By BlockSec On Nov 08, 2022, we detected that some attacks successfully drained assets from pools that are built on top of Sushi’s official KashiPairMediumRiskV1 contract (or some contracts that fork from it). After investigation, we found that the root cause is due to a logic bug that causes the…

By BlockSec We are thrilled to announce that BlockSec and Tokenlon reached a strategic partnership to explore crypto assets security and risk management. BlockSec will provide a comprehensive risk management solution to help Tokenlon securely interact with crypto assets. We will have more in-depth cooperation in the Web3 world. About…

By BlockSec In the previous article, we briefly introduce how to develop a Hello World program on the Aptos network. From now on, we will delve a little more deeply into the development of DeFi applications and their security concerns. As always, we’d like to start with some basic but…

MetaDock is a powerful browser extension designed for the crypto community. It aims to deliver an enhanced user experience by seamlessly integrating various innovative features into the blockchain explorers. MetaDock is entirely free and will be open-sourced in the future. …

By BlockSec With the mainnet launch of Aptos network on Oct 18th, Move programming language and its ecosystem expand their influence continuously. To engage the community, we will release a series of articles to provide secure development practices in Move. …

We are thrilled to release Rustle: the first automatic auditor offered by BlockSec for NEAR community. Rustle has several great features: Rustle can currently detect 20+ types of issues in the NEAR contract. See the section Detectors for the full detector list. Rustle is easy to use. We provide thorough…

By BlockSec The BabySwap and TransitSwap on BSC were attacked on October 1. Some attack transactions were front-run by a Bot. Interestingly, this bot was susceptible to the profanity tool vulnerability, and we successfully recovered its private key. We also managed to reverse-engineer the bot contract and withdraw the funds…

By BlockSec After investigating the report named Analysis of the Wintermute Hack: An Inside Job (the report) published by James Edwards (@libreshash), we believe that the accusation of the Wintermute project is not as solid as the author claimed. 0x1. The privilege of the account 0x0000000fe6a514a32abdcdfcc076c85243de899b The report just looked up the current state of the account…

The Wintermute has been exploited for more than 160M loss. The root cause is that the private key of the Wintermute project was compromised possibly due to a vulnerability in the Profanity tool, which was used by Wintermute to generate the private key and the Ethereum account. In this blog…