Alan Lai

Solidity developer & auditor

[Franco Victorio @fvictorio_nan]

I've been working on something: Slippy, a modern and flexible linter for Solidity.

https://t.co/lSUkHh6v9E

[zerosnacks.eth @zerosnacks]

Foundry has a new release candidate: v1.4.0-rc3!

Highlights include: backtraces, configuration inheritance & multi-chain configuration, forge fmt powered by Solar🌞, enhanced coverage guided fuzzing, custom precompiles & many performance improvements!

$ foundryup -i v1.4.0-rc3

[Zhuo Zhang @i2huer]

1/10

@troublor says wait, but I can't. Can't wait.

We are builting an Ethereum debugger with

1) true source-level stepping,
2) near-100% local/state variable inspection, and
3) on-the-fly Solidity expression eval at any step.

Screenshots below; details in the thread.

[Vladimir S. | Officer's Notes @officer_secret]

Reminder guys: now with PECTRA ethereum upgrade, you only need to sign a message to get completely drained! Before, you actually had to sign the TX.

Be very careful of what you sign now - even an offchain message!

[OpenZeppelin @OpenZeppelin]

https://t.co/ICYseKXmoG

[Andrej Karpathy @karpathy]

We have to take the LLMs to school.

When you open any textbook, you'll see three major types of information:

1. Background information / exposition. The meat of the textbook that explains concepts. As you attend over it, your brain is training on that data. This is equivalent to pretraining, where the model is reading the internet and accumulating background knowledge.

2. Worked problems with solutions. These are concrete examples of how an expert solves problems. They are demonstrations to be imitated. This is equivalent to supervised finetuning, where the model is finetuning on "ideal responses" for an Assistant, written by humans.

3. Practice problems. These are prompts to the student, usually without the solution, but always with the final answer. There are usually many, many of these at the end of each chapter. They are prompting the student to learn by trial & error - they have to try a bunch of stuff to get to the right answer. This is equivalent to reinforcement learning.

We've subjected LLMs to a ton of 1 and 2, but 3 is a nascent, emerging frontier. When we're creating datasets for LLMs, it's no different from writing textbooks for them, with these 3 types of data. They have to read, and they have to practice.

[Alan Lai @wp__lai]

@mrmatrixx77 @milotruck The second one follows the ABI-encoding rules, thus abi.encode would not revert.

[Andrej Karpathy @karpathy]

Nice post on software engineering.
"Cognitive load is what matters"
https://t.co/eMgxu0YgWw
Probably the most true, least practiced viewpoint.

[tincho 🪷 @tinchoabbate]

Dear players of Damn Vulnerable DeFi, rumours are true.

The most vulnerable smart contracts in all web3 have been upgraded. V4 is out! 🔥

This is a major update to the game, packed with new challenges and improvements all around.

https://t.co/i1ePdfnpHN

[Alan Lai @wp__lai]

@zdravkohristov0 return in assembly causes the transaction to end prematurely

[Alan Lai @wp__lai]

@zdravkohristov0 The data are not swapped. A new reference is bound to the targetNumber variable.

[Alan Lai @wp__lai]

@makemake_kbo how did you even remember the preimage😂

[Alan Lai @wp__lai]

@joshmedeski wait, what, how?!

[Alan Lai @wp__lai]

@YQ996CO28254695 @onlypwner @3DOCsec Congratulations on securing the first blood.

[Trail of Bits @trailofbits]

Today we’re releasing weAudit, the VSCode extension we use during secure code reviews to collaboratively take notes and highlight code regions. https://t.co/e0ZnmknQjU

[Alan Lai @wp__lai]

@i2huer @mestevez No, I couldn't track it down.

[Alan Lai @wp__lai]

@i2huer @mestevez Yes, the approved transactions are not necessary. I think the original design may aim to display the correct signatures in those approved transactions.

[Alan Lai @wp__lai]

@i2huer @mestevez However, as the hint suggested, "think outside the box, everything you need is onchain":

1.https://t.co/290AxQOvBZ
2. https://t.co/tMc6jalsS2

[Alan Lai @wp__lai]

@i2huer @mestevez I obtained two vanity addresses by tracking the Approval events. These addresses were likely generated by the vulnerable Profanity tool, making their private key crackable. The CTF server concealed the real signature necessary for computing the public key.