Web3 Cybersecurity Academy
Web3 Cybersecurity Academy
Subscribe to SunWeb3Sec
Subscribe to SunWeb3Sec
Share Dialog
Share Dialog
<100 subscribers
<100 subscribers
Author: Sun
Translation: Helen
Community Discord
This article is published on XREX and WTF Academy
On-chain data can include simple one-time transfers, interactions with one DeFi contract or multiple DeFi contracts, flash loan arbitrage, governance proposals, cross-chain transactions, and more. In this section, let’s begin with a simple start. I will introduce on BlockChain Explorer - Etherscan what we are interested in, and then use Phalcon to compare the differences between these transaction function calls: Assets transfer, swap on UniSWAP, increase liquidity on Curve 3pool, Compound proposals, Uniswap Flashswap.
The first step is to install Foundry in the environment. Please follow the installation instructions.
Forge is a Major test tool on the Foundry platform.If it is your first time to use Foundry, you can refer to Foundry book, Foundry @EthCC, WTF Solidity - Foundry.
Each chain has its own blockchain explorer. In this section, we will use Ethereum's blockchain network as a case study.
Typical information I usually refer to includes:
Transaction Action: Since the transfer of complex ERC-20 tokens can be difficult to discern, Transaction Action can provide the key behavior of the transfer. However, not all transactions include this information.
From: msg.sender, the source wallet address that executes this transaction.
Interacted With (To): Which contract to interact with
ERC-20 Token Transfer: Token Transfer Process
Input Data: The raw input data of the transaction. You can see what Function was called and what Value was brought in.
If you don't know what tools are commonly used, you can view the transaction analysis tools in the first lesson.
From: This transaction's source EOA wallet address
Interacted With (To): Tether USD (USDT) Contract
ERC-20 Tokens Transferred: Transfer 651.13 USDT from user A's wallet to user B
Input Data: Called transfer function
According to Phalcon "Invocation Flow" :
There is only one ''Call USDT.transfer''. However, you should pay attention to the "Value".Because the Ethereum Virtual Machine (EVM) does not support floating-point operations, decimals representation is used instead.
Each token has its own precision, the number of decimal places used to represent the value of the token. In ERC-20 tokens, the decimals are usually 18 digits, while USDT has 6 digits. If the precision of the token is not handled properly, problems will arise.
You can query it on the Etherscan token contract.
The following can be derived from the Etherscan example above:
Transaction Action: A user performs Swap on Uniswap V2, exchanging 12,716 USDT for 7,118 UNDEAD.
From: This transaction's source wallet address
Interacted With (To): A MEV Bot contract called Uniswap contract for Swap.
ERC-20 Tokens Transferred: Token exchange process
According to Phalcon "Invocation Flow" :
MEV Bot calls the Uniswap V2 USDT/UNDEAD trading pair contract to call the swap function to perform token exchange.
We use Foundry to simulate the operation of using 1BTC to exchange for DAI in Uniswap.
Sample code reference, execute the following command:
forge test --contracts ./src/test/Uniswapv2.sol -vvvv
According to the figure - we swap 1 BTC to 16,788 DAI by calling the Uniswap_v2_router.swapExactTokensForTokens function.
The following can be derived from the Etherscan example above:
The purpose of this transaction is to add Liquidity at Curve three pools.
From: This transaction's source wallet address
Interacted With (To): Curve.fi: DAI/USDC/USDT Pool
ERC-20 Tokens Transferred: User A transferred 3,524,968.44 USDT to the Curve 3 pools, and then Curve minted 3,447,897.54 3Crv tokens for User A.
According to Phalcon "Invocation Flow" :
Based on the call sequence, three steps were executed: 1.add_liquidity 2.transferFrom 3.mint.
The following can be derived from the Etherscan example above:
The user submitted a proposal on the Compound. The contents of the proposal can be viewed by clicking "Decode Input Data" on Etherscan.
According to Phalcon "Invocation Flow" :
Submitting a proposal through the propose function results in proposal number 44.
Here we use Foundry to simulate operations - how to use flash loans on Uniswap. Official Flash swap introduction
Sample Code Reference, execute the following command:
forge test --contracts ./src/test/Uniswapv2_flashswap.sol -vv
In this example, a flash loan of 100 WETH is borrowed through the Uniswap UNI/WETH exchange. Note that a 0.3% fee must be paid on repayments.
According to the figure - call flow, flashswap calls swap, and then repays by calling back uniswapV2Call.
Further Introduction to Flashloan and Flashswap:
A. Common points: Both can lend Tokens without collateralizing assets, and they need to be returned in the same block, otherwise the transaction fails.
B. The difference: If token0 is borrowed through Flashloan token0/token1, token0 must be returned. Flashswap lends token0, and you can return token0 or token1, which is more flexible.
For more DeFi basic operations, please refer to DeFiLab.
Foundry's cheatcodes are essential for conducting chain analysis. Here, I will introduce some commonly used functions. More information can be found in the Cheatcodes Reference.
createSelectFork: Specifies a network and block height to copy for testing. Must include the RPC for each chain in foundry.toml.
deal: Sets the balance of a test wallet.
Set ETH balance: deal(address(this), 3 ether);
Set Token balance: deal(address(USDC), address(this), 1 * 1e18);
prank: Specify the wallet address to simulate. It is only effective for the next call and will set the msg.sender to the specified wallet address. Such as simulating a transfer from a whale wallet.
startPrank: Specify the wallet address to simulate. It will set the msg.sender to the specified wallet address for all calls until stopPrank() is executed.
label: Labels a wallet address for improved readability when using Foundry debug.
roll: Adjusts the block height.
warp: Adjusts the block timestamp.
Thanks for following along! Time to jump into the next lesson.
https://github.com/crisgarner/awesome-foundry
https://blog.infura.io/post/build-a-flash-loan-arbitrage-bot-on-infura-part-i
Author: Sun
Translation: Helen
Community Discord
This article is published on XREX and WTF Academy
On-chain data can include simple one-time transfers, interactions with one DeFi contract or multiple DeFi contracts, flash loan arbitrage, governance proposals, cross-chain transactions, and more. In this section, let’s begin with a simple start. I will introduce on BlockChain Explorer - Etherscan what we are interested in, and then use Phalcon to compare the differences between these transaction function calls: Assets transfer, swap on UniSWAP, increase liquidity on Curve 3pool, Compound proposals, Uniswap Flashswap.
The first step is to install Foundry in the environment. Please follow the installation instructions.
Forge is a Major test tool on the Foundry platform.If it is your first time to use Foundry, you can refer to Foundry book, Foundry @EthCC, WTF Solidity - Foundry.
Each chain has its own blockchain explorer. In this section, we will use Ethereum's blockchain network as a case study.
Typical information I usually refer to includes:
Transaction Action: Since the transfer of complex ERC-20 tokens can be difficult to discern, Transaction Action can provide the key behavior of the transfer. However, not all transactions include this information.
From: msg.sender, the source wallet address that executes this transaction.
Interacted With (To): Which contract to interact with
ERC-20 Token Transfer: Token Transfer Process
Input Data: The raw input data of the transaction. You can see what Function was called and what Value was brought in.
If you don't know what tools are commonly used, you can view the transaction analysis tools in the first lesson.
From: This transaction's source EOA wallet address
Interacted With (To): Tether USD (USDT) Contract
ERC-20 Tokens Transferred: Transfer 651.13 USDT from user A's wallet to user B
Input Data: Called transfer function
According to Phalcon "Invocation Flow" :
There is only one ''Call USDT.transfer''. However, you should pay attention to the "Value".Because the Ethereum Virtual Machine (EVM) does not support floating-point operations, decimals representation is used instead.
Each token has its own precision, the number of decimal places used to represent the value of the token. In ERC-20 tokens, the decimals are usually 18 digits, while USDT has 6 digits. If the precision of the token is not handled properly, problems will arise.
You can query it on the Etherscan token contract.
The following can be derived from the Etherscan example above:
Transaction Action: A user performs Swap on Uniswap V2, exchanging 12,716 USDT for 7,118 UNDEAD.
From: This transaction's source wallet address
Interacted With (To): A MEV Bot contract called Uniswap contract for Swap.
ERC-20 Tokens Transferred: Token exchange process
According to Phalcon "Invocation Flow" :
MEV Bot calls the Uniswap V2 USDT/UNDEAD trading pair contract to call the swap function to perform token exchange.
We use Foundry to simulate the operation of using 1BTC to exchange for DAI in Uniswap.
Sample code reference, execute the following command:
forge test --contracts ./src/test/Uniswapv2.sol -vvvv
According to the figure - we swap 1 BTC to 16,788 DAI by calling the Uniswap_v2_router.swapExactTokensForTokens function.
The following can be derived from the Etherscan example above:
The purpose of this transaction is to add Liquidity at Curve three pools.
From: This transaction's source wallet address
Interacted With (To): Curve.fi: DAI/USDC/USDT Pool
ERC-20 Tokens Transferred: User A transferred 3,524,968.44 USDT to the Curve 3 pools, and then Curve minted 3,447,897.54 3Crv tokens for User A.
According to Phalcon "Invocation Flow" :
Based on the call sequence, three steps were executed: 1.add_liquidity 2.transferFrom 3.mint.
The following can be derived from the Etherscan example above:
The user submitted a proposal on the Compound. The contents of the proposal can be viewed by clicking "Decode Input Data" on Etherscan.
According to Phalcon "Invocation Flow" :
Submitting a proposal through the propose function results in proposal number 44.
Here we use Foundry to simulate operations - how to use flash loans on Uniswap. Official Flash swap introduction
Sample Code Reference, execute the following command:
forge test --contracts ./src/test/Uniswapv2_flashswap.sol -vv
In this example, a flash loan of 100 WETH is borrowed through the Uniswap UNI/WETH exchange. Note that a 0.3% fee must be paid on repayments.
According to the figure - call flow, flashswap calls swap, and then repays by calling back uniswapV2Call.
Further Introduction to Flashloan and Flashswap:
A. Common points: Both can lend Tokens without collateralizing assets, and they need to be returned in the same block, otherwise the transaction fails.
B. The difference: If token0 is borrowed through Flashloan token0/token1, token0 must be returned. Flashswap lends token0, and you can return token0 or token1, which is more flexible.
For more DeFi basic operations, please refer to DeFiLab.
Foundry's cheatcodes are essential for conducting chain analysis. Here, I will introduce some commonly used functions. More information can be found in the Cheatcodes Reference.
createSelectFork: Specifies a network and block height to copy for testing. Must include the RPC for each chain in foundry.toml.
deal: Sets the balance of a test wallet.
Set ETH balance: deal(address(this), 3 ether);
Set Token balance: deal(address(USDC), address(this), 1 * 1e18);
prank: Specify the wallet address to simulate. It is only effective for the next call and will set the msg.sender to the specified wallet address. Such as simulating a transfer from a whale wallet.
startPrank: Specify the wallet address to simulate. It will set the msg.sender to the specified wallet address for all calls until stopPrank() is executed.
label: Labels a wallet address for improved readability when using Foundry debug.
roll: Adjusts the block height.
warp: Adjusts the block timestamp.
Thanks for following along! Time to jump into the next lesson.
https://github.com/crisgarner/awesome-foundry
https://blog.infura.io/post/build-a-flash-loan-arbitrage-bot-on-infura-part-i
No activity yet