BlockThreat - Week 1, 2023
GDS | GMX | RTFKT | Uniswap | Moonbeam | Astar | Acala
Welcome to the first edition of BlockThreat in 2023!
We are kicking off the new year with a number of excellent annual blockchain security reports from Immunefi, CertiK, Slowmist, and others. Devastating phishing attacks resulted in $4M+ in losses from various individuals.
On the more positive side, this week also features a number of research articles on novel tools and techniques for on-chain analysis. Bug bounty reports helped patch vulnerabilities in Uniswap and multiple Polkadot chains.
In other news, Helix CEO’s brother learned the hard way that stealing crypto from IRS to spend on strippers and luxury condos may not have been his best life decision.
News
Crypto Losses in 2022 by Immunefi.
Hack3d - The Web3 Security Report - 2022 by CertiK.
Blockchain Security and AML Analysis Report - 2022 Annual by SlowMist.
Global Web3 Security & AML Report - 2022 by Beosin.
$49 Billion Lost in Crypto in 2022 by DeFiYield Security.
Why NFTs on Magic Eden Are Unintentionally Displaying Porn, 'Big Bang Theory' Images.
Balancer is asking LPs to urgently remove tokens for several pools.
Crime
Scams
NFT influencer falls victim to cyberattack, loses $300K+ CryptoPunks.
Fake NFTs listed under verified collections on Magic Eden marketplace.
Hacks
On January 3, 2023 GDS lost $187K in a reward manipulation exploit.
Vulnerabilities
Moonbeam, Astar, And Acala Library Truncation Bugfix Review — $1m Payout by Immunefi.
Circom-Pairing: A Million-Dollar ZK Bug Caught Early by Veridise.
Malware
Contests
Mr Steal Yo Crypto Wargame by 0xToshii.
HappyNewYear CTF puzzle by Convergence Boy.
Media
Bug Patterns in Solidity and Smart Contract Auditing with Yannis Smaragdakis at SmartCon 2022
Research
Web3 Bug Bounty Hunter Thread by Adrian Hetman.
Formal Verification of Smart Contracts: Equivalence Checking of Uniswap Library by Truscova.
Solidity Attack Vectors: — #1 Contract With Zero Code Size by Jesserc.
Circumventing Layer Zero: Why Isolated Security is No Security by Krzysztof Urbański.
TrueBlocks Recipe: Factories by Thomas Jay Rush.
Tools
Guide to Web3 Data Tools by Web3 Data Degens.
OnChain Transaction Debugging Tools Thread by SunSec.
Getting Started with Phalcon 2.0 by BlockSec.
Spook - Ethereum RPC request mixer using Nym network.
Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with indicators, special reports, and searchable newsletter archives.