@bin2chen

Focus Web3 Security @sherlockdefi https://xitter.cf/t.co/edTtnk54mh https://xitter.cf/t.co/dqSfHU1kmk

Joined November 2020
  • Tweets101
  • Following375
  • Followers684
This one was so much painful guesswork 🙈 #13 Junior miners ventral.digital/posts/2022/7…

Damn Vulnerable DeFi V2 - #13 Junior Miners • Ventral Digital

Ventral Digital LLC is a research and consultancy firm specializing in Information Security and Privacy.

ventral.digital
5
10
1
68
bin2chen retweeted
IGN China@IGNChina3 Jul 2022
香港四大才子之一，科幻小说《卫斯理》系列作者，著名作家倪匡于今日离世，享年 87 岁。 R.I.P.🕯️
17
116
17
370
NFT借贷平台@XCarnival_Lab 大约7个小时之前被黑了，至少有3000个$ETH （约380万美元）被盗。下面是该事件的简要分析：
6
9
2
20
bin2chen retweeted
BlockSec
@BlockSecTeam26 Jun 2022
1/ Our system monitored an attack to @XCarnival_Lab tx.blocksecteam.com/ETH/0xab… versatile.blocksecteam.com/t… @Mudit__Gupta
2
5
19
今晚小课堂，讲openZeppelin，欢迎参加✌ @TypeV_Official
2
2
14
bin2chen retweeted
Immunefi
@immunefi23 Jun 2022
We've released the latest Whitehat Hall of Fame NFT. And it goes to legendary whitehat @PwningEth for his find critical bug find in @auroraisnear, which saved a LOT of funds. He is now immortalized for his heroic work. Check out the new NFT below. 👇 medium.com/immunefi/pwning-e…
4
9
4
44
MetaMask Clickjacking Vulnerability Analysis slowmist.medium.com/metamask…
11
44
How to Audit a Smart Contract | Can you find the Solidity Security Vulnerabilities? youtube.com/watch?v=TmZ8gH-t…

How to Audit a Smart Contract | Can you find the Solidity Security Vulnerabilities?

We learn the auditing 101 of smart contracts, and understand basic ...

youtube.com
17
62
6
326
#zkEVM has been the holy grail of layer2 and Ethereum scaling and is at the forefront of the blockchain && ethereum There's a lot of zkp and engineering innovation here, bringing together all the most talented people in the Ethereum ecosystem
13
121
26
459
bin2chen retweeted
BlockSec
@BlockSecTeam16 Jun 2022
Our Take on the Inverse Finance Security Incident: Price Manipulation blocksecteam.medium.com/pric…
1
7
27
Constant product AMM math XY = K
9
73
5
394
这是个有趣的EdDSA库的风险敞口，简单来说黑客可以用两个不同的签名计算出私钥。和同随机数黑掉ECDSA类似，都是由于开发者不慎或对其密码学原理和要求不理解造成的，和加密算法本身没关系。在使用ECDSA的主流币种上，由于之前的索尼事件，应该不会有钱包再犯这种错误了。
Cos(余弦)😶‍🌫️
@evilcos17 Jun 2022
可以认为这个是 EdDSA 椭圆曲线库的使用安全风险，不是算法本身的问题。昨天和@Safeheron 仔细讨论了下，Safeheron 的安全分析解读文章很快会出来。核心来说，这些库如果严格验证公钥和私钥的 pair 关系，就不会有这种问题，或者使用上注意，否则会比较容易根据结果推导出私钥。
2
4
14
List of Smart contract security vulnerabilities github.com/runtimeverificati…
1
19
36
1/ @InverseFinance was exploited in etherscan.io/tx/0x9582362669…, leading to the gain of ~$1.26M for the hacker (The protocol loss may be larger).

Ethereum Transaction Hash: 0x9582362669... | Etherscan

Flash Loan 27,000 WBTC From Aave Protocol V2 | Success | Jun-16-2022 08:47:58 AM (UTC)

etherscan.io
12
58
31
197
bin2chen retweeted
0xBilly
@Billy0xFF15 Jun 2022
Layer 2竞争格局分析: 生态资源和L2性能是核心竞争力 （本人第一篇Web3研究长文，欢迎交流~） mirror.xyz/0xee0FF4092C52696…
20
102
9
189
bin2chen retweeted
Xiaowen
@ixiaowenz15 Jun 2022
太缺德了。
32
266
35
2,102
The Interest Protocol token sale contract has a bug that allows admins to take all IPT tokens before purchasers can claim them. The admin withdraw() method does not check if it has already been called - withdraw() can be called repeatedly to drain the entire contract of IPT. 1/5
1
21
1
77
bin2chen retweeted
storm
@notnotstorm11 Jun 2022
you can query each address's nonce per block. so you can use this with something like a binary search to efficiently gather an complete transaction history of an address ctc uses this technique. for example for vitalik.eth takes about 20 secs to find 811 tx's with alchemy node
jacob@thal0x11 Jun 2022
is going block by block the only way to get every transaction from an address? sitting here working through 14 million blocks right now 💀
5
33
2
279
亲戚家房子盖在一个坡顶，房子盖好之后在坡上种了好多常青藤。快二十年了，这些常青藤长得到处都是，她找人来看，说至少要六千到一万刀才行。后来她在网上找到一家出租山羊的，于是租了十只羊来啃了两个星期，终于啃干净了，花了九百刀。
65
95
15
976
Replying to @safepump_meme
@treasure__swap is exploited, the attacker can swap out all the WETH tokens in the pool using only 0.0000000000000000000001WETH. (credit: @bbbb) By reversing the source code, we find the root cause is the lack of k-value checks in the swap function of the victim contract.
1
2
1
16
Load more