Founder @ https://xitter.cf/t.co/gcgrMm5l8P, JohnnyTime @ Youtube, Securing Web3 @ https://xitter.cf/t.co/wJdpJyYK5y & https://xitter.cf/t.co/3d9aL8nDvG
Web3
Joined February 2012
- Tweets10.6K
- Following1.5K
- Followers12.8K
- Likes37.1K
Pinned Tweet
Smart contract security pays WELL.
💰 Top auditors make $500K+ per year
💰 Bug bounties can 10x that
💰 Even “mid” auditors make six figures
BUT… Only if you actually put in the work. No shortcuts here.
An AI writes a smart contract, then reviews it:
"Who wrote it?"
"The model."
"Who reviewed it?"
"The model."
"What happens if the withdrawal fails?"
"Hang on."
Nomad's bridge paid out on unproven messages in August 2022.
Bridge messages authorize actions such as releasing funds on another chain. An unknown message passed Nomad's validation because its default value was treated as trusted. 1/4
3/4 Copycats reused transaction data with different recipients.
Test a message that has never entered the proof process. Follow its default storage value through validation; an unknown entry must not grant permission.
4/4 Coinbase's analysis of the historical Nomad exploit:
coinbase.com/blog/nomad-brid…
The blank passport illustration is a metaphor for accepting an unproven message.
You can now find your course's exercise files, solutions and setup lessons under Course Resources. For lesson questions or account problems, use Get Help on the dashboard.
Full guide: smartcontractshacking.com/at…
Free Rider hides a plain accounting bug inside a flash swap.
buyMany passes the same msg.value into every purchase. 15 ETH can satisfy six purchase checks.
That detail lets the attacker take every NFT.
youtube.com/watch?v=cxFH9U1N…
Hack totals need incident sources. Audit-firm claims need reports. We built two tools so readers can check both for themselves.
smartcontractshacking.com/to…
smartcontractshacking.com/to…
New SCH CTF Arena challenge: Denial.
Worth 1150 EXP and up to 1750 HP.
smartcontractshacking.com/to…
$1M in capital, $12M in positions. The part I'd want to understand is how you get out.
What happens if one side closes and the other can't? How much room is there before liquidation?
Would like to see those scenarios alongside the APR.
There's nowhere else in this world where you can:
> Earn over 30% APR
> It's fixed rate
> It's delta-neutral
> You can size in with $1M capital
> Where it will earn like it's $12M (notional amount)
Only on @boros_fi 🌍
Run an Ethereum validator in New York. Years later, get called to testify in a hacking trial because of where that node was running.
That's what Dylan says happened to him in the Uranium Finance case. Didn't expect node location to become part of this story.
TLDR for crypto people:
> Be me
> Ran ETH validator while I lived on Wall Street
> Get call from federal prosecutor 3 years later
> HIM: "We're prosecuting hacker of Uranium Finance"
> HIM: "Need you to come testify that you ran a node for proof of Venue, its a law that requires crimes are tried where they are committed"
> Law doesn't make sense when applied to crypto, but whatever
> Me: "ok, how did you find me?"
> HIM: "Matching Etherscan and Verizon IP records"
> Fly to NYC
> Take oath and tesify
> HIM: "Cool thx bro"
> Post story on X
> Avi Eisenberg replies
> Avi's convictions were thrown out, not because he didn't do it, but because they couldn't prove it happened in the district he was tried
> Realize I'm the fix
> Realize everyone who runs a node is a witness to all crimes that occur on that blockchain
State of modern crypto law
An attacker can sign a Solana transaction with their own wallet.
Checking that someone signed isn't enough. Your program has to check that the signer is allowed to change that account.
Rust won't catch that mistake for you.
Try your exploit again after the fix. Then change how you reach the bug.
Does it still work through another function? With a different account?
The original PoC failing only tells you that particular attempt stopped working.
Free bug bounty prompts from @mdp_sec, covering the hunt from recon to checking whether a finding actually works.
One detail I like: make the agent prove how the attacker gets each ID or token used in the PoC. Easy to skip when you've got both test accounts open.
You'll need your own tools to use these.
Just found this awesome Open Source repository with a list of 10 AI prompts you can integrate into your bug bounty hunting workflow
Web2 Security focused, still very valuable - scoping, triaging, validation & more. 10x for the great resource @mdp_sec 🫡
github.com/mdpsec/bug-bounty…
Your SCH dashboard now shows the course sequence: Part 1, Part 2, final assessment and certificate. You can see your progress and which stage comes next.
An upgradeable proxy holds state; its implementation supplies code. Deploying the implementation doesn't initialize the proxy.
Initialize the proxy during deployment. Verify owner/roles, block repeat initialization, lock implementation and test upgrade permissions.
Lending protocols pay a liquidation bonus to accounts that repay unhealthy debt.
In Euler V1's March 2023 exploit, an attacker made an account eligible for liquidation, then collected that bonus through self-liquidation. 1/4
3/4 The attacker self-liquidated for a bonus larger than the donation loss.
Review the whole sequence: can an attacker reduce collateral, trigger liquidation and recover more through the bonus than they gave up?
4/4 Euler Labs' account of the historical V1 exploit and recovery:
euler.finance/blog/war-peace…
Euler V2 has a different architecture.
