You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: Blockchain Concepts/README.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -46,7 +46,7 @@ Blockchain Concepts
46
46
Who holds the private key? In the custodial wallets a third party manages the private key, in the non-custodial ones is the user who holds the keys. Usually the centraliced exchanges are the ones who provide custodial wallets and you can get the non-custodial ones using Metamask or Trust Wallet for example.
47
47
48
48
- Hot/Cold wallet:
49
-
The biggest difference between this wallets is if they are connected to the internet (hot wallet) or not (cold wallet)
49
+
The biggest difference between these wallets is if they are connected to the internet (hot wallet) or not (cold wallet)
Copy file name to clipboardexpand all lines: BugFixReviews/README.md
+2-36
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,10 @@
1
1
Bugfix Reviews
2
2
--------------------
3
-
This are the real world cases, if you are interested in learning the theory about this vulnerabilities check: [Vulnerabilities](../Vulnerabilities/README.md)
3
+
These are real world cases of bug fixes reported through Immunefi. To learn more about smart contract vulnerabilities theory check: [Vulnerabilities](../Vulnerabilities/README.md)
4
4
5
5
-[2023](#2023)
6
6
-[January 2023](#january-2023)
7
-
8
-
-[Hack Analysis: Nomad Bridge, August 2022](#hack-analysis-nomad-bridge-august-2022)
9
-
-[Hack Analysis: Beanstalk Governance Attack, April 2022](#hack-analysis-beanstalk-governance-attack-april-2022)
-[Hack Analysis: Saddle Finance, April 2022](#hack-analysis-saddle-finance-april-2022)
21
-
-[Hack Analysis: Cream Finance Oct 2021](#hack-analysis-cream-finance-oct-2021)
22
18
23
19
-[September 2022](#september-2022)
24
20
@@ -124,18 +120,6 @@ This are the real world cases, if you are interested in learning the theory abou
124
120
125
121
## January 2023
126
122
127
-
### [Hack Analysis: Nomad Bridge, August 2022](https://medium.com/immunefi/hack-analysis-nomad-bridge-august-2022-5aa63d53814a)
128
-
129
-
A routine upgrade on the implementation of one of Nomad’s proxy contracts marked a zero hash value as a trusted root, which allowed messages to get automatically proved. The hacker leveraged this vulnerability to spoof the bridge contract and trick it to unlock funds.
130
-
131
-
- Vulnerability type: CommittedRoot set to ZERO.
132
-
133
-
### [Hack Analysis: Beanstalk Governance Attack, April 2022](https://medium.com/immunefi/hack-analysis-beanstalk-governance-attack-april-2022-f42788fc821e)
134
-
135
-
Beanstalk was the victim of a whopping $181M hack, which leveraged the lack of execution delay to push through a malicious governance proposal.
The bug, which was found within Frontier — the Substrate pallet that provides core Ethereum compatibility features within the Polkadot ecosystem–impacted Moonbeam, Astar Network, and Acala. The estimated potential damage from the vulnerability amounted to approximately $200m across the three projects, which was swiftly prevented
@@ -146,12 +130,6 @@ The bug, which was found within Frontier — the Substrate pallet that provides
146
130
147
131
## December 2022
148
132
149
-
### [Hack Analysis: Omni Protocol, July 2022](https://medium.com/immunefi/hack-analysis-omni-protocol-july-2022-2d35091a0109)
150
-
151
-
The underlying vulnerability, reentrancy, was exploited across two different functions of the same smart contract. Notably, these functions were lacking reentrancy locks and did not follow the checks-effects-interactions pattern. By leveraging the re-entrancy vulnerability on two different functions and using two attacker contracts, the hacker was able to borrow against the collateral and make the market forget about it.
152
-
153
-
- Vulnerability type: Re-entrancy.
154
-
155
133
### [88MPH Theft Of Unclaimed MPH Rewards Bugfix Review](https://medium.com/immunefi/88mph-theft-of-unclaimed-mph-rewards-bugfix-review-1dec98b9956b)
156
134
157
135
Allowed users to steal most of the 88MPH tokens generated from yield contract by depositing an asset and withdrawing the vested 88mph tokens immediately.
@@ -166,18 +144,6 @@ The bug could have allowed users to drain contract funds.
166
144
167
145
- Vulnerability type: Theft of funds.
168
146
169
-
### [Hack Analysis: Saddle Finance, April 2022](https://medium.com/immunefi/hack-analysis-saddle-finance-april-2022-f2bcb119f38)
170
-
171
-
Price miscalculation when swapping a token for an LP token.
172
-
173
-
- Vulnerability type: Logic, price calculation.
174
-
175
-
### [Hack Analysis: Cream Finance Oct 2021](https://medium.com/immunefi/hack-analysis-cream-finance-oct-2021-fc222d913fc5)
176
-
177
-
Analysis of Cream Finance exploit on Oct 2021, resulting in loss of $130m in available liquidity.
178
-
179
-
- Vulnerability type: Oracle manipulation, Uncapped supply of token.
These are real world cases of bug fixes reported through Immunefi. To learn more about smart contract vulnerabilities theory check: [Vulnerabilities](../Vulnerabilities/README.md)
4
+
5
+
-[2023](#2023)
6
+
-[Hack Analysis: 0xbaDc0dE MEV Bot, September 2022](#hack-analysis-0xbadc0de-mev-bot-september-2022)
7
+
-[Hack Analysis: Nomad Bridge, August 2022](#hack-analysis-nomad-bridge-august-2022)
8
+
-[Hack Analysis: Beanstalk Governance Attack, April 2022](#hack-analysis-beanstalk-governance-attack-april-2022)
9
+
10
+
-[2022](#2022)
11
+
-[Hack Analysis: Omni Protocol, July 2022](#hack-analysis-omni-protocol-july-2022)
12
+
-[Hack Analysis: Saddle Finance, April 2022](#hack-analysis-saddle-finance-april-2022)
13
+
-[Hack Analysis: Cream Finance Oct 2021](#hack-analysis-cream-finance-oct-2021)
14
+
15
+
16
+
# 2023
17
+
18
+
## [Hack Analysis: 0xbaDc0dE MEV Bot, September 2022](https://medium.com/immunefi/0xbadc0de-mev-bot-hack-analysis-30b9031ff0ba)
19
+
20
+
A smart contract MEV bot was hacked on the Ethereum blockchain, losing around 1,101 WETH. The hack took place just 30 minutes after the MEV bot pulled off a notoriously profitable arbitration that earned it 804 WETH. Since the smart contract code is unverified, this article shows how one can go about finding a vulnerability in a smart contract by just looking at its bytecode, past transactions and a bit of PoC trial and error action.
21
+
22
+
- Vulnerability type: Lack of sufficient validation of flashloan caller leading to arbitrary function execution
23
+
24
+
## [Hack Analysis: Nomad Bridge, August 2022](https://medium.com/immunefi/hack-analysis-nomad-bridge-august-2022-5aa63d53814a)
25
+
26
+
A routine upgrade on the implementation of one of Nomad’s proxy contracts marked a zero hash value as a trusted root, which allowed messages to get automatically proved. The hacker leveraged this vulnerability to spoof the bridge contract and trick it to unlock funds.
27
+
28
+
- Vulnerability type: CommittedRoot set to ZERO.
29
+
30
+
## [Hack Analysis: Beanstalk Governance Attack, April 2022](https://medium.com/immunefi/hack-analysis-beanstalk-governance-attack-april-2022-f42788fc821e)
31
+
32
+
Beanstalk was the victim of a whopping $181M hack, which leveraged the lack of execution delay to push through a malicious governance proposal.
33
+
34
+
- Vulnerability type: Lack of execution delay.
35
+
36
+
# 2022
37
+
38
+
## [Hack Analysis: Omni Protocol, July 2022](https://medium.com/immunefi/hack-analysis-omni-protocol-july-2022-2d35091a0109)
39
+
40
+
The underlying vulnerability, reentrancy, was exploited across two different functions of the same smart contract. Notably, these functions were lacking reentrancy locks and did not follow the checks-effects-interactions pattern. By leveraging the re-entrancy vulnerability on two different functions and using two attacker contracts, the hacker was able to borrow against the collateral and make the market forget about it.
41
+
42
+
- Vulnerability type: Re-entrancy.
43
+
44
+
## [Hack Analysis: Saddle Finance, April 2022](https://medium.com/immunefi/hack-analysis-saddle-finance-april-2022-f2bcb119f38)
45
+
46
+
Price miscalculation when swapping a token for an LP token.
47
+
48
+
- Vulnerability type: Logic, price calculation.
49
+
50
+
## [Hack Analysis: Cream Finance Oct 2021](https://medium.com/immunefi/hack-analysis-cream-finance-oct-2021-fc222d913fc5)
51
+
52
+
Analysis of Cream Finance exploit on Oct 2021, resulting in loss of $130m in available liquidity.
53
+
54
+
- Vulnerability type: Oracle manipulation, Uncapped supply of token.
-[People to Follow](Check%20This%20Out/README.md#people-to-follow)
95
+
-[Resources from YouTube](Check%20This%20Out/README.md#resources-from-youtube)
96
+
-[PoC like a pro](Check%20This%20Out/README.md#poc-like-a-pro)
97
+
113
98
114
-
## How to add Resources?
115
-
Please follow the structure of the file you are editing. Whenever possible add a description of the resource you want to share. Send a pull request adding in the comment your Twitter and Discord users to thank you for the contribution and receive XP in the Discord leveling system.
99
+
## How to add Resources?
100
+
Please follow the structure of the file you are editing. Whenever possible add a description of the resource you want to share. Send a pull request adding in the comment your Twitter and Discord users to thank you for the contribution and receive XP in the Discord leveling system.
116
101
117
-
Plagiarism: Word-for-word copying of portions of another's writing won't be allowed.
102
+
Plagiarism: Word-for-word copying of portions of another's writing won't be allowed.
0 commit comments