kaleidawave

Trying Ezno checking today

This a short overview of some of the things you can do with Ezno today. If you find any problems, file an issue.

The following examples show some errors that have been caught using type checking, partial/const evaluation and effects.

To get started we will install oxidation-compiler which has bindings for Ezno's checker. (you can also get the binary from the releases page).

npm install -g oxidation-compiler@latest

taarushv

// TX 1 - Admin wallet enables trading on FCKIT token https://etherscan.io/tx/0x12b949cf5605bb4da83efd14b6d38ad628a9ebf3befb42141d2ddb8cfc43d53e
// TX 2 - Searcher uses a proxy contract to buy ~2B FCKIT --for 60 ETH-- into multiple wallets (and to pay builder for gas fees/rebate) https://etherscan.io/tx/0xc3a37580a96b52a718a5b516dfef209f150e87a75032c725536821ea0d6cc875
// TX 3 - Rebate is forwarded from the flashbots builder back to the user https://etherscan.io/tx/0x80dc2721d833cd221bdf9264f1138a88907f57303bc606f8ee4034297201e095

const { ethers } = require('ethers'); // v5
const rpc = "https://mainnet.infura.io/v3/YOUR_API_KEY_HERE"
const provider = new ethers.providers.JsonRpcProvider(rpc)

// uni v2 router, to fetch trades using logs
const uniPool ="0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D"

recmo

#![cfg(all(target_arch = "aarch64", target_feature = "sha3"))]
use core::arch::asm;

const RC: [u64; 24] = [
    0x0000000000000001,
    0x0000000000008082,
    0x800000000000808a,
    0x8000000080008000,
    0x000000000000808b,
    0x0000000080000001,

engn33r

#!/bin/bash

# This script is a hacked together PoC, don't trust it to work well
# For proper detection of vulnerable contracts, recursive testing must be performed because CREATE2 in a contract's ancestry could be problematic: https://medium.com/@jason.carver/defend-against-wild-magic-in-the-next-ethereum-upgrade-b008247839d2#3f90
# Improved tool and full research coming from yAcademy next month: https://twitter.com/yAcademyDAO

contract_addr="0x0d4a11d5eeaac28ec3f61d100daf4d40471f1852" # default value is a uniswap V2 pair from https://v2.info.uniswap.org/pairs
etherscan_api_key=""

if [[ -z "$etherscan_api_key" ]]; then

ttesmer

{-# LANGUAGE TypeSynonymInstances #-}
data Dual d = D Float d deriving Show
type Float' = Float

diff :: (Dual Float' -> Dual Float') -> Float -> Float'
diff f x = y'
  where D y y' = f (D x 1)

class VectorSpace v where
  zero  :: v

Saw-mon-and-Natalie

# ▇ => ▇ + ▇
# Minimal runtime bytecode for a contract that mutates 
# into two child contracts and then self-destructs
# 1st child contract receives the call value
# 2nd child contract recevies the remaining balance
# author: Saw-mon and Natalie

# constructor payload for the spawned contract
 
#       ┏━━━━━━━━━━━━━━━━━━━ push1 RUNTIME_BYTECODE_LEN         # L

rossgalloway

July 9th 2022 Governance Attack Postmortem

Original Gist published shortly after the attack: https://gist.github.com/ethedev/248f931dbb29d054a9366fe43f37d42e

This document expands upon and cleans up that document to make it easier to follow.

Important Wallets and Actors

Attacker

VictorTaelin

Ethereum

Deploy contract:

Code:

pragma solidity >=0.4.22 <=0.9.0;

sambacha

//https://github.com/jupyter-widgets/ipywidgets/blob/master/scripts/package-integrity.js
var readFileSync = require('fs').readFileSync;
var writeFileSync = require('fs').writeFileSync;
var ts = require('typescript');
var glob = require('glob');
var childProcess = require('child_process');
var path = require('path');

// Packages to ignore
var IGNORE = {

EllyLoel

/*
  Made by Elly Loel - https://ellyloel.com/
  With inspiration from:
    - Josh W Comeau - https://courses.joshwcomeau.com/css-for-js/treasure-trove/010-global-styles/
    - Andy Bell - https://piccalil.li/blog/a-modern-css-reset/
    - Adam Argyle - https://unpkg.com/open-props@1.3.16/normalize.min.css / https://codepen.io/argyleink/pen/KKvRORE

  Notes:
    - `:where()` is used to lower specificity for easy overriding.
*/