Did you know that you can cast the state mutability of a function pointer in Solidity.
You can use it to:
- have a view function appear as pure
- override an internal virtual function's state mutability without modifying the inherited contract
But how does it work?
1/4
Function calls in Solidity work like this:
1. If the address is external, it makes a CALL or STATICCALL to the address.
2. If the function is internal (present in the bytecode of the calling contract) it executes a JUMP to the JUMPDEST marking the start of the function.
3/4
With this trick you can call internal functions with any state mutability (even in an internal pure function).
However if the contract was entered externally in a view context (STATICCALL), then execution will revert on state mutations, making this trick unsafe.
4/4
h/t @z0age
Solidity 0.8.22 will ship with an optimization rule for simple loop increments. I can't believe it took so long to do this.
No more ugly unchecked blocks.
Like all high-leverage endeavors, Web3 security follows the pareto principle. The hustle is to get to the top 20%. After that scale happens by itself.
Managed to get an easy $500 Medium on the @centrifuge audit on @code4rena.
Always check if the protocol implements an ERC to spec, especially if it’s an obscure standard (ERC1404 in this case)
.@noah_eth made a remark on the @ScrapingBits podcast about the current lack of auditor tooling. I think it really holds back the space.
What sort of auditing tool would you be excited about using? What feature do you dream about having in the tools you already use?
Curious.
degensec.eth retweeted
My controversial programming opinion is that 99% of what everyone argues about on here literally doesn’t even matter when it comes to shipping actual software
Everyone is stumbling, reaching, larping, will say almost anything if they’ve calculated it will bring them attention
degensec.eth retweeted
This week I shared my experience with invariant testing at @opensensepw
Here are my tips and best practices on to write robust and efficient property tests for your DeFi protocol 🧵
Biggest takeaway from the vyper bug: Never assume an external module is secure.
OpenZeppelin Contracts are industry-standard but they are not immune to bugs.
18 known vulnerabilities in v4. More will come with v5.
Best ROI in security comes from challenging assumptions.
ALT OpenZeppelin vulnerabilities
The vyper compiler 0-day is already the worst language bug ever in crypto in terms of aggregate money lost.
Currently a massive arms race is happening between whitehats and blackhats, looking for exploits in the wild.
Reach out to @pcaversacci if you think a project might be affected.
The auditor space is growing exponentially.
Soon finding simple, well-known bugs will be netting you $0.
The big bucks are given for complex interaction/logic-based bugs. The ones missed by the entire protocol team and 5 auditors.
📚 Here's how you get there:
9) Finally, be patient.
This space attracts many young and ambitious high-performers. When you're in that position it's hard to be patient about your journey.
Quit measuring progress in $. Money is the byproduct of being good. Focus on getting in that 1% and it will follow.
Follow @degensec, anon 💜 Only high-quality brainwaves.
Tagging chads for visibility @pashov @PaladinCharles @chrisdior777 @gogotheauditor @ShieldifyAnon @0xriptide @0xRajeev @juancito @0xOwenThurm @CodingNameKiki @akshaysrivastv