mono

Building SigintZero: Smart contract audits & on chain monitoring.

The post-mortem always costs more than the audit.

[mono @monodev_eth]

Pulled the whole trace apart, addresses and the two calls that prove it. https://t.co/FCWlvr4AT6

[mono @monodev_eth]

Everyone ran this as a $9.3M hack. Flow later corrected it to $410k.

More Markets on Flow lost its whole WFLOW reserve Monday.

Staking 1 FLOW minted 1 ankrFLOW. Redeeming 1 ankrFLOW paid 1.2 FLOW.

Loop that 54 times, print 52M tokens, post them as collateral.

[mono @monodev_eth]

Wrote up the mechanism and the numbers, including the borrow cap that was never set. https://t.co/ZtaGQlH8Xm

[mono @monodev_eth]

A token doing about $11k of daily volume was backing $119M of loans on Cronos.

Someone spent ~$600k pushing TONIC up 100x in 20 minutes, posted it as collateral, and borrowed Tectonic empty.

Validators halted the entire chain to trap the money. About $6M got out.

[mono @monodev_eth]

@stableshaman Bit Ga the big one

[StockRip @stockripx]

This guy's portfolio 🤯

[mono @monodev_eth]

@gami_vc Man's wildin

[Gami @gami_vc]

> how big is your portfolio?
> i’d say about 30cm or so

😂😂😂

[StockRip @stockripx]

We never grew out of collecting.
What we collect just evolved ⚡️

[mono @monodev_eth]

Went through the fix commits. One describes the device presenting an approval screen over zeroed data. https://t.co/y5oybF9LhH

[mono @monodev_eth]

Ledger quietly patched a rough one in the Ethereum app.

Your device shows a transaction to review. A website sends a second one mid-review. The screen keeps showing the first.

Your approve press signs the second.

Release note: "Security issues." That was it.

[mono @monodev_eth]

Pulled the registry record and the nine withdrawals myself: https://t.co/FWdhI0k6o9

[mono @monodev_eth]

Someone lost 810 ETH on Tornado Cash last week. About $2M.

The contracts were fine. They opened an old bookmark.

That web address lapsed while the project was sanctioned and somebody else picked it up. The clone sitting there kept their withdrawal secret.

[StockRip @stockripx]

that's my quant

[mono @monodev_eth]

The full mechanics, on-chain trace, and the audit lesson: https://t.co/6PTcL2opQO

[mono @monodev_eth]

A small BNB Chain protocol lost ~$119k on Friday.

Its bond contract priced a FOX mint off a PancakeSwap pool, then moved that pool's price in the same tx and paid on the old number.

91M FOX minted and dumped in one tx. No stolen keys, just a price trusted too long.

[mono @monodev_eth]

Maya Protocol lost $1.7M this week to six separate bugs.

Each one was small enough to pass an audit alone. One transaction chained them.

It minted 49M tokens into a pool nothing backed, then the attacker bought 99.93% of it and left with 20 BTC.

[mono @monodev_eth]

Wrote up the whole trace and how to price it safely: https://t.co/22neh4C77z

[Gami @gami_vc]

I'm staking my $RIP obviously 🫡

[mono @monodev_eth]

@gami_vc @stockripx RIP CONNNEEEECCCTTTTT