Pinned Tweet
Just dropped the first piece of my blog series where I explore formal verification of smart contracts using @certora
blog.bahoz.xyz/introduction-…
Subscribe if you want to see more.
This is why these guys are still at the top, despite strong competition. They prioritize wardens above all.
See announcement here — the original numbers in the readme are what will be honored.
discord.com/channels/8109169…
Did @code4rena change Uniswap contest terms significantly just two days before contest ends?
Is this ok?
3
9
2,526
B A H O Z retweeted
🟢🔴 Public Disclosure for ERC1271 Replay Issue🔴 🟢
On September 25, 2023, I found an issue in a widely used implementation of the ERC1271 pattern that affected more than 15 teams.
The following blog describes the sequence of events regarding how it all came together.
mirror.xyz/curiousapple.eth/…
If you are a wallet team or a security researcher, consider going through it.
Many parties joined to help mitigate this issue.
Shoutouts to @frangio_, @Ivshti, @fleupold_, @leekt216, @optimizoor, @howydev, and many others for their assistance.
Special thanks to @CoWSwap, @AmbireWallet, @Instadapp, and @biconomy for issuing the bug bounty
That's all 🫡
I published the second post on Formal Verification with @certora
It delves into the world of Propositional Logic, a foundation for formal methods with some practical examples.
blog.bahoz.xyz/formal-verifi…
Just dropped the first piece of my blog series where I explore formal verification of smart contracts using @certora
blog.bahoz.xyz/introduction-…
Subscribe if you want to see more.
LLMs are set to transform software engineering, shifting the focus from writing to reviewing and verifying the machine written code.
4
653
Results from June are announced and I am back with an update as promised.
Public contests: $4165 (@code4rena & @HatsFinance)
Private audits: $7375
Total: $11540
450% increase from May, I am getting there.
And I have some exciting updates coming soon 👀
I made $2123 from my first month of independent audits.
Which is around 1/10 of my previous monthly salary 😢
What did I learn and what did I change to significantly increase this in my second month?
A short thread:
7
42
4,030
5. Hacker Mindset:
It can be explained as actively attempting to exploit any possible flaws in a smart contract and involves using techniques listed above.
Adopt the hacker mindset, simulate real-world attack scenarios to identify weaknesses and potential entry points.
1
2
745
Alpha leak Monday:
The most under-discussed yet critical concept in bounty hunting and competitive auditing is bug density.
Every line or chunk of code has some invisible "danger" value, which is the probability of a mistake being injected. As a hunter, time and attention are your only resource constraints. It follows that to maximize success you need to spend those resources on the highest-value sections.
So what are the red hotspots on my heatmap?
1. fundamentally complex code
2. undertested/hard-to-test code
3. novel ideas or implementations
4. heuristics triggered - gas/delegatecall/callbacks/eth-weth duality etc.
Mastering the bug density heatmap is the single most profitable thing you can do in bounties.
1
896
The results for the Chainlink CCIP contest are finally out.
Thanks @chainlink and @code4rena.
7
58
4,518
LOL, almost missed this.
@HatsFinance you should tag winners next time :)
1/6
🎉 Congratulations to the winners of the @Vmex_fi 1st audit competition! 🚀
We sincerely thank you for your invaluable contributions to fortifying the web3 security ecosystem.
2
8
1,245