I post a progress report showing what I did and how my products performed each month. Last month’s report can be seen here.

What did I do

Productive Hours in March
Productive Hours in March

Hours worked on side-projects in March

I worked 71 productive on side projects hours last month.

To make these progress reports a bit more interesting, from now on I’ll post my favourite song, TV show, and article I read last month.

What was worked on

Mostly client work, but I also did some bug…


In this part of the Replaying Ethereum Hacks series, we will look at a vulnerability that is common among yield aggregators. Many of these protocols disclose a function to automatically convert the profits to a different token by trading on a decentralized exchange like Uniswap. This in and of itself already opens the protocol up to a potential sandwich attack. The profitability of such an attack can be dramatically improved if the attacker can force the protocol to trade in an illiquid pool.

A recent example of such an arbitrage attack could be observed in BadgerDAO’s DIGG <> WBTC Sushiswap…


I post a progress report showing what I did and how my products performed each month. Last month’s report can be seen here.

What did I do

Productive Hours in February
Productive Hours in February

Hours worked on side-projects in February

I worked 104 productive on side projects hours last month.

To make these progress reports a bit more interesting, from now on I’ll post my favourite song, TV show, and article I read last month.

What was worked on


Furucombo has been exploited yesterday for ~15M USD.

Let’s dive into the attack, understand it by reading the code of the relevant contracts, and then replay the hack using a custom contract.

Background

Furucombo lets users build custom DeFi flows through a drag’n’drop interface — think Zapier or If This Then That for DeFi.

The entry-point for the attack is the Furucombo Proxy that some users approved with many different tokens worth millions of dollars. The gist of the attack is that anyone can call into the contract, make it do a delegatecall to a user-controlled…


This is the start of a new series called “Replaying Ethereum Hacks” where we take a closer look at past Ethereum exploits and end up re-implementing the attacks. One might ask themselves what the benefits of doing this might be — especially as the hacks are already documented through post mortems. This is a valid objection, but I still think it’s very valuable for these reasons:

  • To learn about smart contract security.

Paradigm CTF 2021 was a 48-hour Ethereum focused security competition held over the last weekend. It consists of 17 challenges, most of them were quite hard, definitely harder than Ethernaut or Capture The Ether Solutions. Nevertheless, this made them even more fun. 😃 Thanks to Paradigm for organizing it and I hope to see similar ones in the future.

I participated as team [object Object] and ranked #7 overall, was the top single-member team and drew two first bloods. I'll do a walk-through for the challenges I was able to solve. If you solved any of the others (or solved…


I post a progress report showing what I did and how my products performed each month. Last month’s report can be seen here.

What did I do

Productive Hours in January
Productive Hours in January

Hours worked on side-projects in January

I worked 103 productive on side projects hours last month.

To make these progress reports a bit more interesting, from now on I’ll post my favourite song, TV show, and article I read last month.

What was worked on

  • Did the Capture the Ether CTF challenges

Capture the Ether is a game to learn about Ethereum smart contract security. It already launched over 2 years ago but most things you’ll learn still apply today. There even is a leaderboard. You still have the chance to be immortalized as one of the first 100 players to solve all challenges. (I’m at rank 56.) Go ahead and try it!

I solved all challenges using the modern hardhat local environment which makes forking from the ropsten test network and testing your exploits locally very easy. My solutions can be found here.

I’ll discuss all challenges in this post.

Warmup

Deploy

The…


Ethernaut is OpenZeppelin’s wargame to learn about Ethereum smart contract security. It launched a couple of years ago and consists of 21 challenges that need to be solved. I personally found the Ethernaut challenges to be easier than the challenges of Capture the Ether, another CTF. If you have no prior Ethereum and security background this might be a good place to start. The challenges are on the Rinkeby testnet which makes the setup and receiving testnet ether a bit inconvenient as there are currently no easy to use faucets.

What I did was to solve all challenges using hardhat


DeFi protocols come with novel innovations that haven’t been possible in traditional finance like flash loans. This opens new attack vectors that need to be considered when designing these protocols. Recently, OpenZeppelin released their Damn Vulnerable DeFi CTF challenges.

They are a lot of fun and it’s a great way to get started with DeFi or ETH development in general. Unlike other CTFs everything runs on your local node, so no need to do waste time on getting set up like managing private keys, getting testnet ether, copying code to your local machine, etc. Give it a try! …

Christoph Michel

Full Stack Software Engineer #javascript #EOS. Into Recreational Math / CS 🤯 Just message me about anything, my mind is open.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store