Smart Contract Security

Support

--- ### Introduction to Thunderloan I hope you took some time to go through the fuzzing exercises from the last section, because it's only going to ramp up from here. In Section 6: Thunder Loan we'll be doing _a lot_ of testing. Strap in! You may as well begin by cloning the Thunder Loan repo into your project folder. ```bash git clone https://github.com/Cyfrin/6-thunder-loan-audit.git cd 6-thunder-loan-audit/ code . ``` **_What else will we be covering?_** Let's go through a few of the things we'll learn, as outlined in the [**GitHub repo**](https://github.com/Cyfrin/security-and-auditing-full-course-s23/tree/main) associated with this course. First off we're going to dive deep into DeFi's borrowing and lending systems. The Thunder Loan protocol is based specifically off of [**Aave**](https://aave.com/) & [**Compound**](https://compound.finance/) which are two of the most significant protocols in DeFi. We're also going to get more exposure to `Oracles` and how a protocol can leverage [**`Chainlink`**](https://chain.link) and similar services to integrate reliable price feed data in a decentralized way. Additionally this is going to be our first mock audit of an upgradeable contract. Proxies and the like are very common in live scenarios so your experience assessing them here will be invaluable. Things we'll be covering include: - [UUPS & Transparent](https://docs.openzeppelin.com/contracts/4.x/api/proxy) - [Multi-facet Proxy (Diamond)](https://eips.ethereum.org/EIPS/eip-2535) - [Foundry Proxies & Upgrades](https://github.com/Cyfrin/foundry-upgrades-f23) - [What are upgradeable smart contracts?](https://www.youtube.com/watch?v=bdXJmWajZRY) We'll also be learning a bunch of new tooling such as: - [**Upgradehub**](https://upgradehub.xyz/) - Allows you to view a history of changes during upgrades by entering a contract address - very cool! Last but not least, we're going to get our hands dirty with `flash loans`, a hot topic in DeFi. We'll learn how they work, what powers them and the types of exploits they enable. From the perspective of DeFi, this is section on Thunder Loan is going to be one of **_the most important_** in the whole course. The knowledge you take away from here will be directly applicable to real world security reviews, preparing you for larger and more complex code bases. Before we dive into the review, remember the `audit-data` branch of this section's GitHub repo serves as an 'answer key', if you get stuck you can always refer to this branch for clues. > **Note:** As always, there may be bugs in these code bases that we don't cover, feel free to write your own findings for these as well! Let's get started.

Introduction

Introducing the Thunder Loan protocol, based off Aave/Compound. Section covers borrowing and lending, pricing information, and upgradeable contracts.

Solidity Developer

Smart Contract Security

Course Introduction

Duration: 25min

Section 1: Review

Duration: 1h 18min

Section 2: What is a smart contract audit

Duration: 35min

Section 3: Your First Audit | PasswordStore

Duration: 2h 28min

Section 4: Puppy raffle

Duration: 5h 03min

1. Introduction

An introduction to PuppyRaffle and all else that will be covered in this section! Duration: 5min

2. Puppy raffle primer

Learn coding bug detection in this mock audit! Explore, discover & review together. Duration: 2min

3. Phase 1: Scoping

Puppy Raffle Code Base, Git & Foundry Installation, Testing Coverage, Security View, Exploits. Duration: 4min

4. Tooling: Slither

Tooling in Smart Contract Auditing, Patrick Introduces Static Analysis. Using Slither by Trail of Bits to find bugs without executing code. Duration: 6min

5. Tooling: Aderyn

Introducing Aderyn: a static analysis tool for smart contracts, built with Rust by Alex Roan. Duration: 2min

6. Tooling: Solidity Visual Developer

Patrick goes over additional useful tools like Solidity Metics and Solidity Visual Developer. Duration: 3min

7. Recon: Reading docs

Puppy Raffle Audit Walkthrough - Main Branch Details. Patrick explains raffle documentation, functions, and entry requirements. Duration: 2min

8. Recon: Reading the code

Navigate PuppyRaffle codebase, player entry points, keyboard shortcuts. Duration: 5min

9. Recon: Reading docs II

In this lesson Patrick continues reading through the docs and even smell a bug! Duration: 3min

10. sc-exploits-minimized

Introducing the sc-exploits-minimized repo, a compilation of common smart contract vulnerability examples. Duration: 2min

11. Exploit: Denial of service

Explore a DoS attack using a minimalistic DOS contract. Learn how loops and arrays can make a protocol unusable. Duration: 7min

12. Case Study: DoS

Joined by Owen, we look into 2 case studies of real life DoS attacks: GMX V2 and the Bridges Exchange. Duration: 21min

13. DoS PoC

Puppy Raffle Denial of Service Attack - Identify and Test. Main focus: Unfair cost increase for late entrants, disadvantaging new players. Duration: 8min

14. DoS: Reporting

How to create a DOS security review report. Step-by-step process including title, root cause, impact, severity, likelihood, and mitigation strategy. Duration: 8min

15. DoS: Mitigation

How to Remove Duplicates from Arrays with Patrick Duration: 3min

16. Exploit: Business logic edge case

Patrick discusses the potential impacts of a user entering PuppyRaffle with a smart contract. Duration: 3min

17. Recon: Refund

Continuing our Recon of PuppyRaffle with the Refund function. Duration: 3min

18. Exploit: Reentrancy

Reentrancy Attack in PuppyRaffle: Deposit-Withdraw Loop Steals Funds Duration: 14min

19. Reentrancy: Remix example

Patrick shows a hacker draining a user's balance via Remix using re-entrancy exploit. Duration: 4min

20. Reentrancy: Mitigation

Fixing Re-Entrancy in Smart Contracts:CEI Pattern, Lock Variables & Non-Reentrant Modifier Duration: 4min

21. Menace To Society

DeFi reentrancy attacks: Importance of understanding past hacks for security pros; The DAO hack case study. Duration: 5min

22. Reentrancy: Recap

Patrick recaps reentrancy vulnerabilities and discusses prevention such as checks-effects-interactions (CEI) and non-reentrant modifiers. Duration: 3min

23. Reentrancy: PoC

Identify & exploit smart contract re-entrancy vulnerability for PuppyRaffle. Demo of POC with a hypothetical attacker contract. Discuss prevention methods. Duration: 8min

24. Recon: Continued

Smart contract codebase analysis, focusing on PuppyRaffle's selectWinner function. Checking timestamp, players, raffle status, winner calculation concern. Duration: 5min

25. Exploit: Weak randomness

Dive into PuppyRaffle's weak randomness. Patrick emphasizes use of secure sources like Chainlink VRF. Duration: 4min

26. Weak randomness: Multiple issues

Blockchain timestamps, previous block hashes, and transaction senders are unsuitable for secure random number generation. Use more reliable methods instead. Duration: 4min

27. Case Study: Weak Randomness

NFT product Mebits attacked, obtained rare NFT worth almost $1M; weak security measures. Duration: 7min

28. Weak randomness: Mitigation

Chainlink VRF for trustless randomness in apps, Patrick explains. No to alternative methods. Duration: 1min

29. Exploit: Integer overflow

Bug in smart contract due to arithmetic overflow; demonstrates with Solidity code & offers solutions. Duration: 8min

30. Integer overflow: Mitigation

Fixing Solidity Arithmetic Issues: Use Newer Version Duration: 2min

31. Exploit: Unsafe casting

Overflow issue: Loss of significant digits due to uint64 casting from uint256, leading to lost fees. Importance of identifying & fixing in audit reports. Duration: 4min

32. Recon II

Patrick continues his reconnaissance of PuppyRaffle! Duration: 11min

33. Exploit: Mishandling Of ETH

Identifying the mishandling of ETH in PuppyRaffle and outlining issue with relying on .balance in contract accounting. Duration: 3min

34. Mishandling of ETH: Minimized

How ETH Misuse Leads to Smart Contract Vulnerability, Patrick Explains Solutions Duration: 6min

35. Case Study: Mishandling of ETH

SushiSwap attack: Poor handling of ETH led to a real-life attack, causing significant monetary loss. Read detailed case study. Duration: 3min

36. Recon III

PuppyRaffle walkthrough continues, covering functions & exploits. Go through code multiple times for understanding. Identify areas for improvement. Duration: 7min

37. Answering our questions

Going back through the notes we left ourselves and answering some of the questions we'd asked! Duration: 4min

38. Info and gas findings

Improving code quality through an audit: Use specific Solidity versions, define constants, check library security, make storage variables immutable. Duration: 5min

39. Pit stop

Conducting Code Quality Test Using Slither & Aderyn Tools; Practice Tips Given by Patrick. Duration: 2min

40. Slither walkthrough

Slither is a static analysis tool that is useful for securing smart contracts. A walkthrough of its use. Duration: 13min

41. Aderyn walkthrough

A brief walkthrough of Aderyn and how to use it to supercharge your smart contract security reviews. Duration: 3min

42. Test coverage

Code Coverage Check Using Foundry, Aderyn & Slither Duration: 1min

43. Phase 4: Reporting primer

Learn report writing for security reviews & effective communication in bug bounties with Patrick. Master competitive audits & finding submission. Duration: 3min

44. What is a competitive audit?

Competitive Audits - Discover Bugs, Win Rewards! Get started with Patrick's guidance, perfect for aspiring smart contract security professionals. Duration: 5min

45. Codehawks

Join CodeHawks for Competitive Audits & practice. Live competitions, real $$$. Duration: 3min

46. Submitting a competitive audit finding

Patrick demonstrates how to submit findings in a competitive audit, emphasizing the importance of building your auditing portfolio. Duration: 4min

47. Reporting templates

Introducing some useful templates and processes for audit reporting. Duration: 3min

48. Reporting: Floating pragma

Walkthrough of the floating pragma informational finding report. Duration: 2min

49. Reporting: Incorrect solc version

Quick walkthrough of reporting an incorrect solc version. Duration: 2min

50. Reporting: Unchanged state variables should be immutable or constant

Learn how to track gas consumption and identify where improvements can be made. Focus on gas optimization techniques and proper variable scoping. Duration: 2min

51. Reporting: Zero address check

Patrick explains zero address check and walks through reporting it. Duration: 1min

52. Reporting: Storage variables in loops should be cached

Optimize gas usage via caching store variables in loops, read memory instead of storage for efficiency. Duration: 2min

53. Reporting Findings We'll Cover Later

Audit Findings: MEV Attacks & Refund Function - To be covered later (Section 7.5) Duration: 1min

54. Reporting Reentrancy

How to write a security review finding for a reentrancy vulnerability including a mitigation recommendation. Duration: 8min

55. Reporting: getActivePlayerindex

Walkthrough of a report for our getActivePlayerIndex edge case! Duration: 5min

56. Reporting: Should Follow CEI

Informational PuppyRaffle issue, improving code with CEI. Duration: 2min

57. Reporting: Weak Randomness

Auditing blockchain randomness, Patrick explains how weak randomness can be exploited and suggests using secure generators like Chainlink VRF. Duration: 6min

58. Reporting: Magic Numbers

Focus on Magic Numbers & Named Constants. Patrick provides Solidity examples & tips. Duration: 2min

59. Reporting: Integer Overflow

Patrick explains two security issues found in PuppyRaffle - integer overflow and unsafe cast. Offers detailed explanations & potential mitigations. Duration: 8min

60. Reporting: Smart Contract Wallet Reverts Winning

Winning smart lottery without fallback causes restart issues & gas waste; Suggested mitigation: mapping addresses to payouts, 'claim prize' function. Duration: 5min

61. Reporting: Mishandling Of ETH

Writing our report for ETH Mishandling in PuppyRaffle. Duration: 2min

62. Reporting: Missing Events And Remove Dead Code

A quick report for missing events and unused function in PuppyRaffle! Duration: 2min

63. Adding The Audit To Our Portfolio

Learn how to create an audit report using Markdown and Pandoc, including adding logos, formatting sections, and converting the report to a PDF. Duration: 6min

64. Exercises

Protecting Web3 Against Hacks & Attacks; Remix Exploits & DeFi Challenges. Presented by Patrick. Includes Exercises & Case Studies. Duration: 5min

65. Solodit

Solodit - a Web3 audit finding aggregator. Learn from other auditors' reports & excel in competitive contests. Duration: 4min

66. Wrapping Up

Raffle complete, tweeting your success, CodeHawks First Flights, rest & rewards encouraged. Duration: 2min

Section 5: TSwap

Duration: 5h 22min

Section 6: Thunder Loan

Duration: 4h 33min

Section 7: Boss Bridge

Duration: 2h 01min