This is the 4th article of the Bridge security series. see the Part 1, Part 2, part 3. This article explains: 1. Chain id spoofing 2. Hash collision 3. Lack of signature expiry check 1. Chain id spoofing The contract used in this example is BridgeSpoofChainId.sol. This contract has
This is 3rd article of the Bridge security series. Check out Part 1 and Part 2 This article explains Arbitrary call execution with the help of two implementation specific examples: 1. Attacker steals ether. 2. Attacker tricks minting logic. Arbitrary call execution This vulnerability is possible because the bridge contract
This is 2nd article of the Bridge security series. see the Intro and Part 1. This article explains 2 vulnerabilities mentioned below: 1. Cross chain signature replay 2. Variations of signature replay 1. Cross chain signature replay test_sendMsgPermit_cross_chain_signature_replay() shows how cross chain signature replay attacks
Introduction: Blockchain bridges serve as critical infrastructure in the web3 ecosystem, enabling cross chain communication and asset transfers between different blockchain networks. this series will explain some of the common/possible bridge smart contract vulnerabilities with examples. The examples used are from my past sample project repository Blockchain-bridge-vulnerabilities. Before moving
A deep dive into my personal auditing mental model, designed to enhance efficiency, accuracy, and strategic thinking during audits. Learn how a structured mindset can help auditors assess risks. This post breaks down essential practical steps for auditors.
In this article, we will explore how to integrate Tenderly with a sample Hardhat project that implements a staking and rewards system. While Tenderly docs. will help you going through it, i believe i can give you some more idea about where things can go wrong. Before that lets check
I unearthed this article from my drafts, and given recent developments, I felt it was relevant to share. Imagine you are working in Decentralized Finance as a project to provide value to the world, you have built a revolutionary million-dollar protocol but a hidden vulnerability lurks in the code. That’
Table of contents: 1. What is Transient storage (in short) 2. Applications of transient storage (in short) 3. Usage with examples 4. Security considerations What is Transient storage (in short) : The Transient storage is the dedicated data location in EVM that behaves like a storage but this data location is
_safeMint() is sometime not safe when used without taking care, this article shows identifying and exploiting reentrancy with POC…
Have you ever noticed a need of tracing smart contract transactions while testing or learning smart contract protocols or forks?
Lets take a look of how to exploit vulnerable smart contract.