Joined November 2016
Thanks @CertiK for the great write-up on the vulnerability I found in Cosmos EVM-compatible chains👀 Precompiled contracts can cause state inconsistencies ⚡️ It’s the first case in EVM–Cosmos Convergence Research From Security Base certik.com/resources/blog/ev… @CertiKCommunity
5
501
@asymmetric_re @pleasew8t also found a similar arbitrary token minting vulnerability on @EvmosOrg, and they didn't get a reward. xitter.cf/asymmetric_re/status/1…
New blog post: Evmos Precompile State Commit Infinite Mint. A critical vulnerability in EVM state commits during precompile execution could cause a mismatch between the state held within EVM and the Bank module, resulting in inflated contract balances. asymmetric.re/blog/evmos-pre…
1
4
2,158
The MEV supply chain and its complicated interactions with all parts of Ethereum could use more study and testing. For me this was most clearly illustrated about a year ago in the fallout of lowcarbcrusader's equivocation attacks. At the time it felt to me that something like pandora's box had been opened. We quickly fixed the relay bug that lowcarbcrusader used, but then found several other equivocation attacks we needed to quickly patch. Soon lowcarbcrusader themself had reached out to a few of us to disclose another attack (in return for rebranding themself away from sandwichtheripper). They pointed out a small nuance in CL client behavior in propogating blocks could give an attacker a substantial advantage (~500ms) in equivocating. And they were right. When you saw it, it seemed obvious something like this would exist. But the reality was that very few people had knowledge of both the depths of the CL p2p and MEV, so I don't think anyone else had put this together before. If you're interested you can read more here: collective.flashbots.net/t/d… It was clear to me then, as it is now, that we needed people studying the complicated intersections of MEV and every part of Ethereum. I see the bug that Bloxroute's BDN had in its interaction with Lighthouse as the same sort of thing as the above disclosed attack from lowcarbcrusader. And fewer people are working at these intersections than Ethereum needs - especially those working in the open. I can't fault Bloxroute for looking for every edge that they can get in lowering latency, which I presume is why they were propogating blocks first without their blobs. For BloxRoute to stay competitive with other relays they need to look for this kind of edge. And I expect if they didn't another one of the other relays probably eventually does something similar if it helped with latency. The MEV industry is brutally competitive. Searchers, relays, and builders fight over literally milliseconds. That is the reality of MEV. What is unfortunate here is that they weren't more forthcoming with what they were doing. Of course, there is a thin line between "closed source edge" and what we can expect someone like BloxRoute to disclose given the importance of the BDN. But if they were more open with what they were doing I would've expect someone like @sproulM_ or @terencechain to have helped catch this challenge earlier on if they were. Moreover, it isn't clear to me why this wasn't caught on a testnet too. There were several testnets that included the whole relay, builder, mev-boost stack that were carried out to test the interaction between that stack and the client changes being made in a live environment. I'd make the contention that if your infrastructure is a major part of how mainnet blocks work we should expect it to be mirrored on testnet(s) and be a part of testing too. That goes for everyone in the supply chain too, not just BloxRoute. Perhaps this was tested on a testnet too, I don't know. I also wish that we have more people effectively red teaming the complicated interactions that result from the incentive to make money. In my ideal world before the latest fork happened a cracked group of people somewhere had thought "if I was a builder I would want to publish my blocks as late as possible. How can I shave off latency and get an edge in block propogation with the deneb changes?" and then came up with "Well, we could publish blocks without blobs first." And tested that interaction. Then, we could have caught this before mainnet went live and given those folks a grant for discovering a bug that later caused proposers to lose money. And this could be done across the stack too, where we'd hopefully find this recent bug as well as others - like the attack lowcarbcrusader highlighted and future bugs which will result from similar things. The reality is that Ethereum is complicated and the interactions between its clients - both execution and consensus - and MEV driven behavior are too much to expect any one stakeholder group to handle. Effectively managing that complexity requires across the board collaboration, openness, and leveraging the efforts of the whole community. It is long past the time where we realized that and built for it. To that end I'm heartened by the collaboration that we have with many CL teams, who have always been a pleasure to work with, and things like the PBS Foundation. I would like to see more people demanding MEV projects to uphold the tenets of crypto that we all cherish, like fairness, permissionlessness, and transparency. That would go a long way. As a community we can, and should, do much more. Flashbots stands ready as ever to join in the efforts to do so.
This post-mortem misrepresents the issue as a Lighthouse p2p bug, when in fact it was caused by an untested interaction between Bloxroute's centralised "block distribution network" (BDN) and Lighthouse's HTTP API Here's an account from my perspective
8
17
3
88
37,239
I got first blood in the blockchain challenge of Real World CTF 2024, named SafeBridge. Here is the detailed write-up for it. chovid99.github.io/posts/rea… Many thanks to @RealWorldCTF and @0xiczc for creating such an impressive challenge.
7
53
4,205
Added exploit scripts for this challenge github.com/iczc/rwctf-6th-sa…
Congrats to Blue Water! And a warm welcome to all to try out this blockchain challenge I prepared for @RealWorldCTF realworldctf.com/challenge/6…
1
4
1,227
Just solved a HARD blockchain challenge SafeBridge in @RealWorldCTF designed by @0xiczc ! Can you spot the bug here? 🕵️
Congrats to Blue Water! And a warm welcome to all to try out this blockchain challenge I prepared for @RealWorldCTF realworldctf.com/challenge/6…
1
3
2
28
8,905
Congrats to Blue Water! And a warm welcome to all to try out this blockchain challenge I prepared for @RealWorldCTF realworldctf.com/challenge/6…
Congrats to Blue Water(@pb_ctf & @Water_Paddler) for taking the first blood of SafeBridge! 🥳 #realworldctf
1
2
8
8,320
New launch! 💰 @Scroll_ZKP is a fully EVM-Equivalent zk-Rollup built to scale the Ethereum network. Find bugs - get $1,000,000! immunefi.com/bounty/scroll/
5
24
6
121
34,692
🔥Root Cause Analysis Part 2 of Past DeFi Incidents. We have covered another 101 incidents. We hope this information can help developers avoid making the same mistakes as much as possible. 👉web3sec.notion.site/web3sec/… #Web3 #DeFi
5
41
7
117
28,084
We know that there are still many security challenges for non-evm chains in the direction of being compatible with evm, such as cve-2021-25837. The vulnerability of any token mint in the Ethermint chain announced last year can be seen in the native evm chain...
3
3
4
Shout out to our security team! @0xiczc found a vulnerability in Polygon zkEVM and it has been fixed now, check out the thread for more details 👇
1/ Recently, I discovered a vulnerability in the @0xPolygon zkEVM and earned my first L2 bug bounty from @Immunefi. This vulnerability causes the assets being bridged from the L1 to Polygon zkEVM(L2) cannot be claimed properly in the L2, thus blocking L1->L2 asset migration.
1
4
39
10,278
#MostClicked @PhABCD Ethereum Halving @hanni_abu validator queue @e_kaspersky iMessage 0-click @0xQuintus intents @naps62 Iron wallet @dannyryan LSD risk reminder @0xiczc Polygon zkEVM vuln @merklejerk Zipped contracts @nero_eth block construction market xitter.cf/WeekInEthNews/status/1…
1
6
1
19
8,352
1/ Recently, I discovered a vulnerability in the @0xPolygon zkEVM and earned my first L2 bug bounty from @Immunefi. This vulnerability causes the assets being bridged from the L1 to Polygon zkEVM(L2) cannot be claimed properly in the L2, thus blocking L1->L2 asset migration.
17
55
11
313
64,504
15/ The Polygon zkEVM team fixed this vulnerability by removing the particular gas logic for claim tx. github.com/0xPolygonHermez/z… Although no funds are at risk due to node upgradability, I think it is an interesting issue arising from the mix of contract and blockchain node logic.
2
1
16
2,862
16/ I observed that @immunefi added a new impact of it to their classification system after I reported(maybe this can show that this is a new point of view!) I believe it's possible to surface more weaknesses in the differences between Rollup and Geth, so let's keep hunting!
2
22
3,248