Sub-brand of @0xbitslab. We're a Blockchain Security Team that Provides Proficient Audit Solutions for the Mass Adoption of Web3
Joined June 2023
- Tweets608
- Following247
- Followers3.3K
- Likes859
A Seed-generation flaw affected certain wallets, while the underlying blockchain protocol remained unaffected. Computors halted the network at Tick 85,371,949. About 87.1% of stolen funds were frozen on-chain; the remaining 12.9% went to MEXC, where related accounts were frozen.
🔍 EtherVista Exploit: An Integer Overflow in an AMM’s K Check
On Oct 9, EtherVista reportedly lost 💸~$18.6K in WETH and VISTA. The issue was in EtherVistaPair.swap(): an overflow broke the constant-product check, letting invalid swaps drain liquidity.
Here's how it works🧵👇
5/6 Why SafeMath Didn’t Help 💨
Elsewhere, EtherVista uses uint(reserve0).mul(reserve1), casting to uint256 before multiplying. But swap() uses reserve0 * reserve1 directly.
⏳ SafeMath in one code path doesn't protect another. Router access can't fix a broken invariant.
6/6 ScaleBit Security Insight 💡
A K-invariant check is useless if its math can overflow.
✅ AMM/DEX audits should test integer widths, casts, extreme reserves, invariant enforcement, router access, and fuzz testing.
#ScaleBit #EtherVista #DeFiSecurity #SmartContractAudit
🚨How did $3.8M leave a cross-chain vault?
On Oct 1, @near_intents disclosed an exploit involving its Omni deposit/withdrawal system. An attacker withdrew 3.865M USDT from a BNB Chain vault in five transactions, each accepted with signed withdrawal proofs.
Here's how it works👇
7/8 | Audit takeaway
🔦 Cross-chain smart contract audits must cover the full flow:
Deposit → Balance Accounting → Withdrawal Authorization → Settlement.
🥏 Test proof-to-balance consistency, nonce replay resistance and asset conservation across failures and edge cases.
8/8 | ScaleBit Security Insight
✍️ Cross-chain audits must test trust boundaries, access control and consistency from accounting to settlement.
ScaleBit, sub-brand of @0xbitslab , focuses on multichain smart contract security. ✊