nott

Abracadabra got hit for $1.8M in the weekend. Their third hack in 2 years. The bug? A logic flaw in cook() let attackers borrow without collateral by manipulating a status flag with a 2-action sequence. The contracts were supposed to be "deprecated".

1/16 I recently gave a presentation on OpSec at our cowork space, and someone recommended I write it down and share it. So here's how to improve your personal security in 5 minutes.

1/11 Most smart contract exploits happen when hackers break assumptions devs never explicitly tested. Invariants are your defense: fundamental rules that must ALWAYS hold, no matter how users interact with your contract. Here's how to use them to build safer protocols 👇

How do we make more protocols care about security? Having spent the last couple of months exploring the security space, I have noticed two different kinds of attackers: those who just get lucky (actually just hacking) and sophisticated attackers. The lucky ones seem to be monkey-hacking and brute-forcing their way to discovering vulnerabilities. They rarely do any prep and often execute hacks over several blocks, which opens up the door for easy mitigation/damage control. On the other hand, more sophisticated attackers often spend weeks preparing and deploying contracts that they use to execute their attacks in a single transaction, making damage control very difficult. We also see attacks where they manage to compromise several signers of multi-sigs to change critical governance or admin properties. Funnily, this behavior is kind of mimicked in the smart contract dev space. Here, we see protocols being hacked together in an afternoon by copying/pasting code from other protocols and omitting any kind of tests or audits. Conversely, there are also really well-built protocols that have several audits, thorough test suites, and follow all the best practices. Even these protocols occasionally introduce fatal bugs. Security is hard; that's a fact. We need tools that make it easy for everyone to improve security, and there are more and more good tools for this. The real challenge is convincing protocols and users to care more about security. Often, they start caring only when it's too late. We need to offer easy-to-use and affordable security solutions that everyone can set up and use in an afternoon! Collectively we all need to do better in order to make sure that crypto wins!

A day rarely goes by where I don't think about the fact that crypto picked Discord over Matrix. People argue that Discord "just works", which is true, but we of all people should be prepared to use apps with minor bugs or inconveniences here and there....