We are proud to announce the release of the updated 𝗦𝗺𝗮𝗿𝘁 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗩𝗲𝗿𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱 (𝗦𝗖𝗦𝗩𝗦)! ✅ The best and most comprehensive checklist available for Solidity based smart contract projects.

Some time ago we worked on a project which was integrating with @LayerZero_Labs Omnichain Tokens and we were not able to find an all-in-one security checklist that could facilitate the whole process. That’s why in our new blog post you will find such a checklist. Check it out here: composable-security.com/blog…

Congratulations on 1st 🥇 place in War Room Games for @drdr_zz from our team and other Team16 members @mestevez @dgrabec @danielvf Networking during @EthCC 🇫🇷 is great, but hacking together is another level of friendship 🍾 @TenderlyApp @yAuditDAO @yearnfi

NoBullSh*T Security Guide is live! CTOs, Lead Devs, and all Security Freaks! We created a comprehensive resource which cuts straight to the chase delivering effective and practical security strategies without the fluff. Get the Security Guide from here: composable-security.com/secu…

Thanks to the grant received from @UniswapFND, we have created the most comprehensive article on #Uniswapv4 hooks security and their threats 🫡 You will find different #hooks use cases and threat model that can be used to create hooks. Read it here 👇 composable-security.com/blog…

Check it out and share with frens! github.com/ComposableSecurit…

On the blockchain, security should always come first! As the creators of Smart Contract Security Verification, we will thoroughly test your project 🧵

The research on #UniswapV4 hooks proved that hooks have great potential, but at the same time, their space is full of threats. With the development of the hooks space, there will be a growing need for tools and standards to help developers build. Find suggestions and proposals for solutions to be created in the future. Get to know already available tools and resources which were also supported by @UniswapFND: - Static Tool Analyzer created by @BlockSecTeam - Builders Perspective on UniV4 hooks by @BrokkrFinance - “Uniswap V4 hooks Guide” created by @0xUmbrella and more! Read the article 👇 composable-security.com/blog…

While everyone is happy about the ETF, we shouldn't miss the SEC's glaring oversight and another high-profile account on X being compromised. Here is an article explaining sim swap and showing many other attack vectors and recommendations on how to protect against them. credit: @wh01s7 composable-security.com/blog…

Meet @Composable_Sec at @ETHWarsaw! Let’s connect if: - You want to be among the first to access the “No Bullsh*t Security Guide” - Learn the basics of threat modeling which can be introduced to your team - Meet and chat You can reach out to us via DM or just drop a comment 📩

Build smarter, not harder ⛏ The sooner a project starts building on good security assumptions, the easier it is to protect it from vulnerabilities. . That’s why, we consider threat modeling a valuable process that saves not only time and funds but also a great amount of stress.

Ciao from @eth_milano 🇮🇹 Look for @drdr_zz and let’s connect!

🛠️ New #slither detectors from @pessimistic_io. Expand your toolset and give them a try. github.com/pessimistic-io/sl…

Calling all the #EthWarsaw Hackers! Each project that was created during the @EthWarsaw hackathon and is to be continued is invited for a FREE security consultation. DM’s open. Build with a long-term vision and let nothing stand in your way! 🛠️👷‍♂️

Better safe than sorry! If we were to give one reason to use the SCSVS that’s how we would describe it. With the SCSVS we provide a checklist to standardize the security of smart contracts which helps to address security issues and vulnerabilities at all development stages.

Hi from #Web3SecurityConference2023! 🇮🇹 We’re glad to be among the Security Projects that are leading the biggest discussions on Web Security! Especially with @drdr_zz having a panel about “Smart Contract Security, Spotting Exploits Before They Happen”. What a great day to be in blocksec space!

Should exploiting 100 million dollars from the contract in good faith be considered a white hack? 🤔 Questions like this and doubts about whether white hacks should be commonly accepted regularly occur in security space. Our view on the topic is firm. Check out what we think in the last blog article: composable-security.com/blog…

Verify and mitigate potential threats when integrating with Uniswap V4! Uniswap recently launched V4 and we’re threat modeling that will come in handy for both builders and users interacting with the dapp. Read it here: 🔗composable-security.com/blog…

Big heads up to @eulerfinance for such a comprehensive security approach 👏 Even though we did not have a chance to help secure EVC, we find it crucial to promote such an approach! Let’s spread the word about projects emphasizing security and minimizing risks as much as possible.

📣 Big announcement! We’re thrilled to share that our work is being supported by the grant from @UniswapFND 🦄 What bad hooks look like? Our team is contributing to research exploring the "malicious design space" of hooks and how protocol stakeholders should reason about their security. The aim of the research is to raise awareness about potential threats and provide resources that will help understand the threat landscape and analyze the security of the hooks. We’re looking forward to sharing our findings through blog articles, the new SCSVS category, and more!

It takes more than an audit to make your protocols secure. Preparing to act in a crisis may be your life vest when your project is being exploited. Now, by doing SEAL Drills, you can go through such a situation and learn how to act when it happens. With the next update of the Security Guide, we will ensure to mention doing SEAL Drills and performing other actions that can be done before anything happens.

100+ pages. 😱 Many excellent frens have signed up for our guide. We believe that it will bring a change for the better in the security context of many projects. Don't have it yet? Get it now!

We’ve just published the third article about #UniswapV4 Bad Hooks! This time @Drdr_zz explains a threat scenario in which a malicious hook owner updates the oracle parameters resulting in an invalid price. Read the article here 👇 composable-security.com/blog…

As a result of a bug in the @bananagun contract, located in the "transfer" function, the following issues occurred: * Contract subtracted from sender's balance fewer tokens than expected * The `fee` tokens were technically minted to the token contract (and later used to pump the price in the Uniswap pool). This issue could be detected by following the check G12.2 of SCSVS: Verify that sensitive functions of the verified contract are covered with tests in the development phase.

Meet us at #Web3SecurityConference2023 in Milan! On October 4th, @DeDotFiSecurity is hosting a conference during which @drdr_zz and other leaders from known security projects will give speeches on topics related to the block sec sector. Let us know if you’ll be there!

With the @ethWarsaw coming on the 31st of August, let’s go back to last year! @drdr_zz and Certora, Quantstamp, and Halborn's representatives participated in the security panel. Watch it here and get the expert knowledge:  🔗composable-security.com/blog…

Happy to help @CCCTRX20 with mitigating threats and improving their security. We value the desire for a comprehensive approach from an early stage! 🛡️

Have you ever wondered how smart contract auditors identify threats while performing an audit? 🤔 In Composable Security we divide the process into 3 stages, using different resources to ensure we find as many threats as possible 🧵

In September 2023, @wh01s7 published an article to start discussions about White Hack Policy. At the same time, a dedicated group was working on something similar independently in the shadows. Today is the day to start discussions again! ✅Check the WHITEHAT SAFE HARBOR AGREEMENT ✅Check out all the initiatives of great people who are dedicated to keep the ecosystem safe! Big things are coming! 🛡️ Follow @_SEAL_Org and stay secure!

📣 Key Takeaways from EthCC & DeFi Security Summit! The insights and connections we gathered from these conferences were invaluable. For a deeper dive, stay tuned for our detailed blog post. 📸 Check a few photos to relive some of these moments with us! 🧵

We found a vulnerability in a hook created during @EthCC Paris Hookathon 🕵️ We challenge you to also find it! Comment the bug below if you did it! 👇

Currently, @LayerZero_Labs is one of the most discussed protocols in the space. We took a closer look at how this omnichain interoperability protocol is built and as a result next week you may expect an article on “Secure integration with LayerZero” on our blog! Like this post to get a message once it’s published and ensure to not miss it 📩

The founder of Composable Security, @drdr_zz, found a valid attack scenario in Uniswap V4, enabling all LP tokens to be withdrawn. Find the vulnerability description and threat modeling for Uniswap V4 here 👇

Fast reaction is one of the most important things when a security crisis happens. Thanks to the “SEAL 911” Telegram group, projects can now get first-hand help from the group of experienced blockchain security specialists. 1/2

The 7 different hook use cases we analyzed, included: - Median Oracle @saucepoint - Multi-sig @adamtj_eth - KYC @jwpark02 - Hedge @andry_r99 - Limit order @Uniswap - Locking liquidity @BrokkrFinance - Dynamic fees @ArrakisFinance Thank you for creating these use cases!

Today at 12 pm EST, @drdr_zz is one of the speakers during @DeDotFi Security Spaces devoted to Preventative Security Tactics! Join it and learn from experts about steps you can take to secure your project.

Merry Christmas!🎅🎄 Best wishes from the 𝗖𝗼𝗺𝗽𝗼𝘀𝗮𝗯𝗹𝗲 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗧𝗲𝗮𝗺 ⛓️🇵🇱! #solidity #christmas #DeFi #security #smartcontractaudits #wishes

🔒 Join the @summit_defi livestream 🚀 For frens who won't make it this year - no worries! You are covered with a live stream link. 🎥 Reserve 2 days on your 📅 and prepare for an incredible feast of the latest attacks, research, and emerging threats🛡️ piped.video/watch?v=QhY9T-6Q…

Another week in blockchain security is behind us! What did it bring? Let’s see 🧵

Congratulations @divaprotocol_io👏🚀 We had the pleasure of working with the team behind this project and they definitely put #security as one of priorities Detailed docs and numerous cross-checks demonstrate the security centric approach that we would like to see more often🛡️

We are very excited to announce that we have successfully completed our security audit for @Milky_icecream_ tokenized ice cream business. Full report available here: github.com/ComposableSecurit…

The Median oracle hook is the first one we described in research about #UniswapV4 hooks 🦄 Read @wh01s7 to learn how this hook works and what are possible threat scenarios related to it 👇

At the moment, there is no single checklist or standard on the market according to which all auditors operate. 🧵1/4

Today at Degen Meetup! Congratulations to @DegenHouse_for another great event 🙌🏼 It is an amazing initiative that enables to onboard more users to web3 and at the same time create a place for the ones who are already in the space to meet, educate and network! We’re looking forward for more!

Some time ago we had the pleasure to share our knowledge at the @ETHWarsaw meetup. @drdr_zz talk titled Security Sins of Web3 Bridges is now available for you to view. 🎥 🍿 composable-security.com/blog…

Last week we published an article about “Secure integration with Layer Zero” 💻 Based on it we also added a new category to SCSVS. The I4: Cross-Chain category is dedicated for projects integrating with external cross-chain protocols such as @LayerZeroLabs. Check it out here: 🔗github.com/ComposableSecurit…

Fill in the form below and be the first to receive a guide: composable-security.com/secu…

Stay ahead of the curve in #smartcontract security with our upcoming Smart Contract Security Verification Standard v2, featuring advanced checks and categories for comprehensive vulnerability detection. ✅ Follow us for updates and be the first to know when it's released.

📢Top 10 blockchain hacking techniques 2022 by @OpenZeppelin Read and learn from the mistakes of others 🚀 #blocksec #hackingtechniques #Top10 openzeppelin.com/security-au…

/1 We listened to a discussion led by @CryptoFeesInfo about the state of bridge security Frens from @immunefi and @lifiprotocol shared their observations and tips. It is very important to exchange such experiences, so we were happy to add something from ourselves in the comments

Are you aware that you can increase the security of your project by small changes in the process, and reduce the costs of time-consuming corrections after audits? That’s possible with threat modeling!

Do you want to learn how to securely use #bridge? Meet us on March 21st in Warsaw! @drdr_zz is going to talk about “Security sins of Web3 bridges” 👾⛓️

We believe that our research will bring many good practices and help you explore the hooks landscape in a safe way. Stay tuned and follow us for more! Including a new UniswapV4 Hooks SCSVS category, and a series of bad hooks illustrating the problems we discuss here.

Security always starts in-house 🛡💻 However, if you want to take it to the next level you should definitely contact us!

Echidna 2.2.0 released ⚡️

2023 has ended with a $81.5M loss for @Orbit_Chain’s Ethereum bridge. It is presumed that the hack happened due to compromised keys of signer addresses on the Orbit’s ETH Vault multisig. A similar possible threat scenario was described in the article we published some time ago about “6 security sins of Web3 bridges”. It is worth reading to learn how to increase security awareness and prevent the recurrence of the most common bugs and mistakes.

A single hack cost on average in 2022 was $14,264,506. Rethink your budget and invest in #security.

Do you want to quickly and regularly improve your code quality without the involvement of outside companies? 💻 Introduce peer review through which you get your team to examine each other's smart contract code. This way you will remove repetitive bugs and increase the overall smart contract’s quality 📈 Get the Security Guide for more tips you can apply within your team to enhance security: 🔗 composable-security.com/secu…

Let’s dive into another part of Bad Hooks implementations- Liquidity Theft via Hook Fee! If the hook is not implemented properly, the attacker can steal the whole liquidity during their withdrawal process 🤯 See the theft process in the diagram below 👇

There is a bug in this code! Can you spot it? 🕵️ In the last article about #Uniswapv4 bad hooks implementations, we referred to the EulerMedianOracle hook. Something we have yet to mention is that there is a vulnerability in the original implementation of this hook. Let us know if you find it!

Day 1 of @ETHWarsaw 🙌🏼 We’re glad to meet all the builders and welcome a new member in our team 🧸 We’re more than ready for day 2!

Do you want to perform threat modeling but have no clue how to do it? We got you! Or..Actually, AI does 📱 In our blog article, we explain how to use ChatGPT for threat modeling and bring it to the next level! Read it here: composable-security.com/blog…

What to do when you can not afford to perform an audit and additional cross-checks? There’s a solution! Instead of requesting two or three audits, you can opt for key threat-based cross-checks adjusted to your needs and capabilities that focus on key threats and scenarios.

Excatly Protocol, an Optimism-based lending platform, suffered from a $7.2 million hack! Attack was made due to vulnerability of an insufficient check in the DebtManager contract as to whether the market address was valid. It enabled a hacker to pass a fake market address by inserting the victim’s address as _msgSender, which led to draining users’ collateral. Check G5.9 of SCSVS minimizes potential threats of such attacks. Check out the whole section “G5: Access control” to secure your contract: 🔗github.com/ComposableSecurit…

We would like to thank everyone who contributed to building this standard, especially @deliriusz_eth, @LewellenMichael and @saxenism. 🙌

A successful cooperation with the codefunded team (codefunded.com), allowed for the removal of 22 vulnerabilities from their codebase 🫡 The full report is available here: 🔗github.com/ComposableSecurit…

Merry Christmas 🎄 The Composable Security team is wishing you all a festive season filled with warmth, happiness, and unbreakable security! 🎁🛡

“A large portion of exploitable bugs in the wild (i.e., 80%) are not machine auditable”. These are words that ring out quite clearly from a great study by @i2huer. 🧵1/5

The first week of the year is coming to an end! Let’s recap what happened in the blockchain security space at the end of 2023 and the beginning of 2024 🧵

Security starts within your team and a lot can be done in this matter. To help you introduce secure practices within your team and increase your project’s security, we created a Security Guide. Here you’ll find tips on incorporating good security practices in your company. Get it here: composable-security.com/secu…

What can projects do to reduce funds and time spent on smart-contract audits? 🛡

🔐🚀 Gearing up for the @summit_defi & @EthCC ! Exciting discussions, workshops, and announcements lie ahead. Who are we meeting on site? Let's connect and share insights! Comment below or send us a DM if you're attending. See you there! #DeFiSecuritySummit #EthCC #Paris

A Must-Read for Devs and Auditors dealing with Bridges. If you're working with cross-chain protocols, you need to be aware of security sins. @drdr_zz put together an in-depth overview based on REAL hacks that will help you protect your DeFi assets. composable-security.com/blog…

You may also find interesting this article about threat modeling when integrating with Uniswap V4: composable-security.com/blog…

Read an article starting the series in which we present implementations of #UniswapV4 “Bad hooks”. In today’s article, @drdr_zz covered “Re-Initialization Leading to Funds Locked” 🔓 Read it here👇 composable-security.com/blog…

This Wednesday @drdr_zz participated in @DeDotFi Security Spaces 🛡 The opening question was: “How do you envision the future of blockchain security?”. In the answer, Damian pointed out that blockchain security may develop in a similar way as it happened in Web 2. With the progressing adoption and development of projects, in a decade, instead of reading code line by line and searching for bugs in code - security experts will have to focus on specific parts of the systems and such vulnerabilities like using libraries with known ones will be more common. What is more, we may expect the creation of open foundations that will be recognized by the whole community and promote: standards, tools, and best practices. This is a great chance for web3 security experts to take part in this process and outline the path. Do you agree with this vision? Would you add something? Let us know! Listen to the full spaces here 👉 nitter.app/DeDotFi/status/1…

A smart contract audit is a balance between the cost on the client's side and the best performance of our work. That's why, to save time and money, we recommend preparing for it using our checklist to improve the code quality. Find the checklist here: 🔗composable-security.com/blog…

This is what shifting left means. That's why we built the Security Guide 🛠🛡 Be the next one, introduce a change, introduce a security-centric approach. Start by getting the Guide here: composable-security.com/secu…

Kyber Network experienced a major security exploit last night. All the users were advised to withdraw their funds and wait for further updates and information from the team..

Let's meet at @ETHWarsaw this year!

Results of a recently performed smart contract audit for one of our clients in which we verified 31 threat scenarios. Detected: 1 MEDIUM 2 LOW Now, we are working together to remove the detected threats 🫡

A few months ago we published an article “6 security sins of Web3 bridges”. In Sin, #1 we describe the issue of improper key management which may lead to minting by someone who acquires keys an unlimited amount of tokens or withdrawing all locked tokens and that is what happened with @MixinKernel. Key management is often related to the web2 component which is why it’s significant to include it in your threat model. Read the full article here: composable-security.com/blog…

Great challenges 🫡

Just a reminder that 2FA is a basis of organization security 🛡️

We are thrilled to announce that our smart contract security auditing company has recently become a partner of the @PLBlockchainA ! We look forward to continuing to serve the blockchain community. #partnership #blockchain #security

📣New SCSVS category alert! As a part of #UniswapV4 hooks research, we’ve added a new category to SCSVS 🦄 You will find there a list of checks you can follow to securely integrate with Uniswap V4. Check it out here: 🔗github.com/ComposableSecurit…

Governance attacks are a great threat to both DAO Communities members and Organisations 🤯 In one of our blog posts we we described the attack that happened to @TornadoCash and shared some tips that may help you avoid similar situations: composable-security.com/blog…

Have you heard about reentrancy reintroduced by Transient Storage (TSTORE)? That’s true and similar case was with EIP-1283 (eips.ethereum.org/EIPS/eip-1…) just before Constantinople upgrade. Am I vulnerable? Only if you plan to use (it is not deployed yet) TSTORE and transfer/send functions. However, if you consider transfer and send functions as reentrancy is safe, please stop. I am a dev. How to be safe? Do not use transfer and send functions as reentrancy protections. Rethink the flow of external calls in your contract and follow Check-Effects-Interactions pattern or use modifiers to protect from reentrancy. What is Transient Storage? It is something between memory and storage. Those variables are stored in the contract for the whole execution of the transaction, including reentrant calls (unlike memory which is kept only for the current call context) and cleared after the transaction is finished (unlike storage which is kept permanently). What’s the issue? Basically, the pricing of opcodes. SSTORE price was lowered in some cases in EIP-1283 and TSTORE is going to be cheaper by design (that’s actually one of the reasons why it was created). On the other hand, transfer and send functions were considered reentrancy safe, because they were limited by 2300 gas (docs.soliditylang.org/en/v0.…). When the storage manipulation becomes cheaper, you can fit these operations in 2300 limit. That resulted in cancellation of EIP-1283 and introduction of it’s fixed version in EIP-2200. Should TSTORE be “fixed”? As in case of EIP-1283 it would result in reentrancy for existing contracts and their storage, in case of TSTORE the vulnerable scenario would be valid only for new type of storage - transient storage. In the end, nowadays we see very rarely transfer and send functions as most of the calls are made through safeTransfer (which is the call function). So it does not change much anyway 🙂

During #Web3SecurityConference2023 organized by @DeDotFiSecurity, @drdr_zz mentioned that over 2 billion dollars were stolen in the bridges’ hacks 😱 After recent events to this number, we can add another 99 million lost during the HTX (Huobi) exchange and the Heco bridge hack.

Before we share with you the first results from the ongoing research supported by the @UniswapFND grant about the „malicious design space" of hooks, we recommend you read our previous work. An article about secure integration with Uniswap v4 packed with potential threats that you should be aware of. Read the article at the link below: composable-security.com/blog…

Yesterday we had the pleasure of sharing our knowledge at the #ETHWarsawMeetup. @drdr_zz gave a presentation full of lessons learned from others' mistakes and amazing security tips. We are grateful to the @ETHWarsaw team for this opportunity and for gathering such a community.

How do you choose an audit firm?

👉 Read our 𝟭𝟰 𝗲𝘅𝗽𝗲𝗿𝘁 𝘁𝗶𝗽𝘀 on how to take care of #NFT security. • learn the most important risks related to NFT • understand in which areas there may occur vulnerabilities • learn how to eliminate the indicated threats ✅ composable-security.com/blog…

Impersonating other users on @github is a relatively easy thing to do 😱 Even though it is not a critical safety issue, being aware of how it’s done and how to protect from being impersonated is important to build multiple layers of security and introduce good security practices in your mail work basis. Read our recent blog article to learn more about it: composable-security.com/blog…

👺Hackers are waiting for your lack of vigilance Stay safe during the holidays with these 5 tips 🎁 1. Make sure someone is supervising the monitoring. Prepare with: 2. securityalliance.notion.site… 3. securityalliance.notion.site… 4. securityalliance.notion.site… 5. In case of problems - contact SEAL 911 t.me/seal_911_bot Stay safe, be ready and don't let your users down. As @samczsun said, you have no excuses.

Is your multi-sig really multi-sig? The short story by @drdr_zz about the Ronnin Bridge hack 🎬

We look forward to @summit_defi, and YOU should too! Last time there were lots of interesting presentations full of high quality knowledge and technical details ⛓️ It would be great to contribute and share something special this year.

Let us present you with a Multi-sig hook 😎 How does it work and what are the threats related to using it? Read @drdr_zz thread👇

We're committed to providing the highest level of quality and accuracy for our clients so our methodology is constantly evolving to keep up. We're always here to help you increase the security of your project. 👉 Read how we do it composable-security.com/blog…

Do post-audit corrections cost you a lot of time&money? If you answered “yes” then you 𝗱𝗼𝗻’𝘁 𝘄𝗮𝗻𝘁 𝘁𝗼 𝗺𝗶𝘀𝘀 𝗼𝘂𝗿 𝗮𝗿𝘁𝗶𝗰𝗹𝗲 about AI-driven threat modeling. 👉 Be ahead of the competition and try this innovative approach composable-security.com/blog… #DeFi #TM