Security research. MEV consulting. Crypto nerd. Formerly: Flashbots, OpenZeppelin, Augur, OpenBazaar.
Fun with Footguns in BoringSolidity
I came across a fun footgun in the BoringSolidity contracts library and wanted to share it so future devs (and their users) don’t lose a foot. It is closely related to the vuln that samczsun found in the MISO fundraise. Here it is in a single line:contract ThisCanBeDrainedOfETH is BoringBatchable, BoringFactory {} That is to say, any contract that inherits both BoringBatchable and BoringFactory can be drained of all ETH by anyone. We’ll discuss below how it works, but if you want to try to fi...
Fun with Footguns in BoringSolidity
I came across a fun footgun in the BoringSolidity contracts library and wanted to share it so future devs (and their users) don’t lose a foot. It is closely related to the vuln that samczsun found in the MISO fundraise. Here it is in a single line:contract ThisCanBeDrainedOfETH is BoringBatchable, BoringFactory {} That is to say, any contract that inherits both BoringBatchable and BoringFactory can be drained of all ETH by anyone. We’ll discuss below how it works, but if you want to try to fi...
Principal Freezing and Ransom Attacks with MasterChefV2
One of the services I've been offering for the past several months is quick (less than 2hr) security checks of yield farming pools. I look for rug-pull potential and security risks in yield farming contracts to help protect would-be farmers and LPs. I basically try to spot trouble with farms before a user puts their funds at risk. As you you might imagine, I've seen countless forks of MasterChef -- both its original incarnation and its official second version, MasterChefV2. I'v...
Principal Freezing and Ransom Attacks with MasterChefV2
One of the services I've been offering for the past several months is quick (less than 2hr) security checks of yield farming pools. I look for rug-pull potential and security risks in yield farming contracts to help protect would-be farmers and LPs. I basically try to spot trouble with farms before a user puts their funds at risk. As you you might imagine, I've seen countless forks of MasterChef -- both its original incarnation and its official second version, MasterChefV2. I'v...
