Founder @ https://xitter.cf/t.co/gcgrMm5l8P, JohnnyTime @ Youtube, Securing Web3 @ https://xitter.cf/t.co/wJdpJyYK5y & https://xitter.cf/t.co/3d9aL8nDvG
Web3
Joined February 2012
- Tweets10.6K
- Following1.5K
- Followers12.8K
- Likes37.1K
Study one hack by answering four questions:
What did the attacker control?
What did the protocol trust?
Which transaction crossed that boundary?
What changed?
Link the evidence. Leave unknown details unknown.
A bonding-curve token can rise in price while exits become fragile. Model a buy wave followed by a sell-off; check reserves and execution prices. Try the SCH stress tester:
smartcontractshacking.com/to…
LFG!
vm.prank allowed me to run my tests correctly.
I tried finishing the exercises without AI and looking at the solutions.
Fungible Tokens Exercise 1 conquered!
Thanks, @RealJohnnyTime! Looking forward to finishing the whole SCH course before 2026 ends.
An AI writes a smart contract, then reviews it:
"Who wrote it?"
"The model."
"Who reviewed it?"
"The model."
"What happens if the withdrawal fails?"
"Hang on."
4/4 Coinbase's analysis of the historical Nomad exploit:
coinbase.com/blog/nomad-brid…
The blank passport illustration is a metaphor for accepting an unproven message.
3/4 Copycats reused transaction data with different recipients.
Test a message that has never entered the proof process. Follow its default storage value through validation; an unknown entry must not grant permission.
2/4 Looking up an unknown message returned bytes32(0).
An initialization change had made that zero root acceptable. The unproven message passed the root check, allowing a payout.
Nomad's bridge paid out on unproven messages in August 2022.
Bridge messages authorize actions such as releasing funds on another chain. An unknown message passed Nomad's validation because its default value was treated as trusted. 1/4
You can now find your course's exercise files, solutions and setup lessons under Course Resources. For lesson questions or account problems, use Get Help on the dashboard.
Full guide: smartcontractshacking.com/at…
Free Rider hides a plain accounting bug inside a flash swap.
buyMany passes the same msg.value into every purchase. 15 ETH can satisfy six purchase checks.
That detail lets the attacker take every NFT.
youtube.com/watch?v=cxFH9U1N…
Hack totals need incident sources. Audit-firm claims need reports. We built two tools so readers can check both for themselves.
smartcontractshacking.com/to…
smartcontractshacking.com/to…
New SCH CTF Arena challenge: Denial.
Worth 1150 EXP and up to 1750 HP.
smartcontractshacking.com/to…
$1M in capital, $12M in positions. The part I'd want to understand is how you get out.
What happens if one side closes and the other can't? How much room is there before liquidation?
Would like to see those scenarios alongside the APR.
There's nowhere else in this world where you can:
> Earn over 30% APR
> It's fixed rate
> It's delta-neutral
> You can size in with $1M capital
> Where it will earn like it's $12M (notional amount)
Only on @boros_fi 🌍
Run an Ethereum validator in New York. Years later, get called to testify in a hacking trial because of where that node was running.
That's what Dylan says happened to him in the Uranium Finance case. Didn't expect node location to become part of this story.
TLDR for crypto people:
> Be me
> Ran ETH validator while I lived on Wall Street
> Get call from federal prosecutor 3 years later
> HIM: "We're prosecuting hacker of Uranium Finance"
> HIM: "Need you to come testify that you ran a node for proof of Venue, its a law that requires crimes are tried where they are committed"
> Law doesn't make sense when applied to crypto, but whatever
> Me: "ok, how did you find me?"
> HIM: "Matching Etherscan and Verizon IP records"
> Fly to NYC
> Take oath and tesify
> HIM: "Cool thx bro"
> Post story on X
> Avi Eisenberg replies
> Avi's convictions were thrown out, not because he didn't do it, but because they couldn't prove it happened in the district he was tried
> Realize I'm the fix
> Realize everyone who runs a node is a witness to all crimes that occur on that blockchain
State of modern crypto law
