Skip to content

Instantly share code, notes, and snippets.

View lmanini's full-sized avatar
🐛
searching

ljmanini lmanini

🐛
searching
View GitHub Profile
@lmanini
lmanini / nerdsnipe.txt
Last active September 21, 2023 07:23
p_misirov's nerdsnipe
// https://twitter.com/p_misirov/status/1704555126365548553
// Haven't done a logic formulation exercise in a while, please let me know if I'm wrong somewhere!
// Formulation may not be the best, bear with me
X : " A did it " ; XL : " A is lying "
Y : " B did it " ; YL : " B is lying "
Z : " C did it " ; ZL : " C is lying "
// The following formulations express that :
@lmanini
lmanini / spoofed_sig.txt
Last active July 26, 2023 14:45
Spoofed signature of setProposalThreshold(uint256)
s‌e​t‍P⁠ropo⁠s⁢al‎T⁠h‏re‏s‎h‍old(᠎ui​nt⁡2⁡56؜)​
@lmanini
lmanini / mine_spoofed_sig.py
Created July 26, 2023 14:12
A python script used to find method signatures filled with invisible characters, whose selector is that of another method
import random
from Crypto.Hash import keccak
############################################################################################################
#
# To find a selector collision I need to find a hash of a string with selected first 4 bytes = 32 bits
# hence, the chances of finding a collision is 1 / 2 ** 32 ~= 1 / 4B
#
# This script runs at ~ 65k attempts/sec on my machine.
#
@lmanini
lmanini / Proxy.sol
Created June 7, 2023 20:54
Test contracts for forge selectors collision
pragma solidity ^0.8.0;
contract Proxy {
uint256 public initializer;
mapping(address => uint256) private _balances;
uint256 private _totalSupply;
string public name;
string public symbol;
@lmanini
lmanini / explainer.txt
Last active April 13, 2023 14:20
ljmanini's evm-puzzle-007 solution
GASPRICE [gasPrice]
CALLDATASIZE [gasPrice, calldataSize]
CALLVALUE [gasPrice, calldataSize, callValue]
PUSH2 0x3E8 [gasPrice, calldataSize, callValue, 0x03e8]
PUSH0 [gasPrice, calldataSize, callValue, 0x03e8, 0x00]
CALLDATALOAD [gasPrice, calldataSize, callValue, 0x03e8, *first 32 bytes of calldata*]
PUSH1 0xf4 [gasPrice, calldataSize, callValue, 0x03e8, *first 32 bytes of calldata*, 0xf4]
SHR [gasPrice, calldataSize, callValue, 0x03e8, *first 12 bits of calldata*]
MUL [gasPrice, calldataSize, callValue, 0x03e8 * *first 12 bits of calldata*]
PUSH0 [gasPrice, calldataSize, callValue, 0x03e8 * *first 12 bits of calldata*, 0x00]
@lmanini
lmanini / RetdatasizeCheck.t.sol
Created April 6, 2023 09:54
Check what RETURNDATASIZE returns in case of different reverts
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;
import "forge-std/Test.sol";
contract RetdatasizeCheck is Test {
Reverter reverter;
function setUp() public {
@lmanini
lmanini / PackedCalldata.t.sol
Last active March 29, 2023 13:56
Prove that calldata dynamic type parameters can reuse slots if they have the same value
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;
import "forge-std/Test.sol";
contract PackedCalldata is Test {
function testPackedCalldata() external {
bytes memory array1 = "";
bytes memory array2 = array1;
@lmanini
lmanini / bundleToRLP.js
Last active September 2, 2021 08:57
A function to RLP encode a FlashbotsBundle object
function bundleToRLP(bundle) {
if (bundle.signedBundledTransactions === undefined) throw Error('Bundle has no transactions!');
if (bundle.options === undefined) bundle.options = [];
const fields = [
bundle.signedBundledTransactions,
formatNumber(bundle.blockTarget || 0),
formatNumber(bundle.options.minTimestamp || 0),
formatNumber(bundle.options.maxTimestamp || 0),
import { providers, Wallet, utils } from "ethers";
import { FlashbotsBundleProvider } from "@flashbots/ethers-provider-bundle";
import { encrypt, decrypt } from "eciesjs";
import { encode, decode } from "@ethersproject/rlp"
import dotenv from "dotenv";
dotenv.config();
const provider = new providers.InfuraProvider("goerli", process.env.INFURA_PROJECT_ID);