New blog post is up:
How Ethereum Address Derivation Works (Wallets, CREATE, and CREATE2).
The formulas for address derivation are simple, yet this article clocks in at over 4,000 words.
It's not just about the formulas to derive addresses -- it's about what goes into the formula that requires some depth of understanding.
Among other things, we cover:
- a brief tutorial on RLP encoding (needed for understanding EOA addresses and CREATE)
- how EIP-161 affects address prediction in EOAs vs contracts deployed with CREATE
- how EIP-2681 informs our understanding of why EIP-1014 (Create2) injects a 0xff into the address derivation
- how to deploy two mutually dependent contracts without a factory or setter function
Get ready to learn a lot!
Link in the reply.
Let's be real. Who should decide what is out of scope for a project?
The Dev team or the Audit team? Do they always do this with an attacker's perspective in view?
Zero Cool achieved yet another top 10 finish on the Sequence contest hosted by Code4rena (๐ซก RIP).
Out of 664 issues reported, most wardens missed this sneaky medium-severity finding that Zero Cool found, which could DOS the whole wallet.
This vulnerability stems from a subtle misuse of Solidityโs call semantics, where an external self-call inside a critical function (validateUserOp()) silently breaks the walletโs core auth model.
Full write-up coming tomorrow!