vulnerabilities, exploits, and lessons from audits. Learning in public, one bug at a time.
Let's build a more secure Web3 together

[MkXploit | Smart Contract Security Researcher @mkXploit]

→ Etherpot
→ King of the Ether

Both lost funds because failed transfers weren't handled properly.

Modern rule:

Always check the returned bool.

Always.

Biggest lesson:

Silent failures are some of the most dangerous failures.

#Ethereum #SmartContracts #Web3Security

[MkXploit | Smart Contract Security Researcher @mkXploit]

Your contract may think it sent ETH.

What if it didn't?

Day 95 of my SR Journey 🧵

A dangerous Solidity misconception:

.send() and .call()

DO NOT revert automatically on failure.

Instead they return: bool success

Meaning this can happen: 👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

https://t.co/X1sZDLkSy7{value: amount}("""");

Transfer fails.

But execution continues.

If you never check:

require(success);

Your contract assumes everything worked.

Even when it didn't.

This exact mistake contributed to real incidents including: 👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

@clarke_ame You’re welcome

[MkXploit | Smart Contract Security Researcher @mkXploit]

Q: Why does Solidity use: constructor() today?

A: Because humans make mistakes.

And naming bugs once compromised real protocols.

#Ethereum #Web3Explained

[MkXploit | Smart Contract Security Researcher @mkXploit]

If your smart contract ignores return values...

You're not writing secure code.

You're writing assumptions.

The difference between "secure code" and "vulnerable code" is often one forgotten keyword.

#SmartContracts #SecurityResearch #Ethereum #Solidity

[MkXploit | Smart Contract Security Researcher @mkXploit]

Tiny naming mistakes can become ownership vulnerabilities.

#Ethereum #Solidity #SmartContractSecurity

[MkXploit | Smart Contract Security Researcher @mkXploit]

One forgotten rename gave attackers ownership of an entire protocol.

Day 95 of my SR Journey 🧵

Before Solidity 0.4.22...

Constructors worked differently.

Instead of:

constructor()

You had to name the constructor exactly the same as the contract.

Example: 👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

It became a normal public function.

Meaning anyone could call it.

And become owner.

Just like that.

This bug became one of Ethereum's classic security lessons.

Today Solidity uses:

constructor()

to prevent exactly this mistake.

Biggest lesson: 👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

Most developers fear advanced exploits.

The reality?

Some of crypto's most famous bugs happened because someone forgot to rename a function.

#Solidity #Web3Security

[MkXploit | Smart Contract Security Researcher @mkXploit]

Audit tip

Whenever you see: delegatecall

Ask yourself: "What happens if the target contract disappears?"

The answer might be catastrophic.

#SmartContracts #Ethereum

[MkXploit | Smart Contract Security Researcher @mkXploit]

The funds were still there.

But nobody could access them anymore.

~$150M frozen forever.

Biggest lesson:

Shared dependencies create shared failure points.

One contract.

Thousands of victims.

#Ethereum #SmartContractSecurity #SecurityResearch

[MkXploit | Smart Contract Security Researcher @mkXploit]

A single transaction permanently froze ~$150M worth of ETH 😱

No hack.
No private key compromise.

Just one function call.

Day 93 of my SR Journey 🧵

In November 2017, parity had already suffered one major exploit.

Then disaster struck again.

Here's what happened 👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

The library itself had never been initialized.

Meaning nobody owned it.

So they simply called:

initWallet()

and became owner.

Then they called:

kill()

The library self-destructed.

Gone.

Every wallet depending on that library instantly lost access to its logic.👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

The scariest smart contract exploits don't steal money.

They make it impossible to recover it.

$150M wasn't stolen in the Parity Library incident.

It was frozen forever.

That's arguably worse.

#Ethereum #Web3Security #SmartContracts

[MkXploit | Smart Contract Security Researcher @mkXploit]

“This should never happen.”

This is one of the most dangerous mindset in Web3

Attackers love assumptions like this 😁

#Ethereum #SmartContractSecurity

[MkXploit | Smart Contract Security Researcher @mkXploit]

@Sonofachampionn @meikkp Done

[MkXploit | Smart Contract Security Researcher @mkXploit]

The best auditors don’t just read code.

They recognize dangerous patterns BEFORE the exploit happens.

#Ethereum #SecurityResearch