Decoding DeFi Perpetuals: From Basics to Advanced
These days I’m into auditing DeFi perpetuals, and that requires me understanding how the overall system works if I’m to find unique, business logic bugs. One of the best ways to learn something is to talk about it, share and teach one’s knowledge. I plan to share what I understand from perpetuals, from basics to advanced. This is the first part of a series, expect more to come.In order to understand perpetuals, it might be the best to go back to futures contracts briefly, as perpetuals are pr...
Decoding DeFi Perpetuals: From Basics to Advanced
These days I’m into auditing DeFi perpetuals, and that requires me understanding how the overall system works if I’m to find unique, business logic bugs. One of the best ways to learn something is to talk about it, share and teach one’s knowledge. I plan to share what I understand from perpetuals, from basics to advanced. This is the first part of a series, expect more to come.In order to understand perpetuals, it might be the best to go back to futures contracts briefly, as perpetuals are pr...
Easy to spot bugs: USDC/USDT blacklisting
Here’s a bug that’s hiding in plain sight... (and it can break your whole protocol) Security researchers know: It’s not just the logic inside the smart contract. It’s also how tokens behave in the real world. Take this real-world scenario: You’re using USDC in an auction contract. When a user is outbid, the funds are returned. But what if... A malicious user gets themselves blacklisted by USDC? Now the contract can’t send their USDC back. Which means it can’t process new bids. Which means... ...
Easy to spot bugs: USDC/USDT blacklisting
Here’s a bug that’s hiding in plain sight... (and it can break your whole protocol) Security researchers know: It’s not just the logic inside the smart contract. It’s also how tokens behave in the real world. Take this real-world scenario: You’re using USDC in an auction contract. When a user is outbid, the funds are returned. But what if... A malicious user gets themselves blacklisted by USDC? Now the contract can’t send their USDC back. Which means it can’t process new bids. Which means... ...
Huff simple storage rewritten
This post is for those who dig deeper in Huff language, but found the simple storage tutorial in official docs difficult to grasp. I’ve rewritten it with further explanations. I couldn’t commit a PR since there are no active maintainers of the Huff repo, so I deployed my own => https://huff-docs.vercel.app/tutorial/simple-storage/#storage-in-huff You can read it from the link above. Huff will help you understand EVM further. Dig in!
Huff simple storage rewritten
This post is for those who dig deeper in Huff language, but found the simple storage tutorial in official docs difficult to grasp. I’ve rewritten it with further explanations. I couldn’t commit a PR since there are no active maintainers of the Huff repo, so I deployed my own => https://huff-docs.vercel.app/tutorial/simple-storage/#storage-in-huff You can read it from the link above. Huff will help you understand EVM further. Dig in!
I missed a bug.
Anyone can call VVVVCTokenDistribution::claim function by utilizing ClaimParams signed by the signer Let's get simple. First principles, right? The protocol or the codebase is not that important at this point, it is difficult to understand the nature of the bug when it's so much entangled with the protocol, so, I'll try to strip it down from the whole codebase, show it in its barenaked form as much as I can. ## The shallow waters If I ever have children, there will be a strong ...
I missed a bug.
Anyone can call VVVVCTokenDistribution::claim function by utilizing ClaimParams signed by the signer Let's get simple. First principles, right? The protocol or the codebase is not that important at this point, it is difficult to understand the nature of the bug when it's so much entangled with the protocol, so, I'll try to strip it down from the whole codebase, show it in its barenaked form as much as I can. ## The shallow waters If I ever have children, there will be a strong ...
