0xshoaib

Smart Contract Security Researcher
Auditing protocols. Hunting vulnerabilities.
DeFi • EVM • Web3
Securing the decentralized future.

[0xshoaib @shoaibscsr]

@_AlexBiryukov_ @DeFiHackLabs Thank you! 🙏

It's very helpful for me and other beginner auditors

[sanbir | .eth .sol .ton .lens @_AlexBiryukov_]

If you audit smart contracts, you already know @DeFiHackLabs. It's the most complete open library of exploit PoCs there is, and SunWeb3Sec has done the whole industry a service by maintaining it.

But a PoC is a starting point, not an explanation. To actually learn from one you have to:
➡ get the Foundry test compiling (solc version, EVM version, remappings)

➡ source an archive RPC for the correct chain and fork at the exact block

➡ reconstruct the attack from raw trace output

➡ cross-reference the trace against the test's Solidity

➡ pull the source of every downstream contract from Etherscan - the PoC ships the attacker's code, not the victim's.

We built https://t.co/vP9Yq3H6ca to collapse that into one page.

What you get per hack:
✅ Pre-written vulnerability analysis, with the root-cause line highlighted directly in the source.

✅ A live EVM playground (think in-browser debugger) that replays the exploit deterministically.

✅ Opcode-level stepping plus line-level Next / Prev / Step-in / Step-out; click an opcode to jump to its source line.

✅ Full call trace (execution tree) so you can see exactly what called what.

✅ EVM state at every step: memory, stack, and storage.

✅ Matched source for every executing contract in the call tree - fetched from Etherscan, compiled, and source-mapped, so you never leave the page.

✅ Any chain, no RPC needed - the execution is recorded, so there's nothing to set up and nothing to rot: no rate limits, no stale fork blocks, no version drift.

The analysis + build pipeline is fully open source: https://t.co/SrCRX81rNJ - issues and PRs welcome.
Explore 840+ hacks 👉 https://t.co/VeFfnrWdK7

#SmartContractAudit #Web3Security #DeFi #Solidity #EVM #Foundry #Blockchain

[Shieldify Security @ShieldifySec]

Web3 Security🫡

[0xshoaib @shoaibscsr]

@Shabaz1406 Wishing Success, Health, Happiness! ✨

[0xshoaib @shoaibscsr]

@immunefi count me in 🙌🏻

[0xshoaib @shoaibscsr]

@immunefi 🏖️ 💻

[0xshoaib @shoaibscsr]

@SuiInsiders I'm Interested

[0xshoaib @shoaibscsr]

@ValvesSec This is insanely helpful 🔥

[0xshoaib @shoaibscsr]

@OpenledgerHQ Okay 👍😁

[0xshoaib @shoaibscsr]

@ajsinghrawat Cognizant

[0xshoaib @shoaibscsr]

@pashov Count me in 🙌

[0xshoaib @shoaibscsr]

@BnBTianWeb3 I'm Interested

[0xshoaib @shoaibscsr]

@cryptocupra I'm Interested

[0xshoaib @shoaibscsr]

@SorcererTrading hello

[0xshoaib @shoaibscsr]

@fireplacegg Iterested in blockchain engineer role

[0xshoaib @shoaibscsr]

@KannAudits Applied!

[0xshoaib @shoaibscsr]

@VittoStack AI

[0xshoaib @shoaibscsr]

@arsen_bt Security

[Dom Bei @Beiwatch]

Bitcoin is coming to eat your currency like PAC Man

[0xshoaib @shoaibscsr]

@HackenProof Reentrancy Attack in `claimReward( )` function, where ETH is sent to `msg.sender` before resetting their rewards balance.
This bug can be avoided by applying CEI pattern in function or using openzeppelin's `nonReentrant` modifier.