Starknet v0.12 Quantum Leap 👉👈
Quantum Leap is a game-changer for Starknet, offering reported improvements that are seven times better than previous versions, with an initial estimated throughput of 40 TPS and a latency of 30 seconds. Furthermore, the Cairo syntax has recently undergone a facelift and received further enhancements. It is already available on the testnet and will soon be deployed on the mainnet in the upcoming weeks. In this article, we will explore some of the changes in the Cairo syntax. Let’s delve in.Ch...
Starknet v0.12 Quantum Leap 👉👈
Quantum Leap is a game-changer for Starknet, offering reported improvements that are seven times better than previous versions, with an initial estimated throughput of 40 TPS and a latency of 30 seconds. Furthermore, the Cairo syntax has recently undergone a facelift and received further enhancements. It is already available on the testnet and will soon be deployed on the mainnet in the upcoming weeks. In this article, we will explore some of the changes in the Cairo syntax. Let’s delve in.Ch...
Classifying Attacks against DeFi
This is based on the recent paper from Zhou, Xiang et al. When looking for vulnerabilities in DeFi projects, or creating best practices to prevent them, it is vital to have a classification of attacks, so that we both apply prevention in the correct place, and know when we have sufficient coverage of the threat vectors. Given finite resources we need to direct our efforts appropriately. The paper from Zhou et al gives us such a classification. They divide the area into 4 layers, plus services...
Classifying Attacks against DeFi
This is based on the recent paper from Zhou, Xiang et al. When looking for vulnerabilities in DeFi projects, or creating best practices to prevent them, it is vital to have a classification of attacks, so that we both apply prevention in the correct place, and know when we have sufficient coverage of the threat vectors. Given finite resources we need to direct our efforts appropriately. The paper from Zhou et al gives us such a classification. They divide the area into 4 layers, plus services...
Welcome our AI Audit Overlords
IntroductionThe recent introduction GPT-4 has prompted many claims about its value, in this article I want to look at how we can use such tools to assist in auditing smart contracts. I will focus on the Solidity language, and smart contracts written for DeFi applications, as this forms the majority of the auditing that we see.Current Process and ToolsImagine we are about to start an audit, we have some Code, maybe some documentation and perhaps some details from developers, how do we go about...
Welcome our AI Audit Overlords
IntroductionThe recent introduction GPT-4 has prompted many claims about its value, in this article I want to look at how we can use such tools to assist in auditing smart contracts. I will focus on the Solidity language, and smart contracts written for DeFi applications, as this forms the majority of the auditing that we see.Current Process and ToolsImagine we are about to start an audit, we have some Code, maybe some documentation and perhaps some details from developers, how do we go about...
Auditing Cairo 1.0 Contracts
A challenge we face when there has been a major upgrade or change to a language or protocol is to bootstrap the experience necessary to audit code in the new language. Although Cairo 1 is substantially different to Cairo 0, the problem is not as daunting as it might first appear, and we can do more than point out good practices and wait for vulnerabilities to come to light by being exploited. This article will therefore suggest an approach that can be used now when auditing Cairo 1 contracts....
Auditing Cairo 1.0 Contracts
A challenge we face when there has been a major upgrade or change to a language or protocol is to bootstrap the experience necessary to audit code in the new language. Although Cairo 1 is substantially different to Cairo 0, the problem is not as daunting as it might first appear, and we can do more than point out good practices and wait for vulnerabilities to come to light by being exploited. This article will therefore suggest an approach that can be used now when auditing Cairo 1 contracts....
Preparing for audit competitions
Smart contract audit competitions such as Sherlock or Code4rena can be lucrative, but they are increasingly competitive.Code4rena BountiesFinding a vulnerability and getting a prize can be difficult. In this article I will outline some strategies to help. This article is just a brief introduction to the area, to find out more check out or training below.Taxonomy of exploitsWe can categorise the types of exploits as followsGeneral software bugslogic errorsDOSSolidity / EVM specificRe entrancyU...
Preparing for audit competitions
Smart contract audit competitions such as Sherlock or Code4rena can be lucrative, but they are increasingly competitive.Code4rena BountiesFinding a vulnerability and getting a prize can be difficult. In this article I will outline some strategies to help. This article is just a brief introduction to the area, to find out more check out or training below.Taxonomy of exploitsWe can categorise the types of exploits as followsGeneral software bugslogic errorsDOSSolidity / EVM specificRe entrancyU...
