_Follow along with this video:_ --- ### Signatures Summarized In a nutshell, this is how signing works: 1. Take a private key + message - The message is generally comprised of: data, function selectors, parameters etc 2. Pass both the private key + message into the [**Elliptic Curve Digital Signature Algorithm**](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) (ECDSA) - We don't dive deep into ECDSA, but I recommend you do - outputs `v, r, and s` 3. `v, r, and s` are used to verify someone's signature using the precompile `ecrecover`.
Signatures Summarized
Learn how the ECDSA (elliptic curve digital signature algorithm) is leveraged in transactions to verify signatures.
Solidity Developer
Smart Contract Security1. Introduction
Patrick introduces the Boss Bridge protocol and the sorts of concepts that will be covered in this section. Duration: 5min
2. Phase 1: Scoping
Learn about scoping, coverage reports, understanding roles, thorough documentation, code coverage, stateful fuzzing tests, and invariant testing. Duration: 6min
3. Phase 2: Recon
Code Review - Static Analysis Tools & Fixing Issues. Patrick leverages Slither and Aderyn to dive into Boss Bridge. Duration: 2min
4. Checklist
Patrick details the 'Hans' approach to security reviews and leveraging Hans' Audit Checklist (available on Solodit). Duration: 4min
5. Docs
The audit begins with assessing the documentation and gaining context of the Boss Bridge protocol! Duration: 2min
6. Boss Bridge Diagram
In this lesson we visualize the transaction flow of Boss Bridge using protocol diagrams. Duration: 6min
7. L1Token.sol
A brief run through a fairly standard token contract contained in Boss Bridge. Duration: 2min
8. L1Vault.sol
Patrick scopes out L1Vault.sol for potential security vulnerabilities. Duration: 4min
9. Yul Opcodes
Approaching low level code during a protocol audits. Duration: 2min
10. Unsupported Opcodes
Learn about the importance of checking compatibility before deploying contracts across different L2s and chains. Duration: 11min
11. L1BossBridge.sol
ZkSync & Boss Bridge Code Analysis - Reentrancy Guard, Message Utils, Pausable Library. Focuses on adding an emergency stop and preventing re-entrancy attacks. Duration: 3min
12. Signatures
Patrick introduces the ERC-191 signed data format and how signatures are used in the EVM. Discusses the ecrecover precompile. Duration: 6min
13. Signatures Summarized
Learn how the ECDSA (elliptic curve digital signature algorithm) is leveraged in transactions to verify signatures. Duration: 1min
14. EIP-712
We dive into EIP-712 and introduce typed structured data hashing and signing with minimalistic examples. Duration: 4min
15. Case Study: Polygon
We dive into the infamous polygon hack as a case study of bridge exploits. Duration: 9min
16. Signatures Recap
Elliptic Curve Digital Signature Algorithm & Verification Explained. Emphasis on ecrecover, V, R and S values, and on-chain data protection. Duration: 1min
17. Recon Continued
Patrick explains ECDSA signing & verification with OpenZeppelin examples, focuses on signature-related bugs within Boss Bridge. Duration: 6min
18. depositTokenToL2
'depositTokenToL2' Function in Brief. The function locks tokens in a vault, triggers L2 minting. Duration: 2min
19. Exploit: Arbitrary From
With the help of Slither, Patrick identifies and discusses an 'Arbitrary From' vulnerability. Duration: 3min
20. Arbitrary From: Poc
We detail a proof of code for our identified 'arbitrary from' vulnerability. Duration: 4min
21. Recon Continued (again)
Static analysis using Slither identifies potential vulnerabilities, Patrick issues a warning for false positives. Duration: 5min
22. Exploit: Infinite Mint
Highlights the "Infinite Mint" vulnerability in Boss Bridge that allows any user to steal funds if the vault approves the bridge. Duration: 4min
23. Why are these not the same finding?
Patrick discusses how to identify if similar findings are recognized as unique bugs and how to determine distinct vulnerabilities by considering the root cause. Duration: 2min
24. Recon Continued Again (again)
Dive into the withdraw function and the potential protections versus replay attacks. Duration: 6min
25. Exploit: Signature Replay
Learn about cryptographic verification and blockchain signatures as well as preserving the integrity of signed messages. Duration: 1min
26. Signature Replay: Minimized
Create a Signature Replay Attack using sc-exploits-minimized in Remix! Duration: 2min
27. Signature Replay PoC
We walk through a PoC for signature replay attacks with Patrick. Duration: 7min
28. Signature Replay: Prevention
Learn about nonce-based protection against replay attacks in transaction handling. Duration: 1min
29. Exploit: Low level call to itself
Patrick focuses on identifying and resolving two significant security issues within Boss Bridge. Duration: 2min
30. Exploit: Gas Bomb
Patrick details a gas bomb attack and how gas costs can be manipulated, with test cases. Duration: 1min
31. Recap
Recap vulnerabilities including chain incompatibilities, signature replays, and bridge hacks. Emphasizes the importance of learning through PoCs. Duration: 5min
32. Exercises
Patrick details a number of exercises to take to supplement the learnings of this section! Duration: 2min
Testimonials
Students Reviews
Read what our students have to say about this course.
Chainlink
Chainlink
Gustavo Gonzalez
Solutions Engineer at OpenZeppelin
Francesco Andreoli
Lead Devrel at Metamask
Albert Hu
DeForm Founding Engineer
Radek
Senior Developer Advocate at Ceramic
Boidushya
WalletConnect
Idris
Developer Relations Engineer at Axelar