Go for Security Auditors: Part 2 - Finding The Doors Into A Codebase
The second in a three-part series on auditing Go code, covering how to orient in a large codebase, find entry points and attack surfaces, choose a review strategy, and use static analysis tooling effectively.
Go for Security Auditors: Part 1 - Syntax That Will Trip You Up
The first in a three-part series on auditing Go code, covering deceptive syntax, common pitfalls like nil maps and slice aliasing, testing gotchas, and compiler pragmas that hide security-relevant behaviour.
Your first ZK vulnerabilities: From ZeroKnowledge of ZK to OneKnowledge
An introduction to ZK circuit security, exploring fundamental mental models for creating and thinking about ZK circuits. Learn about under-constrained variable vulnerabilities that appear in ZK code through a practical Circom example.
The Ultimate Guide to the Top for Security Researchers: Setting Sail
A comprehensive four-part series guide for security researchers who want to rise faster, build reputation, and make lasting impact in the web3 security space, from foundations to mastery and consistent results.
Live EigenLayer Bug Discovered During Sidecar Security Review
Analysis of a critical division-by-zero vulnerability in the EigenLayer sidecar rewards calculation process, its potential DoS impact, and the implemented fixes.
Common Vulnerabilities: Oracles and Pricing - Smart Contracts
To achieve composability in DeFi, many projects require external sources of truth or price feeds. This article explores the common vulnerabilities in the use of pricing and oracles with real-world examples.
NEAR Smart Contract Auditing: Accounts & Access Control
This article explores how NEAR's unique account system combines human-readable names with multi-tiered permissions, examining the security implications and providing practical guidance for implementing robust access control in smart contracts.
In this article, we dive into the storage system of the NEAR blockchain. We'll explore how storage works on NEAR, how to use it securely, and highlight some of the common pitfalls.
NEAR Smart Contract Auditing: Sharding & Cross Contract Calls
NEAR Protocol introduces Nightshade sharding to tackle blockchain scalability while maintaining security. This article explores the security implications of cross-contract calls in sharded environments, demonstrating both proper implementation patterns and potential vulnerabilities through practical examples.
Common Vulnerabilities: Protocol Governance and DAOs - Smart Contracts
Many DeFi Protocols have decentralised using DAOs and token governance. This article explores the common vulnerabilities in the governance of DAOs with real-world examples.
Common Vulnerabilities: Liquid Restaking Protocols - Smart Contracts
Liquid Restaking protocols are a big trend in the DeFi space. This article explores the common vulnerabilities in liquid restaking protocols with real-world examples.
This post shares publicly the details of a security assessment conducted by Sigma Prime, which targeted an Ethereum smart contract wallet developed by Dapper Labs.
Status ENS Integration: Smart Contract Security Review
This post shares with the public details of a security review performed by Sigma Prime, which targeted an Ethereum Name Service (ENS) registrar developed by Status.
Solidity Security: Comprehensive list of known attack vectors and common anti-patterns
This post aims to be a relatively in-depth and up-to-date introductory post detailing the past mistakes that have been made by Solidity developers in an effort to prevent future devs from repeating history.
