Favorite DeFi Vulnerabilities
summary
Shows concrete bugs: a single shifted bracket breaks retests because Brownie/Foundry unit tests fail; uninitialized proxy implementations let attackers self-destruct logic (the Wormhole $10M class); internal accounting errors — shares vs amounts, rounding/dust and unsafe signed-to-unsigned casts — lock funds; non-atomic deployments (Rocket Pool) let mempool watchers hijack initialization; BLS rogue public key lets an attacker forge aggregated signatures; Merkle-path-as-bitmap enables replay of the same tx; network DoS via CVE-2021-3121 deserialization overflow found by fuzzing.
AI-written summary · about
chapters (7)
- 0:00Start
- 6:23Uninitialised Impl Contracts (Proxies)
- 7:44Internal Accounting Chaos
- 9:06Unprotected Deployments
- 11:07#5: Smart Wallet Attacks
- 13:29Merkle Proofs Mishandling
- 15:30Relayer Panics
related talks
01h 33mWhite Hat Panel: DeFi Exploits
11mCommon Vulnerabilities in Bridges
20mSolidity's most common security pitfalls and its best safeguards
43mOutsmarting Smart Contracts
25mCommSec D2 - Smart Contract (In)Security
51mA Deal with the Devil: Breaking Smart Contracts
39mThe challenges of building, scaling and securing DeFi protocols
01h 16mClassic Vulnerabilities