0xbankyOlympusDAO $300,000 exploit
Two days ago on October 21st 2022, OlympusDAO was drained of 30,437 OHM Tokens (about $300,000) due to an exploit in Bond Protocol. This exploit was surprisingly simple, but nonetheless was not caught during audit. I’ll be going over how the exploit was carried out along with a proof of concept here.BackgroundFirst a quick tl;dr of what bonding is. OlympusDAO uses this approach to generate capital. Essentially, users lock up their LP tokens in exchange for OHM tokens at a discounted rate. By ...
0xbankyEthernaut 14: Naught Coin
This is my solution for the 14th ethernaut challenge, Naught Coin https://ethernaut.openzeppelin.com/level/0x97E982a15FbB1C28F6B8ee971BEc15C78b3d263FInvestigationWe have a smart contract which inherits the ERC20 implementation from OpenZeppelinimport '@openzeppelin/contracts/token/ERC20/ERC20.sol'; contract NaughtCoin is ERC20 { // string public constant name = 'NaughtCoin'; // string public constant symbol = '0x0'; // uint public constant decimals = 18; uint public timeLock = now + 10 * 365 ...
0xbankyEthernaut 15: Preservation
The ethernaut rabbit hole continues. This is my solution for the 15th challenge: Preservation https://ethernaut.openzeppelin.com/level/0x97E982a15FbB1C28F6B8ee971BEc15C78b3d263FInvestigationWe have a contract that has some time zone library addresses defined. Each of these libraries can be used to set the storedTime value on the Preservation instance. The library code being used has also been highlighted at the bottomcontract Preservation { // public library contracts address public timeZone1...
Writing about security, MEV, privacy and decentralized finance
0xbankyOlympusDAO $300,000 exploit
Two days ago on October 21st 2022, OlympusDAO was drained of 30,437 OHM Tokens (about $300,000) due to an exploit in Bond Protocol. This exploit was surprisingly simple, but nonetheless was not caught during audit. I’ll be going over how the exploit was carried out along with a proof of concept here.BackgroundFirst a quick tl;dr of what bonding is. OlympusDAO uses this approach to generate capital. Essentially, users lock up their LP tokens in exchange for OHM tokens at a discounted rate. By ...
0xbankyEthernaut 14: Naught Coin
This is my solution for the 14th ethernaut challenge, Naught Coin https://ethernaut.openzeppelin.com/level/0x97E982a15FbB1C28F6B8ee971BEc15C78b3d263FInvestigationWe have a smart contract which inherits the ERC20 implementation from OpenZeppelinimport '@openzeppelin/contracts/token/ERC20/ERC20.sol'; contract NaughtCoin is ERC20 { // string public constant name = 'NaughtCoin'; // string public constant symbol = '0x0'; // uint public constant decimals = 18; uint public timeLock = now + 10 * 365 ...
0xbankyEthernaut 15: Preservation
The ethernaut rabbit hole continues. This is my solution for the 15th challenge: Preservation https://ethernaut.openzeppelin.com/level/0x97E982a15FbB1C28F6B8ee971BEc15C78b3d263FInvestigationWe have a contract that has some time zone library addresses defined. Each of these libraries can be used to set the storedTime value on the Preservation instance. The library code being used has also been highlighted at the bottomcontract Preservation { // public library contracts address public timeZone1...
Writing about security, MEV, privacy and decentralized finance
Subscribe to 0xbanky
Subscribe to 0xbanky
Share Dialog
Share Dialog
<100 subscribers
<100 subscribers
Simply include the -i / --interactive option to enter interactive mode. For example
$ forge script script/Deploy.s.sol --rpc-url <rpc_url> --broadcast --verify -vvvv --sender <wallet_address> -i 1
While running the script, you will now be prompted with a message similar to this
==========================
Chain 5
Estimated gas price: 3.00000002 gwei
Estimated total gas used for script: 3524127
Estimated amount required: 0.01057238107048254 ETH
==========================
###
Finding wallets for all the necessary addresses...
Enter private key:
As you can see, forge pauses before completing the deployment to ask for your private key. You can now check the estimated amount of ETH required for the transaction.
This is a life saver especially when deploying large contracts during periods of high on-chain activity where you may want to avoid accidentally spending a lot of money on transaction fees before you have a chance to agree to the estimate.
If you found this helpful, support my work by collecting an NFT of this piece!
Simply include the -i / --interactive option to enter interactive mode. For example
$ forge script script/Deploy.s.sol --rpc-url <rpc_url> --broadcast --verify -vvvv --sender <wallet_address> -i 1
While running the script, you will now be prompted with a message similar to this
==========================
Chain 5
Estimated gas price: 3.00000002 gwei
Estimated total gas used for script: 3524127
Estimated amount required: 0.01057238107048254 ETH
==========================
###
Finding wallets for all the necessary addresses...
Enter private key:
As you can see, forge pauses before completing the deployment to ask for your private key. You can now check the estimated amount of ETH required for the transaction.
This is a life saver especially when deploying large contracts during periods of high on-chain activity where you may want to avoid accidentally spending a lot of money on transaction fees before you have a chance to agree to the estimate.
If you found this helpful, support my work by collecting an NFT of this piece!
No activity yet