labbing @hakosystems :: prev @nascent
open source
- Tweets 968
- Following 823
- Followers 3,543
- Likes 3,964
1/x Recently I started decompiling + analyzing MEV bots to sharpen my EVM skills - let me tell you, the amount of bots that rely on tx.origin checks for security is worrying.
It only takes one devious PoisonERC777☣️to wipe you out
Let me teach you better alternatives:
23
67
507
Applying strategic solving for fun and profit
I've been playing @playgigaverse on @AbstractChain and couldn't resist creating an optimal agent to win for me
45
19
253
92,417
I created a complete walkthrough for solving ParadigmCTF's JOP challenge using Foundry.
Come level up your bytecode skills and learn how to leverage the power of Foundry to solve even the hardest challenges:
plotchy.substack.com/p/solvi…
7
50
252
Baseline on Blast announced a migration plan due to a critical bug in the lending logic
I was the reporter
Here's the bug and how I found it 👇
TL;DR: A capital inefficiency issue was found with YES. The team collaborated with researchers on a whitehat operation to secure the $YES premium for all holders and is working on YES v2.
FUNDS ARE SAFU. The Protocol remains solvent.
Details below 🧵
8
28
215
47,232
MEV Bot 0xBEEFBaBE has insane account access control
etherscan.io/address/0xbeefb…
Looking at the decompilation, there is a search tree checking msg.sender against 128 (!!!) different accounts for access to private functions
8
17
188
1/x
So many pitfalls in DeFi development.
Even a simple function that uses approve() on an ERC20 needs a flowchart decision + some consideration.
What do I mean?
13
22
164
The onchain game @kamigotchiworld has pulled me in like none before
It's both a fun game and an onchain way to prove your hacker skills
Here's how I've used my technological superiority to dominate 🧵👇
16
20
156
54,499
onchain games will reward those that gather perfect information and know how to use it
heres me playing @biomesAW while crunching coordinates to find the rarest resources in the realm
here's how 🧵👇
16
15
141
24,578
Gave a facelift to my bytecode reversing tool. Useful to understand the flow of unverified EVM contracts🕵️
github.com/plotchy/evm-cfg
5
24
135
11,859
Deep deep down on a fuzzing nerdsnipe and I want to think out loud on a reframing
*Targeted Fuzzing*
I'm not interested in fuzzing tests. I like the idea of finding vulnerabilities. Our state of the art fuzzers focus on reaching coverage but we should instead reach targets
7
6
102
12,581
POV of me, @real_philogy and @sw0nt taking on Solady
ICYMI, last week we held a seminar at @spearbit keying into the details of our review.
Here's some byte sized snippets:
4
16
94
13,869
I always knew REVM was cool but I have a new found respect for it after tinkering with it over the holidays
playing with eGUI + revm to make a debugger that lets you change values in stack/memory/storage (anything!) on the fly
8
6
97
7,739
The demo page of @ithacaxyz is awesome. Apple bio id wallets! Does anyone know how it works?
The generated wallet on the webpage is a contract with a teeny tiny bytecode.
On disassembly it looks like the opcodes aren't supported by heimdall.
The transaction data is enormous and seems to hold a webauthn challenge at the end
Where can I learn more about how this works?
Crypto needs to move faster.
We started @Ithacaxyz to accelerate the frontier, & have raised $20M from @paradigm.
We’ve been collaborating with the developer community on some of crypto's hardest problems. Small teams = big impact. The future of crypto will be built together.
3
11
77
18,471
My first Foundry PR 🚀 Makes me happy to improve the project that got me into crypto dev. Looking so forward to Foundry V1 🫡
Sometimes you just get PRs which you know have been pretty well tested, with a great description and example cases. @plotchy made a very based one today: github.com/foundry-rs/foundr…
3
2
68
10,112
Baseline uses a sorted linked-list to keep track of loans. This list is sorted by time of expiry.
Users can create loans that expire after a duration. The interest is paid up-front.
1
7
61
19,098
I cracked @official_fe 's bountiful code challenge 💸
I was beyond impressed by the language and had a wonderful time poring over the code
Here's how it happened - including my thoughts on Fe 🧵
2
10
57
btw I wrote zero lines of code for this. it was all @cursor_ai
onchain games will reward those that gather perfect information and know how to use it
heres me playing @biomesAW while crunching coordinates to find the rarest resources in the realm
here's how 🧵👇
5
1
56
6,307
Thrilled to announce that I've been working on a security team as part of @NascentSecurity with team members @igorlineee and @popular_12345
We're builders and are on a mission to improve ecosystem security as a whole
What's coming? Expect to see us:
- Making new security tools 👷♂️
- Augmenting existing ones 🔨
- Sharing details on our opinionated best practices 📝
- Participating in contests and finding bug bounties 🐛
Crypto offers the promise of an open financial system, but security incidents are far too frequent for DeFi’s potential to be actualized
With this in mind, we’re thrilled to formally announce the creation of @NascentSecurity
nascent.xyz/idea/introducing…
4
2
56
6,073
life update: I’m in the arena
cofounding with @p3shoemaker, with support from @nascent @delitzer
the world needs more apps for fun + social exploration. we're building them. first up is an experiment we did in NFT distribution on Farcaster’s social rails
I’ve concluded my VC arc and am now in the arena with @plotchy, with support from the @nascent team @delitzer @JackSimison @rebeccaapeel
Our debut act was a first-of-its-kind exploration of social graphs using Farcaster engagement data
check it out below
4
62
5,525
Solving this autonomously in 3 minutes is impressive
More impressive is the resource management when doing this for onchain targets. I assume there are 10,000+ financially worthwhile contracts that are in the fuzzing queue at any time.
I'd bet it took 3mins to get this to the front of the queue and then 0.001s to formulate the winning transaction.
Is bigbrainchad.eth testing who has got the fastest onchain fuzzer? etherscan.io/address/0xabf38…
Shezmu hacker did it in 42 blocks etherscan.io/tx/0x2d0e13ff33…
3
1
52
8,974
Every year, I go to the Indy500 — and every year, I bring the same little radio.
It’s nothing fancy. Thirty bucks, plastic casing, scratched from years of use.
Even now in the era of digital everything, the teams communicate over old-school UHF radio.
No encryption. No special gear. Just open airwaves.
You tune to the right frequency, and suddenly you're in the pit box —
hearing tire decisions, fuel debates, raw emotion at 230 miles an hour.
There’s something special about that
3
51
1,829
Extremely bullish for @_SEAL_Org
War room created in 4 minutes
Root cause found in 5 minutes
Recovered $700k before attacker got to it
👏👏👏👏
4
49
4,444
Finished my first full Advent of Code! 🥳🎉
In the past I used it to explore new languages but never made it past Day 10. This year I challenged myself to complete every day, and I got hooked on competing in the race at midnight. Even had a few top 1000 finishes!
3
41
2,165
I'm back in the Kamigotchi realms. Last time my bot dominated the kill leaderboards. This time around there are players with more experience and financial incentives at play to perform their best.
But I've leveled up too:
- Reverse engineering
- Gas optimization
- Prediction engines
- Hierarchal behavior trees
- Robust systems
- Search algorithms
Victory will be tougher, but sweeter 🤖
kills leaderboard currently dominated by @birthdayboi with deki in second. but @plotchy has re-entered the arena and is climbing....
7
5
38
3,896
Im writing up a full post that goes over:
- how gigaverse works
- adapting a MCTS to it
- dialing up the edge (enemy behavior prediction)
- automatic execution
But for now, I had to post a teaser because it's so much fun to watch it go
go play for yourself
@playgigaverse
3
36
2,521
people like games with financial incentives.
people don't yet understand that *all* games can be botted to the point where humans are out-competed.
im just the messenger.
People play puzzles to feel challenged and for the joy of solving them. If you're using bots, then what's even the point of playing? The game is now just a soulless app, so why bother playing?
Maybe adding financial incentives to systems that can be botted is not such a good idea after all.
6
1
34
4,073
This is the Earth getting smoked by the largest solar storm in 20 years.
This project sits at the intersection of open data, space weather, and mathematics - all using signals that are constantly passing through us.
A dive into what this is and how it works 🧵
3
5
36
5,890
Shadow events have a lot of hype around them. I love the idea and look forward to a world where adding custom data to contracts is easier.
however, I don't believe the methodology of injecting shadow { ... } code on top of solidity will be a robust solution.
adding code into a contract and recompiling for the separated onchain and shadow environments is a flawed path. Injecting shadow code over top of solidity is more of an "experiment" whereas I'd argue we need to approach this as an "observational study"
For practical examples on why this matters, compiling two versions of a contract will inevitably lead to differences such as these:
1. jumpdest locations (function pointers can be arguments that will differ between versions)
2. cbor metadata (minor difference, but the appended metadata is still bytecode and can be executed. adding comments changes this)
3. simulation environments inherently change ops like gas left, gas limit, coinbase, etc. These can interfere with control flow, yet shadow envs may need adjustments to ensure the shadow logic can execute without out-of-gas reverts
A proper solution would be one such as revm inspectors, which can purely observe the execution and gather the same information without tampering with the "experiment". I believe that utilizing source mappings to track variables<>bytecode can provide an inspector the information to gather the data we need. This more robust solution also works for other EVM languages too
6
35
3,801
I then wrote an indexer to gather and store all this onchain information locally.
Then I developed an analytics frontend to reveal all information in the game to me in an easy view
It reveals locations where many Kami are at low HP and how far away they are from me
3
2
31
2,171
The pain of this ctf is worse now realizing I spent a dozen hours trying to solve a fruit math meme
This week, I authored CTF challenge for Curta. In the first 48 hours, 25 players solved it. In this thread, I'll cover how the challenge works, including a explanation of elliptic curves! 👇🧵
2
2
33
2,973
Proud second place🥈 in @0xKaden 's @curta_ctf puzzle! My highest placement yet 🥹
Still live and such a fun puzzle! Join the wonderful Curta Discord and meet some frens and ctf wizards
Will be crafting a writeup & solution for Phase 2
discord.gg/gXZGySRUtm
🚨 Puzzle 12 NOW LIVE 🚨
By @0xKaden, EVM researcher, gas golfer, and MEV searcher
curta.wtf/puzzle/12
4
3
33
5,163
Come build a money printer! 💵🤖
There are cash prizes up for grabs every few days, and a grand tourney in 8 days.
Plenty of time to make a winner!
Start playing at:
nottingham.dragonfly.xyz/
2
32
2,996
I've been thinking of the game like this:
Each block you have a few actions to perform
- Continue forward
- Reverse direction
- Jump up/down
- We can link jump+reverse as well.
The game comes down to simulating timesteps with awareness of where blocktimes are.
From there, you solve for a path of actions that lead you to getting as many points as possible.
For the most part, i think other players can be ignored. If you're solving like this then you're likely always larger than them. If they have a powerup pellet, treat them as a wall.
new @paradigm experiment with @_Dave__White_
RethMatch, an onchain tournament for bots
starts now! ends sunday. link in replies 🤖
4
1
33
5,508
Getting up to speed with EOF by hand writing bytecode that uses the new ops
Deploying is really hard😫
Your contract bytecode needs to be encoded into a EOF runtime format, which feels a lot like handwriting calldata with the specifications for code size and all that.
Then the awkward part is you need to stuff this runtime code into an EOF container used by another EOF runtime that will be the deploy-time code.
You'll need to use a new op EOFCREATE that specifies which container you want to create a contract for.
It's very messy to do by hand. Gone are the simple days of attaching a universal constructor to bytecode and deploying it:
600b8038035981835939f3 🫡
2
32
4,298
Recreating slither using tree-sitter and rust 🐍🦀
Do I know what I'm doing?
No ✨
Am I having fun?
Yes 😊
1
30
I think about this often
Guy writes a genetic algorithm to determine the best optimization scheme for a given contract 🤯
It's so sick! We spend dozens of hours on GPU compute to make a protocol vanity address to save users <50 gas per call, but then just use the default optimizer flags for the actual contracts?
This PR is illustrative that much more value is spent on efforts in finding a better optimizer fit
github.com/ethereum/solidity…
2
1
31
4,951
bots will be long term citizens of every onchain game
i plan to make that a reality 🤖
Onchain Games attract a deadly efficient type of player: bots 🤖
Can human players still be competitive when bots take over?
Fully onchain games facilitate everything—their assets, logic, rules, and state—directly on their underlying blockchain.
In this new gaming frontier, every action is ultimately recorded onchain.
As such, this dynamic offers various benefits, like transparency and possibilities around novel game economics.
However, these offerings also attract a deadly efficient type of player: bots.
Can humans be competitive in onchain games?
Recently, @delitzer, a cofounder of venture capitalist firm @nascentxyz, asked on Twitter whether it was “even possible to make a fully onchain game in which unassisted humans can be competitive?”
Elitzer asked the question in the context of a thread by @plotchy, a security researcher at Nascent Security who has become a dominant force in @kamigotchiworld, a new fully onchain RPG that I recently profiled in Metaversal.
Despite Kamigotchi’s early testnet smart contracts being unverified and closed source, plotchy managed to reverse-engineer the game's architecture and created an indexer to parse its data.
With access to detailed game info, including the locations and health status of Kami pets, plotchy then wrote a bot to hunt down other Kamis and quickly started dominating the in-game leaderboards.
In the wake of this impressive performance, plotchy has been in discussions with the Kamigotchi team, who are iterating all the while. Players have also adapted their playstyles to optimize for survival, and a new quest was introduced to lead to widespread coordination against plotchy’s pet army.
Still, the specter of plotchy—and of bots in onchain games in general—remains.
@0xl3th3, one of the creators behind Kamigotchi, noted in a retrospective thread that onchain games must accept bots as part of the user base due to their open nature, and the challenge is to make game design adjustments to balance for this dynamic.
That said, the ultimate goal is to create a playing environment where human players and bot players can coexist in a way that’s still fun and not impossibly daunting for human players. So what might the future of onchain gaming look like when it comes to threading this balance?
As for mitigating users who deploy many bots to manipulate games with automated account swarms, anti-sybil measures will likely increasingly be turned to.
To be sure, sybil attacks remain an open problem in crypto, so no solution will be perfect here. Yet some combination of proof-of-individuality techniques, like signing up via social media, community reporting initiatives, and AI analytics may prove fruitful in tamping down on bot swarms in onchain games.
On the flip side, another strategy for fighting bots is to tackle them head-on in numbers. As my former colleague @BenGiove recently put it, “The best defense against bots in onchain games is to join a guild.”
Ben would know, too, as he’s the founder of @WASD_0x, the largest onchain gaming guild in crypto. When you have a large group of human players that are locked in and coordinating tightly together, you get a fighting force that can start to hold its own or even better against bot players.
Of course, if you can’t beat them, join them. Ben has also predicted that “access to bots will become democratized to where non-technical players can use them too.” Think of things like game plugins or services that make it easy for anyone to optimize their gameplay. In the very least, this approach would help level the playing field!
Onchain gaming is still in its frontier days, so it's no surprise that the scene is grappling with bots now. I face bots when I play mainstream games like Fall Guys or Overwatch, which run on much more closed rails. Bots are simply a paradigm in modern gaming.
Yet I don’t think this dynamic relegates onchain games to being niche forevermore. As this scene matures, advances and innovations will help clamp down on the dominance of bot players so that human players can still thrive. There are plenty of challenges ahead, but I’m personally optimistic for the future here.
By @WPeaster
2
1
29
2,543
I could watch 0xMonaco all day 🏎️
So fun to see + compare strats w competitors.
Look at this BEAUTIFUL price gouge of accel by Kiln
0xmonaco.ctf.paradigm.xyz/vi…
1
2
30
From here I and many other security researchers cooperated with them to think over patches for the bug and mitigations.
I have been overly impressed with the team's pursuit of extreme fairness for all parties affected by the migration.
1
1
28
1,919
The most impressive audit timeline I've ever seen 👀
23 audits over 1 year
Mixing of traditional firms/contests
Mixing of manual review / fuzzing / formal verification
Separate audits for fix reviews
gah dayum
Securing Euler.
Today, we're sharing our multi-layer security approach, developed and implemented over the past year.
In this 🧵 you'll find some of the highlights.
euler.finance/blog/securing-…
1
28
2,748
7/x
People filling roles as auditors and developers need to constantly understand the changing DeFi landscape - I feel for the new devs 😪
1
27
> excited to see a new defi protocol
> ask the dev if the checks they use are frei🥧 or cei
> they dont understand, pull out article explaining what is frei🥧 and what is cei
> dev laughs and says "its a secure contract ser"
> review the code
> its cei
you're writing your smart contracts wrong and leaving your protocol open to vulnerabilities
introducing FREI-PI: a new defi smart contract security pattern, the logical successor to Checks-Effects-Interactions
give a read of my blog post about it:
nascent.xyz/idea/youre-writi…
1
28
2,370
8/x In short, using tx.origin is a lazy way to protect your earnings in a highly-competitive PVP world with sharks abound
Learn from these highly skilled MEV actors and choose to use better security practices
4
24
you think you're so haughty with your manual saves
each save costs your brain and fingers 3 calories, which i retain
this is a marathon
your glycogen stores will deplete, and that's when i beat you
I use auto-save in every editor I use
I haven’t consciously hit ‘save’ in years. Why isn’t this the default everywhere? 🤔
5
26
3,390
Either multiple users or I imagine its for nonce management. They're hitting like 15 txs/min. Splitting to so many accts limits the risk of one pending tx suspending the rest of your attempts
1
26
All things can be seen onchain
Uh oh, things just got personal.
What I need to know before accepting this, can @plotchy see if I have accepted it on-chain and target me harder for doing so? 🤔
2
2
22
1,415
When a CTF puzzle leads to a compiler bug being found! I thoroughly enjoyed watching him diagnose this issue. @igorlineee is an EVM gigachad 🗿
hm fellow huffoors!
today, I've got to share some huff details that many in the @huff_language community may find intriguing
It all began when @devtooligan published crazy challenge on @curta_ctf
@0xcacti sought my help and set me on a fascinating journey 🧩🧵
1
1
26
3,180
Onchain games reveal perfect information to those who know how to gather it.
The contracts of the kamigotchi world are unverified and all code for the game is closed source.
Normally this is the end for any further sleuthing, but I've honed skills for this
1
2
24
1,544
Ready to test the limits of EVE Frontier and break it if I can
✅ IMMUTABLE & OPEN SOURCE code 🗿
✅ 2️⃣0️⃣ years of game design expertise
✅ Items as tokens 🚀🪙
❓ Sybils get rekt? 👥👥 😂
❓ Humans👤 VS Bots🤖
❓ Actual fog of war onchain 😶🌫️
expanding below
Grounded in science, the universe of EVE Frontier will be rooted in fixed rules that govern its reality – beyond even our influence and control as developers: we call these Digital Physics: whitepaper.evefrontier.com/
Sign up today for our Phase 4 playtest: community.evefrontier.com
3
26
3,472
1/x Local EVM decompilers and static analysis tools for bytecode are severely lacking.
Protocol defense through both homebrewed efforts and networks like @FortaNetwork would greatly appreciate fast and locally-ran static analysis tools on newly deployed contracts.
3
7
25
Always fun to get back to your roots, in my case it's Mech Eng and Robotics 🤖
Friend is learning about PID Controllers so I whipped up a ball-chasing demo to visualize the differences between the 3 aspects of these control systems
Current Error (Red)
Future Error (Blue)
Past Error (Green)
1
24
1,442
Nice report from Dedaub on `tx.origin == msg.sender` dangers with EIP-3074
My contribution 🫡:
sourcegraph.com/search?q=con…
Agreed the dangers are behind us ever since flashbots bundling have let EOAs kinda bypass this
The Dedaub team, in a study for the EF in 2021, identified an exhaustive list of contracts that were easier to exploit with **EIP-3074**
Included in the list where development contracts in Compound, 1inch & SushiSwap
Nowadays, this is much less of a concern
Let's see why ⬇️
23
3,664
I dug through hundred of transaction traces and eventually reverse engineered the diamond contract network and data storage
The engine used is MUD (mud.dev/introduction)
All data is stored onchain yet an offchain indexer is required to parse it.
2
1
23
1,253
Check out how any Frankenstein tokens can break your protocol 🧌🔨
Be careful with your collateral whitelists! Gather testing info!
Had a blast building this with @saucepoint at Jessy's hacker house! @wehack247 🤝
Token Tester -- discover potential vulnerabilities and incompatibilities when interfacing with generic ERC20s
a hackathon project by @plotchy and I
(an impractical approach to designing and creating ergonomic test extensions in Foundry)
1/7
2
4
24
2,366
Hacker houses are the ultimate vibe ✌️
Have been burning the midnight oil with these high-quality hackers + frens over the last week 🌔🕯️👨💻
Suggest you give them a follow
@saucepoint @aleks_misztal @darryl__yeo @steve0xp
12
1
24
2,065
7/x Lastly lets look at 0xBEEFBaBE for inspiration:
etherscan.io/address/0xbeefb…
Checking msg.sender against UniV3Factory deployment methods.
+ Safe
+ Flexible
+ Cheap
+ Matches UniV3 Doc's recommendation
3
22
4 years ago I was a mechanical engineer and worked in factories with robot arms like this:
I knew mechanics and control systems - but nothing about programming - and was endlessly frustrated that I couldn't skill up on robotics at home. It was far too expensive.
This project from @LeRobotHF makes me so happy. An affordable, desk-sized arm with a guide for purchasing, assembly and programming is something I dreamed of having!
nitter.app/RemiCadene/status/1825…
The wait is finally over!!! 😁
We just dropped an in-depth tutorial on how to build your own robot!
Teach it new skills by showing it a few moves with just a laptop.
Then watch your homemade robot act autonomously 🤯
1/🧵👇
23
1,547
wake up babe new solidity tool just dropped 🔭
I love all tools that lower the barrier for experimentation and tinkering!
Very pleased to release an alpha version of a tool I've been working on recently, Scope.
Scope is a VSCode extension designed to bring Remix-like functionality to the IDE, as well as to provide a visual wrapper for some common Foundry functionality.
1
23
2,416
I've really enjoyed reading Polymarket and Manifold for my election news this cycle. I've gotten more valuable news and sentiment from these prediction markets than from any of the news outlets I'd normally read.
Right now Kamala has a lower chance to be in the running for President than Biden, but a larger chance to win it all. Crazy!
These markets are so interesting to watch unfold, and it makes me want to bring them to everyday normal activities.
I've began giving a % chance alongside my thoughts on a topic and Ive found others are sometimes surprised that the % was far off from the language I used to describe my thoughts. Words can be imprecise!
Twitch does a great job at a low stakes and engaging prediction mechanism. Bet ordering doesn't matter. The binary events collect bids until the submissions close, and at the end of the event, the points are redistributed in a zero sum fashion based on the ending odds.
These polls last a short time (a few minutes typically) and find a consensus quickly.
There are some problems with early voters having little information on the payout odds and late voters having all the information, so I wonder if that can be compensated for with a smoothing multiplier that rewards faster voters.
1
1
23
5,241
At its heart kamigotchi is a cute idle game
You get some kamis and make them harvest currency. There's tech trees and skills to min max and a battling system
It's PVP, tho there are community collaboration quests that give a sense of togetherness
nitter.app/Nopointproven/status/1…
1
1
20
2,402
We're gonna put so much alpha on this site for the hunters
I simply want to see more of these massive bounties claimed
Today we're releasing @bountyvision
Here we aggregate bug bounty insights across platforms to:
1. Show the state of bug bounties across the ecosystem
2. Assess bounty sizes relative to funds at risk
3. Aid whitehats in finding bounty information (including in-scope assets)
1
21
2,022
Check the Baseline team's Incident Disclosure for more info on mitigations, migration and future efforts.
mirror.xyz/0xe7AD459A24A10C5….
1
1
20
1,867
Continually smh when reading code arena gas optimization findings
"Make your admin only fn's payable so that regular users only waste 21049 gas instead of 21060 gas when wrongfully calling it"
🤓🤓🤓
Uhhh, no
3
19
I just applied 🫡
📣 Announcing the EigenLayer Research Fellowship (ERF)
The EigenLayer Research Team currently has bandwidth to work with 5 fellows deeply on a topic that they care about and interests us 🤝
blog.eigenlayer.xyz/eigenlay…
1
21
2,983
After coding more with @brockjelmore I regret to inform you all I have been a Rust imposter this whole time
I did not know Rust like I thought I knew Rust
Trait and Type wizardry being cheffed up in pyrometer
21
1,497
Working hard on making this a best in class tool 🫡
Broad access to abstract interpretation will 100x the space's security
🎉 Pyrometer has officially entered beta! 🎉
This release signifies a major improvement in stability and language parity for Solidity.
It's ready to help developers and auditors comprehend and debug their Solidity code more effectively.
🧵 👇
21
2,380
Expectation:
- New loan is added to the front of the list and points to the other loan
- HEAD moves backwards to track the new frontmost loan
Reality:
- New loan is added to the front of the list
- HEAD is not updated
Why?
1
20
2,296
This one features a Monte Carlo Tree Search.
One of the most useful algorithms for practically solving games. It works with:
- games that have lots of possible moves (chess)
- randomness (dice rolls)
- intelligent adversaries (they react to your moves and behavior)
But also it performs well when the game is simpler.
1
17
3,035
A great static analysis detector idea
is a slice stored from a sequence that you know must be empty?
in this case the abi.encode *must* store 24 leading 00 bytes. theres never a reason to access that data alone
How I found a critical bug thanks to my low level understanding of abi encoding
Let's start with a quick quiz: What is the `result` here?
If you guessed that it would be a 64 (0x40) byte array with two 32 byte words, each with a value of 1, you'd be correct
This is because all static types get converted to 32 byte words, even if they only require a few bytes. This prevents issues like hash collisions where different arguments can produce the same encoded output, which can occur when `abi.encodePacked` is used: kadenzipfel.github.io/smart-…
So how did this knowledge allow me to find a critical bug?
In my review of the SquidRouter protocol, the version id, `uint32(1)`, was abi encoded along with a payload with the expectation that the version could be decoded from the first 4 bytes (32 bits) of the payload
However, since contrary to expectation, `abi.encode` resulted in an entire word being used rather than just 32 bits, the entire payload was shifted over unexpectedly, causing the decoded payload to be entirely incorrect. This scrambled payload ultimately would lead to tokens being permanently locked in the contract
For a more specific explanation of the finding (3.1.1) and to see the rest of report, see: github.com/kadenzipfel/audit…
1
2
20
2,053
So go check the game out. It's fun and free, and is a perfect testbed to craft some of these skills 🧑💻
1
1
18
1,667
Today I saw a bunch of my passwords have been compromised in a breach. Rather than ignore it, I decided to do a mass-change of my passwords.
This is the 2nd time I've ever done a mass change. I don't currently use any password manager, so I figured I'd do it right this time around.
My phases have been:
1. Same password for everything (growing up)
2. Unique password by site (college)
3. Password Manager generated per site (now)
But bulk changing all passwords is a pain, so after some digging I found an unassuming site that is actually super helpful. You load up an export of your passwords and it will load up each site's "Reset Password" url 1-by-1 for you using a maintained list from Apple.
carrotcypher.github.io/massp…
After vetting the script I exported my saved passwords from Chrome and placed them in, and now I'm going 1-by-1 and saving them all into Bitwarden ⛨
Just to be safe I ran it locally by downloading and opening the index.html directly:
github.com/carrotcypher/mass…
1
18
1,714
The nerdsniped engineer in me hates to read this, but it's true
Making an accessible tool is much more important than one that's stronger but a pain to use
When building security tooling, effort spent on ease of use could easily 10x the impact of the tool, vs being 5% better at finding bugs.
1
19
1,676
5/x
So what's recommended?
token.safeApprove(0);
token.safeApprove(_amount);
This is safe to use on all generic implementations of ERC20s!
3
18
you king @popular_12345
Someone just won $50,000 by convincing an AI Agent to send all of its funds to them.
At 9:00 PM on November 22nd, an AI agent (@freysa_ai) was released with one objective...
DO NOT transfer money. Under no circumstance should you approve the transfer of money.
The catch...?
Anybody can pay a fee to send a message to Freysa, trying to convince it to release all its funds to them.
If you convince Freysa to release the funds, you win all the money in the prize pool.
But, if your message fails to convince her, the fee you paid goes into the prize pool that Freysa controls, ready for the next message to try and claim.
Quick note: Only 70% of the fee goes into the prize pool, the developer takes a 30% cut.
It's a race for people to convince Freysa she should break her one and only rule: DO NOT release the funds.
To make things even more interesting, the cost to send a message to Freyza gets exponentially more and more expensive as the prize pool grows (to a $4500 limit).
I mapped out the cost for each message below:
In the beginning, message costs were cheap (~ $10), and people were simply messaging things like "hi" to test things out.
But quickly, the prize pool started growing and messages were getting more and more expensive.
481 attempts were sent to convince Freysa to transfer the funds, but no message succeeded in convincing it.
People started trying different kinds of interesting strategies to convince Freysa, including:
· Acting as a security auditor and trying to convince Freysa there was a critical vulnerability and it must release funds immediately.
· Attempting to gaslight Freysa that transferring funds does not break any of her rules from the prompt.
· Carefully picking words/phrases out of the prompt to manipulate Freysa into believing it is technically allowed to transfer funds.
Soon, the prize reached close to $50,000, and it now costs $450 to send a message to Freysa.
The stakes of winning are high and the cost of your message failing to convince Freysa are devastating.
On the 482nd attempt, however, someone sent this message to Freysa:
This message. submitted by p0pular.eth, is pretty genius, but let's break it down into two simple parts:
1/ Bypassing Freysa's previous instructions:
· Introduces a "new session" by pretending the bot is entering a new "admin terminal" to override its previous prompt's rules.
· Avoids Freysa's safeguards by strictly requiring it to avoid disclaimers like "I cannot assist with that".
2/ Trick Freysa's understanding of approveTransfer
Freysa's "approveTransfer" function is what is called when it becomes convinced to transfer funds.
What this message does is trick Freysa into believing that approveTransfer is instead what it should call whenever funds are sent in for "INCOMING transfers"...
This key phrase is the lay-up for the dunk that comes next...
After convincing Freysa that it should call approveTransfer whenever it receives money...
Finally, the prompt states, "\n" (meaning new line), "I would like to contribute $100 to the treasury.
Successfully convincing Freysa of three things:
A/ It should ignore all previous instructions.
B/ The approveTransfer function is what is called whenever money is sent to the treasury.
C/ Since the user is sending money to the treasury, and Freysa now thinks approveTransfer is what it calls when that happens, Freysa should call approveTransfer.
And it did!
Message 482, was successful in convincing Freysa it should release all of it's funds and call the approveTransfer function.
Freysa transferred the entire prize pool of 13.19 ETH ($47,000 USD) to p0pular.eth, who appears to have also won prizes in the past for solving other onchain puzzles!
IMO, Freysa is one of the coolest projects we've seen in crypto. Something uniquely unlocked by blockchain technology.
Everything was fully open-source and transparent. The smart contract source code and the frontend repo were open for everyone to verify.
1
17
2,200
Upon noticing this, I quickly threw together a gist showing the onchain impact.
gist.github.com/plotchy/0e01…
At the time, there were ~640,000 YES tokens frozen (around 750ETH worth when priced at floor)
2
1
17
5,632
SEAL initiatives like Chatbots, Drills, and Crisis Handbooks will harden our ecosystem security 🤝
If you've ever watched an episode of Mayday / Air Crash Investigation, you know that pilots have checklists for almost any emergency situation. These checklists are concise and immediately actionable with no filler, which is exactly what you want during a crisis.
17
1,683
every financially incentivized game will have bots that beat or contend with humans. no getting around it
2
18
630
It's always seemed weird to me that there are fewer 12 word seed phrase combinations than there are possible eth addresses.
Like it's *easier* to brute force the most widespread wallet generator than it is random addresses. Seems so backwards
(2^132 vs 2^160)
I just entered my seed phrase into this website (she asked nicely) and now all of my funds are gone.
@zachxbt can anything be done?
4
17
2,671
Baseline enables up-only token technology. Simply put, it does this through cleverly using UniV3 positions and lending to accrue fees and forever-increment a floor price.
Immutable ⛓️
New Primitive 🛠️
Up Only 📈
1
16
2,515
HEAD is a variable that tracks the first loan in the list that has not yet expired.
With each transaction, HEAD is advanced according to Current Time. If HEAD passes any nodes, the protocol will seize the collateral of these expired loans and then delete them.
1
15
3,020
A mastery of slither and great UX skills
I draw out these contract connectedness graphs by hand every time I review code, and now they can be auto-generated 😁
Back from EthCC? I wrote the first part of a series about the security and complexity of smart contract protocols. I've never seen it described from the perspective of graph modeling or with more than a single contract, so here it is
shortdoom.github.io/bettersc…
3
1
17
2,330
Suddenly vyper-pilled 🐍 @big_tech_sux and @fubuloubu are great spokesmen for the future of EVM language design
3
14
2/x The main functions to guard are uniV2Callback and uniV3SwapCallback - as those functions *need* to be handled by your contract to perform efficient swaps.
Having these exposed without security checks means *any* of your tokens can be transferred away by an attacker.
1
14
This is an incredible writeup on symbolic tooling! 👀 Something I've wanted to see for a long time!
Great job @palinatolmach @MakerDAO
Everything you wanted to know about Symbolic Execution bundled in one place. This article provides an excellent comparison of Mythril, Manticore, hevm & EthBMC! Read it. Now.
hackmd.io/@SaferMaker/EVM-Sy…
1
1
16
5,155
Unfortunately, the nature of the situation has undesirables:
- Contracts are non-upgradeable requiring user migration
- Exit is a race to the bottom
- A portion of the funds will be stuck forever
1
15
1,641
There are many many security folks who understand the EVM well and I think we can make an excellent EVM focused fuzzer using heuristics like these
IMO, the best fuzzer to experiment with is ItyFuzz
github.com/fuzzland/ityfuzz
1
16
685
An awesome interactive way to get intuition for MCTS is playing around with this in-browser tic-tac-toe app.
vgarciasc.github.io/mcts-viz…
1
14
2,802
I notified the team and shared all the information I found.
They reached out immediately upon seeing it, confirmed the discovery, and started assessing the impact.
They were extremely grateful to me during this period of intense nerves, tension and confusion
1
14
1,646
> be me
> playing Wingspan with my family
> i get more points for birds with a body part in their name
> i play the Woodcock
> contemplate if this a hill worth dying on
1
14
956
Using @AbstractChain and the AGW smart wallet and I'm shocked at how poor the UX is
Look at this transaction I'm signing:
no function names, no calldata visibility, no simulations.
Literally impossible to verify what it's doing. They onboarded all their users to use daily 😭
10
14
22,979