s4bot3ur

web3 security researcher @teambi0s

[s4bot3ur @s4bot3ur]

@SolidityScan Post-EIP-7702, EOAs can have code.

Attack:
Deploy contract with receive() that re-calls withdrawAll() if victim contract has balance more than deposited balance.
Delegate EOA logic to above contract
Deposit + call withdrawAll()
On ETH send, receive() reenters and drains contract

[s4bot3ur @s4bot3ur]

@KannAudits Applied

[s4bot3ur @s4bot3ur]

I took part in the @sukukfi audit on @code4rena and ended up #4 overall. Found 1 High and 2 Medium issues. Learned a lot auditing real-world contracts.

#Web3Security #Code4rena #SmartContractAudit

[dualguard @dualguardaudits]

$492.43 USDT » 🏅 @Sa1ntRobi
$456.01 USDT » 🏅 @0xnightswatch
$422.27 USDT » 🏅 @teoslaf1
$369.70 USDT » 🏅 @Astaraudit
$336.75 USDT » 🏅 @s4bot3ur
$327.34 USDT » 🏅 @0xTimefliez
$325.06 USDT » 🏅 @0xtadev
$318.05 USDT » 🏅 @bbl4de_xyz
$300.50 USDT » 🏅 @kvarxyz
$293.33 USDT » 🏅 @Aasif1552
$287.07 USDT » 🏅 @0xharrywang
$273.84 USDT » 🏅 @OxNoblee
$264.60 USDT » 🏅 @SOPROBRO_
$252.29 USDT » 🏅 @0xrochimaru
$250.96 USDT » 🏅 0xnija_43331
$233.79 USDT » 🏅 @0x15_eth
$229.40 USDT » 🏅 @LuxLode
$226.03 USDT » 🏅 @OsueniElizabeth
$211.28 USDT » 🏅 @0xSilvermist
$208.13 USDT » 🏅 @0xTonraq
$204.73 USDT » 🏅 @_0xR4Y
$203.99 USDT » 🏅 Amr
$152.68 USDT » 🏅 @Yaioxy
$142.96 USDT » 🏅 @0xSlowbug
$137.74 USDT (+$ 6000 USDT)» 🏅💂 @0xsorrynotsorry

[s4bot3ur @s4bot3ur]

Day 44/365

Worked on Alignerz bounty

TimeSpent: 2 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 43/365

Worked on Alignerz bounty

TimeSpent: 6 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 42/365

Creating challenges for bsides Dehradun ctf.

TimeSpent: 2 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 41/365

Escalated issues which i have earlier submitted on dualguard. Made POCs for those issues.

Time Spent: 2 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 40/365

Didn’t work much today and spent around 2 hours on panoptic contest.

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 39/365

Didn’t work much today and spent around 2 hours.

One of my issues from a previous contest was downgraded from High to Low, which felt a bit discouraging.

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 38/365

Read the documentation and watched Panoptic Vault videos.
Started looking into the codebase. Spent more time than expected on videos about the protocol and how options work.

Time spent: 7 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 37/365

Read the documentation and watched videos on the Panoptic Vault.
The math behind it is incredible.

Time spent: 5 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 36/365

Learned about invariant testing and fuzzing with Echidna today.

Time spent: 6 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 35/365

Learned how Uniswap V3 fees work.
Reviewed a bug I had missed earlier in a contest related to account abstraction wallets.

Time spent: 7 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 34/365

Didn’t work much today.
Revised the Uniswap V3 swap function.

I’m trying to push myself to work more, but it’s hard.
I usually feel highly motivated during audits, but while learning, I don’t feel the same level of interest.

Time Spent: 1 hour

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 33/365

Didn't work much today. Revised uniswapv3 swap function.

Time Spent: 1 hour

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 32/365

Preparing for the Panoptic Vault audit.
Spent some time revising Uniswap V3 as part of it.
Time spent: 2 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 31/365

Worked on monolith audit.

Time spent: 8 hours 30 mins

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 30/365

Played nite ctf, solved 3 web3 challs. Worked on monolith audit.

Time spent: 8 hours

#365DaysChallenge

[s4bot3ur @s4bot3ur]

Day 29/365

Worked on monolith audit contest and playing a ctf

Time spent: 8 hours

#365DaysChallenge