How to approach audit correctly?
Once i’ve started doing audits, it was a bit overwhelming for me to simply read the code, without any hesitation. I’ve believed there is some magic pill, system, framework, that would make from me LSR in one month. Unfortunately there is no magic pill, and most of the frameworks fit for the people individually. However, for the last 12 month i’ve constantly tried to re-adjust my audit approach, to see what work for me best, and i highly encourage you to do the same. See, where do you have the...
How to approach audit correctly?
Once i’ve started doing audits, it was a bit overwhelming for me to simply read the code, without any hesitation. I’ve believed there is some magic pill, system, framework, that would make from me LSR in one month. Unfortunately there is no magic pill, and most of the frameworks fit for the people individually. However, for the last 12 month i’ve constantly tried to re-adjust my audit approach, to see what work for me best, and i highly encourage you to do the same. See, where do you have the...
Web3 Security. Notes
Web3 Security, as any other field require determination and patience. Success isn’t built on the motivation, but on the hard work. Every day we enter the battlefield, where we need to fight against others and most importantly, ourselves. I made some notes, which i believe would be helpful.Part #1 - The Fighting AttitudePeople tend to overestimate their skills. We always think we ‘can’, we ‘can do it’, we ‘can manage it’, even if it above our professionalism . Very often this leads to taking o...
Web3 Security. Notes
Web3 Security, as any other field require determination and patience. Success isn’t built on the motivation, but on the hard work. Every day we enter the battlefield, where we need to fight against others and most importantly, ourselves. I made some notes, which i believe would be helpful.Part #1 - The Fighting AttitudePeople tend to overestimate their skills. We always think we ‘can’, we ‘can do it’, we ‘can manage it’, even if it above our professionalism . Very often this leads to taking o...
AnySwap permit exploit
Let’s take a look on very interesting vulnerability that actually happened quite a while, but the quality is still astonishing till our days.Part #1 - Vulnerable functionFirst and foremost goal of the “AnySwap“ was to allow users to swap between any two chains freely. It reduces fees and makes it easier to move between chains. It worked in such way: The router accomplishes this by wrapping the original token with an "anyToken." For instance, DAI is wrapped as anyDAI, making DAI the underlying...
AnySwap permit exploit
Let’s take a look on very interesting vulnerability that actually happened quite a while, but the quality is still astonishing till our days.Part #1 - Vulnerable functionFirst and foremost goal of the “AnySwap“ was to allow users to swap between any two chains freely. It reduces fees and makes it easier to move between chains. It worked in such way: The router accomplishes this by wrapping the original token with an "anyToken." For instance, DAI is wrapped as anyDAI, making DAI the underlying...
MonoX 31 Million Exploit
The root cause of the exploit was that during the swapExactTokenForToken attacker inputed the tokenIn and tokenOut as the same tokens. The main purpose of this function is to deposits MONO(*token that plays crucial role during the exploit) tokens into the pool.Let’s move forward into the swapIn function. The main thing to concentrate here, is prices. And where do the prices are calculated? Right, in the getAmountOut.Following the getAmountOut function, we discovered that the _getNewPrice func...
MonoX 31 Million Exploit
The root cause of the exploit was that during the swapExactTokenForToken attacker inputed the tokenIn and tokenOut as the same tokens. The main purpose of this function is to deposits MONO(*token that plays crucial role during the exploit) tokens into the pool.Let’s move forward into the swapIn function. The main thing to concentrate here, is prices. And where do the prices are calculated? Right, in the getAmountOut.Following the getAmountOut function, we discovered that the _getNewPrice func...
Return-bomb attack
Resources used:What is returnBombWhat is the memory expansion cost?Return Bomb ExampleExcessive Safe CallLet’s dive into the Ethereum Yelow Paper for a moment, so it would be easier to understand the details of the return bomb attack.Part #1 - Memory Expansion CostThe formula calculates the extra gas required by a contract's memory consumption Where:a - This represents the highest memory index (denoted in 32-byte words) that your contract call writes to. If your contract writes to memory...
Return-bomb attack
Resources used:What is returnBombWhat is the memory expansion cost?Return Bomb ExampleExcessive Safe CallLet’s dive into the Ethereum Yelow Paper for a moment, so it would be easier to understand the details of the return bomb attack.Part #1 - Memory Expansion CostThe formula calculates the extra gas required by a contract's memory consumption Where:a - This represents the highest memory index (denoted in 32-byte words) that your contract call writes to. If your contract writes to memory...
