March 17, 2023, SlowMist and HashKey Group are pleased to announce a strategic partnership to collaborate on digital asset ecosystem security, anti-money laundering for digital assets, cutting-edge security technology research, and other technology fields. The goal of the partnership is to explore and develop comprehensive security standards and solutions that…

On March 13th, 2023, the lending project, Euler Finance, on the Ethereum blockchain was attacked, and the attacker profited approximately 200 million US dollars. The SlowMist Security Team intervened and analyzed the situation promptly, and shared the results as follows:

Preface In our previous article, we reviewed the technical features of mainstream ZKP implementation solutions and mentioned the potential extensibility risks associated with certain ZKP algorithms. In this article, we will continue to demonstrate the attack principles and defense methods from a practical perspective. Vulnerability Overview Extensibility attacks on ZKP refer to the…

The Ethereum consensus layer client Prysm has recently completed an official security audit by SlowMist. It’s well known that the Ethereum network relies on client software to regulate the behavior of nodes, making client diversity critical to its overall health. Any client accounting for more than 33% of the network’s…

Overview Earlier, a double-spending vulnerability in a zero-knowledge proof verification contract on Semaphore was uncovered by the Russian developer, Poma. As a matter of curiosity, my intention is to replicate the vulnerability’s PoC initially. …

Overview In order to comprehend the functioning of the blockchain system, it is crucial to have a grasp of various cryptographic concepts. One such example is secp256k1, which is an asymmetric signature algorithm and curve utilized to sign and verify accounts within Bitcoin and Ethereum systems. Additionally, hash algorithms like sha256…

Background The idea of Bitcoin was first presented by Satoshi Nakamoto in November 2008, and it was officially launched in January 2009. As the global digital economy gained momentum, the notion of encrypted assets, such as NFTs, began to gain traction. Colored Coin, a token similar to NFTs, was developed in…

Background On February 8th, 2023, the SlowMist security team received a report from our partner ScamSniffer regarding multiple security breaches due to phishing attacks. An individual even suffered a significant loss, amounting to over $1.2M in USDC. Hacker Address: 0x69420e2b4ef22d935a4e2c194bbf3a2f02f27be1 Profit Address: 0x9cdce76c8d7962741b9f42bcea47b723c593efff

Background Denial of service (DoS) is a problem in smart contract security that is similar to traditional network security. Prior Knowledge Traditional network security denial of service (DoS): DoS is an abbreviation for denial of service. A denial of service occurs when an interference to a service reduces or eliminates…