I'd like to level up my reverse engineering and EVM skills and what's better than learning by doing... 🤓Anyone knows any interesting or intriguing MEV bots worth reverse engineering? 🤖🔍 Lmk!
See y'all there folks! 🫡
Announcing the DeFi Security Summit 2023 in Paris, France!
We're back with two full days of programming with top leaders & researchers in the DeFi security space, directly preceding @EthCC.
Learn more: defisecuritysummit.org/
What you can expect 🧵👇
The subtle, yet very important difference between EVM compatibility and EVM equivalence.. I'd reckon we will see these kind of vulnerabilities more and more in the future unfortunately..
Damn my head exploded doing all those bit shifting 🤯In the end, took a slightly different approach to solve the @curta_ctf CTF 😀 Thanks for the challenge @fiveoutofnine !
Let's level up our EVM skills! Actually took the #huff pill after watching @devtooligan 's awesome introduction video on Huff 💊
First attempt: A simplified version of Pausable ⏸️
Don't be too harsh on me guys 😂
Implementation finished! github.com/Zarfsec/huffmate/…
Expect a blogpost soon on my first experience with Huff! 🐴
Would be nice if there's an app which shows you some interesting @code4rena & @sherlockdefi statistics like the amount of contests a user participated in, amount and type of findings, payouts, ... A web3 auditor portfolio so to speak 👌🏽
Huge pot of 720k led by the 2 OG auditors @trust__90 and @zachobront 😵
You shouldn’t miss this one, anon.
🚨 New Contest!! 🚨
Optimism (✨🔴_🔴✨) @optimismFND
Sign up here: app.sherlock.xyz/audits/cont…
Total Rewards: $700,000 (maximum pot)
Lead Senior Watsons: @zachobront @trust__90
Starts Monday, January 23rd at 15:00 UTC
Check it out!!
As from Solidity 0.8.18 it will be possible to create user-defined operators for user-defined value types. This means well known unary (e.g. !, -) and binary operators (e.g. +, -, ==, !=) may be overridden by user-defined functions and act differently than you’d expect!
⬇️
Interested in testing new Solidity features before they are released? 🧑🔬🧪 Now's your chance to check out user-defined operators & let us know what you think! You can find the dev binaries + a detailed description of how the feature works in the forum. ⬇️
forum.soliditylang.org/t/fea…
![[feature preview] User-defined operators](https://pbs.twimg.com/card_img/2117559985634775040/0sMBsvPP?format=png&name=420x420_2)
1/
Ensure the operator is overridden by a functions which conforms to the semantics of this operator. E.g:
• ‘==’ should check whether variables of the custom type are the same and not check whether they are different).
• '+' should perform addition instead of subtraction.
I’m quite sure formal verification is the next step in web3 audit contests.
An audit only verifies a snapshot of the code, while a set of properly written rules can be verified upon each change in the code.
I've been playing with @certora’s prover and it really blew my mind!
Code4rena has partnered up with @certora to run our 1st formal verification competition for @blockswap_team 🤝 We’re excited to see cutting-edge smart contracts be formally verified with some of the most exciting tools available.
For more info, visit: rebrand.ly/C4-blockswap-cert…
My EVMavericks NFT came to life 😮🦁
@EVMavericks was born in r/ethfinance with the goal of advancing the decentralized Ethereum web3 ecosystem by providing funding, developing, and promoting public goods and education.
Thanks @EVMaverick392 for the dope artwork!
Getting up in the morning, drinking coffee and remixing EVMavericks with #midjourney is nothing short of amazing. Here's my first creation for the day!
"EVM 509"
#AIart #cryptoart #ethereum
Lesson I learned: The challenge should successfully compile before posting it here 🙈 Thanks all for pointing out the contract should’ve implement ERC721Enumerable and include SafeMath in order to fix the totalSupply() and add() functions!
Now to the actual risk/vulnerability: 👇🏽
This code is available in UUPSUpgradeable.sol by calling upgradeTo() or upgradeToAndCall(). Notice both functions are calling _authorizeUpgrade(), which is not yet implemented. The implementation contract should implement this function with the proper modifier (e.g. onlyOwner)
If _authorizeUpgrade() is not implemented in the implementation contract, there is no way of changing the implementation’s address stored in the proxy’s storage space. Therefore, the UUPS Proxy is actually not upgradeable!
Kudos to @nobody20185 @WTllew for the correct answer!