ScaleBit

Sub-brand of @0xbitslab. We're a Blockchain Security Team that Provides Proficient Audit Solutions for the Mass Adoption of Web3

[ScaleBit @scalebit_]

🛡️ Remediation

Qubic has ⚒️ fixed the Seed generation issue in wallet version v4.26.4. Further decisions on the recovery and disposition of the stolen funds will be made by the Computor quorum in accordance with network rules. ✅

[ScaleBit @scalebit_]

🚨 Security Alert: Qubic Wallet Incident Affects 1,404 Wallets

📆 On October 17–18, @_Qubic_ suffered a wallet security incident in which attackers drained 💸 approximately 2.94 trillion QU from 1,404 wallets within about 104 minutes.

Key Findings👇

[ScaleBit @scalebit_]

A Seed-generation flaw affected certain wallets, while the underlying blockchain protocol remained unaffected. Computors halted the network at Tick 85,371,949. About 87.1% of stolen funds were frozen on-chain; the remaining 12.9% went to MEXC, where related accounts were frozen.

[BitsLab @0xbitslab]

BitsLab AI is BitsLab's AI-powered smart contract security scanner. https://t.co/bH8I0NqESG

[BitsLab @0xbitslab]

How a Uniswap v4 Delta Settlement Flaw Led to a Loss of Funds？ https://t.co/ewwew4LKv1

[ScaleBit @scalebit_]

6/6 ScaleBit Security Insight 💡

A K-invariant check is useless if its math can overflow.

✅ AMM/DEX audits should test integer widths, casts, extreme reserves, invariant enforcement, router access, and fuzz testing.

#ScaleBit #EtherVista #DeFiSecurity #SmartContractAudit

[ScaleBit @scalebit_]

🔍 EtherVista Exploit: An Integer Overflow in an AMM’s K Check

On Oct 9, EtherVista reportedly lost 💸~$18.6K in WETH and VISTA. The issue was in EtherVistaPair.swap(): an overflow broke the constant-product check, letting invalid swaps drain liquidity.

Here's how it works🧵👇

[ScaleBit @scalebit_]

5/6 Why SafeMath Didn’t Help 💨

Elsewhere, EtherVista uses uint(reserve0).mul(reserve1), casting to uint256 before multiplying. But swap() uses reserve0 * reserve1 directly.

⏳ SafeMath in one code path doesn't protect another. Router access can't fix a broken invariant.

[ScaleBit @scalebit_]

8/8 | ScaleBit Security Insight

✍️ Cross-chain audits must test trust boundaries, access control and consistency from accounting to settlement.

ScaleBit, sub-brand of @0xbitslab , focuses on multichain smart contract security. ✊

[ScaleBit @scalebit_]

🚨How did $3.8M leave a cross-chain vault?

On Oct 1, @near_intents disclosed an exploit involving its Omni deposit/withdrawal system. An attacker withdrew 3.865M USDT from a BNB Chain vault in five transactions, each accepted with signed withdrawal proofs.

Here's how it works👇

[ScaleBit @scalebit_]

7/8 | Audit takeaway

🔦 Cross-chain smart contract audits must cover the full flow:

Deposit → Balance Accounting → Withdrawal Authorization → Settlement.

🥏 Test proof-to-balance consistency, nonce replay resistance and asset conservation across failures and edge cases.

[BitsLab @0xbitslab]

The Shift Toward Continuous Web3 Security. https://t.co/y3sQnrMzip