Go for Security Auditors: Part 1 - Syntax That Will Trip You Up
The first in a three-part series on auditing Go code, covering deceptive syntax, common pitfalls like nil maps and slice aliasing, testing gotchas, and compiler pragmas that hide security-relevant behaviour.
Common Vulnerabilities: Oracles and Pricing - Smart Contracts
To achieve composability in DeFi, many projects require external sources of truth or price feeds. This article explores the common vulnerabilities in the use of pricing and oracles with real-world examples.
NEAR Smart Contract Auditing: Accounts & Access Control
This article explores how NEAR's unique account system combines human-readable names with multi-tiered permissions, examining the security implications and providing practical guidance for implementing robust access control in smart contracts.
NEAR Smart Contract Auditing: Sharding & Cross Contract Calls
NEAR Protocol introduces Nightshade sharding to tackle blockchain scalability while maintaining security. This article explores the security implications of cross-contract calls in sharded environments, demonstrating both proper implementation patterns and potential vulnerabilities through practical examples.
Common Vulnerabilities: Protocol Governance and DAOs - Smart Contracts
Many DeFi Protocols have decentralised using DAOs and token governance. This article explores the common vulnerabilities in the governance of DAOs with real-world examples.
This post shares publicly the details of a security assessment conducted by Sigma Prime, which targeted an Ethereum smart contract wallet developed by Dapper Labs.
Status ENS Integration: Smart Contract Security Review
This post shares with the public details of a security review performed by Sigma Prime, which targeted an Ethereum Name Service (ENS) registrar developed by Status.
Solidity Security: Comprehensive list of known attack vectors and common anti-patterns
This post aims to be a relatively in-depth and up-to-date introductory post detailing the past mistakes that have been made by Solidity developers in an effort to prevent future devs from repeating history.