Alpha for Auditors: The Vulnerabilities of Tomorrow
summary
Claims that auditors miss systemic risks: there are 35 ERC20 variants with different transfer semantics, integrations assume token behavior that changes (fees, blocking, rebasing), and a concrete exploit path uses an ERC777 callback price manipulation to make an off‑chain oracle return a wrong price during a deposit. Examples include protocols broken when USDC adds addresses to its blocklist and systems that never handle fee‑on‑transfer tokens; protocol‑level changes (SELFDESTRUCT, gas costs, EVM opcodes) also create new cross‑contract failures.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:54What can go wrong
- 5:58Insecure Getters
- 9:32Nongradable Assumptions
- 15:10Protocol Upgrades
- 16:10Account Obstruction
- 16:48Instable Fork
- 17:00Hard Fork
- 17:48Summary
- 18:10Conclusion
related talks
11mCommon Vulnerabilities in Bridges
43mOutsmarting Smart Contracts
15mWhy Smart Contract Audit is Not Enough
36mDeciphering Web3 Security: Implications and Innovations
12mSmart Contract Security
25mCommSec D2 - Smart Contract (In)Security
20mSolidity's most common security pitfalls and its best safeguards
51mA Deal with the Devil: Breaking Smart Contracts