Programming Bao

Co-founder and programmer of @theramennft.
Blockchain Security Geek

[Programming Bao @ProgrammingBao]

Requesting $ETH funds from the #Stakely Faucet on the Ethereum Holesky Testnet blockchain. Request ID: OLCSKZUH https://t.co/0bJ280jBQj .

[Brian Roemmele @BrianRoemmele]

THANK YOU.

Your tolerance and support of me here on X by just interacting with my postings and subscribing if you care to here or my very long form at https://t.co/Ruqey26qLY helps pays for this.

I ain’t got no one else.

I love you folks.

Gratitude.

[Programming Bao @ProgrammingBao]

@mrsolana69 Gm

[code call @codecallapp]

🌐 Work from anywhere, anytime! 🏖️

CodeCall lets you choose projects, work remotely, and get paid for your contributions. One-click GitHub signup makes it a breeze! 🌬️💨 Join us today! 💪

#RemoteWork #Developers #TechTrends #DigitalNomad #CodingLife

[code call @codecallapp]

🚀 Hey Developers!

Join CodeCall—where skill meets opportunity. Work on impactful projects, earn rewards, gain XP, and climb the leaderboard to get noticed by top companies. One-click signup, no email needed!

🔗 Compete. Learn. Earn. #DevCommunity #Programming #Developer

[code call @codecallapp]

🚀 Code, Compete, Get Paid—It’s That Simple! 🚀

Earn more, get hired faster, and work on real projects with top businesses.

Join us and make your skills count. Launching in October!

#TechJobs #DevCommunity #TechCareers #Remotework #codinglife

[Programming Bao @ProgrammingBao]

Startup allowing devs to contribute code and get paid
Like bug bounties but for development
Launching soon with some MERN based projects with bounties ranging from €5,000 to €160,000
https://t.co/BaK8ifUxFo
https://t.co/ucBOJ9FQEc

[Slavcheww @Slavcheww]

These days, we've managed to uncover a Critical issue stemming from misunderstandings about who is the msg.sender in a nested Uniswap call, all thanks to
@TenderlyApp.

If you find yourself needing to debug a transaction with numerous nested functions in external contracts, Tenderly is definitely the tool for you.

[pashov @pashov]

If you are doing a smart contract security audit and see this

`require(token.balanceOf(address(this)) == ….`

You’ve most probably found an issue. Anyone who can get 1 wei worth of `token` can send it to the contract as a front-run attack, forcing the method call to revert

[pashov @pashov]

If you deploy smart contracts on multiple chains like Ethereum, Arbitrum, Polygon, Optimism and others you would greatly benefit from this resource.

GJ @juancito
https://t.co/J01oYX64rv

[pashov @pashov]

Special `try-catch` case from Solidity's docs:

If the return data decoding throws an error it is not caught by the `catch` block.

[pashov @pashov]

My learning technique has always been "just read 10 articles or watch 5 videos on the topic or more until you understand it"

You can go very far with just this, especially by remembering that whatever is hard for you is in most cases hard for others as well

[pashov @pashov]

In smart contracts, whenever you see ">" (or "<") check that it shouldn't actually be ">=" (or "<=") and vice versa.

Off-by-one errors are quite common and can result in a High severity vulnerability. Every experienced security researcher has caught such a bug at least once✌️

[pashov @pashov]

Your code might have a critical severity vulnerability, allowing an attacker to steal 100% of the TVL.

This is your daily reminder to check each division in your application (especially when it comes to pool/vault shares math) and make sure it rounds down/up AGAINST the user.

[pashov @pashov]

Common smart contract attack vector?

Flawed/missing input validation.

For every `external/public` method check that each of its parameters is sufficiently validated, for example that a `uint256` isn't too small or too big. By just doing this you'll find many bugs as an auditor

[pashov @pashov]

Good place to look for smart contract bugs - duplication of code and reimplementation of the same business logic.

Often in such code there can be discrepancies/differences, where one part of the code has an important check which is missing in the other. Possibly a Critical bug✌️

[pashov @pashov]

Exclusion from this rule is when the `payable` function actually forwards the `msg.value` directly to some recipient

[pashov @pashov]

First thing you MUST check when you see a smart contract that has a `payable` function is if the native asset can be withdrawn from it.

Imagine deploying a contract, accruing hundreds of ETH of value in it and not being able to withdraw them. Critical severity vulnerability

[pashov @pashov]

One of the best ways to learn about previous smart contract hacks, understand them in depth and read the code with which the attack can be executed?

Here it is, 10/10 resource
https://t.co/rbLYEHHbmI

[pashov @pashov]

If you are auditing a smart contract and see math calculations for the slippage parameter to be passed to a swap operation, it is highly likely this is a Medium/High severity issue.

Slippage parameters should only be calculated off-chain, because of possible sandwich attacks