Summary
Keywords
Full Transcript
Are you a security researcher looking to join a world-class team? Apply to open positions at Guardian here: https://guardianaudits.notion.site/Guardian-Open-Roles-a7e036d1087e4e0d8442d636fbddb655?pvs=4 Want to become an expert security researcher in a matter of months? Get the guide to becoming a senior auditor in 6 months here: https://www.intogateway.com/guide Looking for a Smart Contract Audit? Apply to work with the Guardian team on our website: https://guardianaudits.com Join our community aimed at building and sharing a wealth of blockchain and solidity knowledge to help developers/auditors of all levels transform the web3 ecosystem. https://lab.guardianaudits.com/ Videos Mentioned: 9:31 - Weird ERC20 tokens - https://www.youtube.com/watch?v=Tx0f8A2Yd3k 16:55 - Complete guide to reentrancy - https://www.youtube.com/watch?v=3T1t2ginfTg&pp=ygUVb3dlbiB0aHVybSByZWVudHJhbmN5 21:31 - 3 Red flags of inflation attacks - https://www.youtube.com/watch?v=3IMw7xbxJgY&pp=ygUUb3dlbiB0aHVybSBpbmZsYXRpb24%3D 25:22 - 4 External call attack vectors - https://www.youtube.com/watch?v=VF1HYD50eus&pp=ygUTb3dlbiB0aHVybSBleHRlcm5hbA%3D%3D 28:23 - 5 Upgradability patterns https://www.youtube.com/watch?v=e5lWvt1rIm0&t=1430s&pp=ygUSb3dlbiB0aHVybSB1cGdyYWRl 29:50 - Ethereum signature introduction - https://www.youtube.com/watch?v=9ZKY8DoVCkI&t=61s&pp=ygUXb3dlbiB0aHVybSBjcnlwdG9ncmFwaHk%3D 29:50 - Ethereum Signature Malleability - https://www.youtube.com/watch?v=V3TJLDHZBFU&t=85s&pp=ygUXb3dlbiB0aHVybSBtYWxsZWFiaWxpdHk%3D Timestamps: 00:00 - Intro 02:51 - #1 Frontrunning & backrunning 04:39 - #2 Using very small amounts 05:27 - #3 Passing zero as an input 06:39 - #4 Using contracts that cannot accept ether 07:35 - #5 Gas griefing with external calls 08:34 - #6 Weird ERC20 tokens 09:38 - #7 Price manipulation 10:51 - #8 Blacklisted ERC20 addresses 13:14 - #9 Overflow/underflow 14:08 - #10 Block re-orgs 16:35 - #11 Reentrancy 17:06 - #12 Sybil attacks on incentives 18:27 - #13 Flash loans 19:41 - #14 Accepting data from any address 20:52 - #15 Inflating internal accounting by sending tokens to the contract 22:06 - #16 Forced precision loss when it really matters 24:00 - #17 Addresses that might be empty at one point, yet house contract code at another 25:10 - #18 Reverting 25:41 - #19 Unexpected addresses 27:20 - #20 Selector clashing 28:42 - #21 Signatures 30:05 - #22 Hash collision 32:08 - Join the Solidity lab 32:47 - My 6 step guide to becoming a senior security researcher
Continue this lesson in the app
Install CourseHive on Android or iOS to keep learning while you move.
