Background The Frozen Heart vulnerability was first named by the Trail of Bits team. The term “Frozen” represents the Forging Of Zero Knowledge proofs, and “Heart” indicates that the Fiat-Shamir transformation is central to many proof systems. The vulnerability refers to the use of a “weak Fiat-Shamir” transformation. In this…

Update(2023/09/21): We double checked our monitoring data, @realScamSniffer ’s monitoring data and Balancer’s description, this is not a certain BGP hijacking. The coincidence of time puzzled us. We look forward to Balancer’s final post-mortem report. On September 20, 2023, our security team indicated that Balancer.fi fell victim to a BGP…

Background Overview In our first article, we discussed various methods to prevent reentrancy attacks. One such method involves checking the caller’s identity and disallowing contract invocations to thwart reentrancy. In this installment, we will explore how to identify the caller’s identity using Contract Size Checks. Prerequisite As is commonly known, contracts are written…

Weekly Update | Approximately $42.554 Million in Losses from Web3 Security Incidents Overview According to statistics from SlowMist Blockchain’s Hacked Archive (https://hacked.slowmist.io), from September 4 to September 10, 2023, there were a total of 10 security incidents, resulting in an estimated loss of approximately $42.554 million. Specific Incidents Stake.com On September 4, 2023…

Introduction Welcome to another episode of our MistTrack investigative series, where we explore the complexities and intricacies of stolen funds in the web3 ecosystem. The web3 community was shaken recently when the gambling platform Stake was hacked, resulting in the loss of approximately $40 million in assets. The funds…

Introduction A Length Extension Attack is a specific vulnerability associated with certain types of hash functions like MD5, SHA-1, and SHA-2. Simply put, this type of attack exploits the fact that given \( H(\text{message}) \) and the length of the message, one can easily calculate \( H(\text{message} \mathbin{\Vert} \text{padding} \mathbin{\Vert} \text{extension})…

Weekly Update: Approximately $830,000 Lost in Web3 Security Incidents Overview According to statistics from SlowMist’s Blockchain Hacking Archive (https://hacked.slowmist.io), from August 28 to September 3, 2023, there were a total of 7 security incidents, resulting in an estimated loss of approximately $830,000. Specific Incidents Ivan Bianco On August 29, 2023, Ivan Bianco, a Brazilian YouTube…

Weekly Update: Web3 Security Incidents Result in Approximately $10.61 Million in Losses Overview According to data from SlowMist’s Hacked Archive, between August 21 and August 27, 2023, there were 8 recorded security incidents, resulting in an estimated total loss of $10.61 million. Incidents Details Fake LayerZero Token On August 21, 2023, a fraudulent…

Weekly Web3 Security Update | Approximately $19.963 Million in Losses — Overview According to data from the SlowMist Blockchain Hacked Archive, from August 14 to August 20, 2023, there were a total of 10 security incidents with an estimated loss of about $19.963 million. Incident Details: MEV Bot On August 14, 2023, Hexagate tweeted that in the past few days, a single MEV…