Security Education and SmartContracts Security Audits. https://xitter.cf/t.co/2W7QBxEiHz - https://xitter.cf/t.co/blRBEsALE1
Mexico y Latinoamerica
Joined August 2024
- Tweets245
- Following131
- Followers88
- Likes98
Initia halted its chain and rollups after a reported exploit involving unauthorized token creation and ~$2.6M in outflows.
Security lesson: mint permissions, supply invariants, bridge limits, and circuit breakers are critical.
seclat.xyz/en/blog/initia-ha…
thehackernews.com/2026/10/ph… update your PHP to avoid being hacked by this vulnerability!
Solving the Ethernaut Level 11: Elevator. Learnign about interfaces, view functions and how the compiler works with them. seclat.xyz/en/blog/Ethernaut… #Security #smartcontracts #Ethereum
5/7 Treating 408.5M NTX as a nominal loss is misleading. Thin liquidity limited realizable proceeds, so supply or spot price cannot establish what could actually be extracted.
6/7 Audit lessons: least-privilege permissions, key rotation and revocation, full signing-context binding, symmetric caps, rate limits, invariant monitoring, and a tested incident-response plan.
7/7 Bridge audits must cover contracts, signing services, key custody, limits, and incident response. Read our Fetch.ai/NuNet incident analysis: seclat.xyz/en/blog/fetchai-n…
3/7 Athena's preliminary report says a 1M FET cap may not have covered conversionIn, and the signed message may not have bound the recipient. These report-based findings need confirmation.
2/7 Fetch.ai confirmed a compromised signing key. Available evidence points to misuse of valid authorization, not an authentication bypass in the FET token contract.
6/7 A static review of App Wallet 9.2.1 flagged a remote web interface, missing origin checks, blind-signing risk, an unsigned remote engine, and no certificate pinning. These are serious review targets, but they do not prove causation and do not assess v10.0.0.
7/7 Wallet security goes beyond key storage. Signing flows must reveal network, recipient, asset, amount, and approval consequences. Shared seeds erase hardware isolation. Analysis: <seclat.xyz/en/blog/dcent-app…>
We will also understand:
What reentrancy is.
Why external calls are dangerous.
How attackers drain vulnerable contracts.
How receive functions work.
How to build a recursive attacker contract.
2/3
How to validate the exploit using Foundry and Sepolia.
How to properly defend against reentrancy vulnerabilities.
seclat.xyz/en/blog/Ethernaut…