A Message From Ankr
Learn more about Ankr @ https://www.ankr.com/.
1. A Message From Ankr
Learn more about Ankr @ https://www.ankr.com/. Duration: 0min
2. Introduction
Patrick introduces the Boss Bridge protocol and the sorts of concepts that will be covered in this section. Duration: 5min
3. Phase 1: Scoping
Learn about scoping, coverage reports, understanding roles, thorough documentation, code coverage, stateful fuzzing tests, and invariant testing. Duration: 6min
4. Phase 2: Recon
Code Review - Static Analysis Tools & Fixing Issues. Patrick leverages Slither and Aderyn to dive into Boss Bridge. Duration: 2min
5. Checklist
Patrick details the 'Hans' approach to security reviews and leveraging Hans' Audit Checklist (available on Solodit). Duration: 4min
6. Docs
The audit begins with assessing the documentation and gaining context of the Boss Bridge protocol! Duration: 2min
7. Boss Bridge Diagram
In this lesson we visualize the transaction flow of Boss Bridge using protocol diagrams. Duration: 6min
8. L1Token.sol
A brief run through a fairly standard token contract contained in Boss Bridge. Duration: 2min
9. L1Vault.sol
Patrick scopes out L1Vault.sol for potential security vulnerabilities. Duration: 4min
10. Yul Opcodes
Approaching low level code during a protocol audits. Duration: 2min
11. Unsupported Opcodes
Learn about the importance of checking compatibility before deploying contracts across different L2s and chains. Duration: 11min
12. L1BossBridge.sol
ZkSync & Boss Bridge Code Analysis - Reentrancy Guard, Message Utils, Pausable Library. Focuses on adding an emergency stop and preventing re-entrancy attacks. Duration: 3min
13. Signatures
Patrick introduces the ERC-191 signed data format and how signatures are used in the EVM. Discusses the ecrecover precompile. Duration: 6min
14. Signatures Summarized
Learn how the ECDSA (elliptic curve digital signature algorithm) is leveraged in transactions to verify signatures. Duration: 1min
15. EIP-712
We dive into EIP-712 and introduce typed structured data hashing and signing with minimalistic examples. Duration: 4min
16. Case Study: Polygon
We dive into the infamous polygon hack as a case study of bridge exploits. Duration: 9min
17. Signatures Recap
Elliptic Curve Digital Signature Algorithm & Verification Explained. Emphasis on ecrecover, V, R and S values, and on-chain data protection. Duration: 1min
18. Recon Continued
Patrick explains ECDSA signing & verification with OpenZeppelin examples, focuses on signature-related bugs within Boss Bridge. Duration: 6min
19. depositTokenToL2
'depositTokenToL2' Function in Brief. The function locks tokens in a vault, triggers L2 minting. Duration: 2min
20. Exploit: Arbitrary From
With the help of Slither, Patrick identifies and discusses an 'Arbitrary From' vulnerability. Duration: 3min
21. Arbitrary From: PoC
We detail a proof of code for our identified 'arbitrary from' vulnerability. Duration: 4min
22. Recon Continued (again)
Static analysis using Slither identifies potential vulnerabilities, Patrick issues a warning for false positives. Duration: 5min
23. Exploit: Infinite Mint
Highlights the "Infinite Mint" vulnerability in Boss Bridge that allows any user to steal funds if the vault approves the bridge. Duration: 4min
24. Why Are These Not The Same Finding?
Patrick discusses how to identify if similar findings are recognized as unique bugs and how to determine distinct vulnerabilities by considering the root cause. Duration: 2min
25. Recon Continued Again (again)
Dive into the withdraw function and the potential protections versus replay attacks. Duration: 6min
26. Exploit: Signature Replay
Learn about cryptographic verification and blockchain signatures as well as preserving the integrity of signed messages. Duration: 1min
27. Signature Replay: Minimized
Create a Signature Replay Attack using sc-exploits-minimized in Remix! Duration: 2min
28. Signature Replay PoC
We walk through a PoC for signature replay attacks with Patrick. Duration: 7min
29. Signature Replay: Prevention
Learn about nonce-based protection against replay attacks in transaction handling. Duration: 1min
30. Exploit: Low Level Call to Itself
Patrick focuses on identifying and resolving two significant security issues within Boss Bridge. Duration: 2min
31. Exploit: Gas Bomb
Patrick details a gas bomb attack and how gas costs can be manipulated, with test cases. Duration: 1min
32. Recap
Recap vulnerabilities including chain incompatibilities, signature replays, and bridge hacks. Emphasizes the importance of learning through PoCs. Duration: 5min
33. Exercises
Patrick details a number of exercises to take to supplement the learnings of this section! Duration: 2min
