--- ### Manual Review of TSwap Now that we've exercised some of our tooling, it's important to remember that our manual review is never replaced and is an invaluable part of the process. Now would be a great opportunity to take a break before diving into the next section of manual review, after which we'll go through writing our TSwap report. When you're ready, let's take a look at `TSwapPool.sol` and make note of some of the things we find.

Manual Review of TSwap

Now that we've exercised some of our tooling, it's important to remember that our manual review is never replaced and is an invaluable part of the process.

Now would be a great opportunity to take a break before diving into the next section of manual review, after which we'll go through writing our TSwap report.

When you're ready, let's take a look at TSwapPool.sol and make note of some of the things we find.

Recon: Manual Review Introduction

In this video, Patrick discusses the importance of manual codebase review along with tooling, specifically focusing on TSWAP pool.

Smart Contract Security Auditor Smart Contract Security

Course Introduction

Duration: 25min

Section 1: Review

Duration: 1h 18min

Section 2: What is a smart contract audit

Duration: 35min

Section 3: Your First Audit | PasswordStore

Duration: 2h 28min

Section 4: Puppy raffle

Duration: 5h 03min

Section 5: TSwap

Duration: 5h 22min

1. Introduction

Learn to find bugs without code inspection. Topics include fuzzing, AMMs, constant product formula, Uniswap/Curve Finance concepts, and more. Duration: 5min

2. Phase 1: Scoping

Beginning our scoping phase of TSwap a fork of Uniswap V1. Duration: 9min

3. Primer On This Review

Learn about protocol invariance without code. Study DEXs & DeFi Security Reviews. Explore TSWAP Protocol Docs w/ Diagrams & Videos. Duration: 2min

4. What is a DEX?

Decentralized exchanges explained through Uniswap and TSwap Duration: 3min

5. What is an AMM?

We're walked through what an AMM is and how it works in DeFi. Duration: 10min

6. Liquidity Providers

An explanation on liquidity providers and the sources of AMM fees for traders. Duration: 11min

7. How AMMs Work

Patrick further details AMMs and how they function in this quick review on How AMMs Work. Duration: 5min

8. TSwap Recon Continued

TSwap - Create New Pools, Swap Tokens via Multiple Pools, Liquidity Providers. Duration: 3min

9. Invariant & Properties Introduction

In-depth explanation of blockchain protocol invariants and fuzz testing. Examples from ERC-20 & ERC-721 tokens. Duration: 3min

10. Stateful And Stateless Fuzzing

Patrick details the differences between stateful and stateless fuzz testing and how each can be used to break protocol invariants. Duration: 10min

11. Stateless And Stateful Fuzzing Practice

Patrick emphasizes the importance of practice to master stateful and stateless fuzz testing. Duration: 5min

12. Stateless Fuzzing

Patrick walks through stateless fuzzing to catch an invariant break in TSwap! Duration: 9min

13. Where Stateless Fuzzing Fails

Patrick walks through some testing failures and how Foundry can be configured to achieve better results. Duration: 11min

14. Fuzzing Where Method 1 Fails

Introduction to different methods of fuzzing when we have no luck with Method 1. Duration: 18min

15. Stateful Fuzzing Method 2

A second approach to stateful fuzzing by Patrick. Duration: 14min

16. Debugging Fuzz Sequences

Uncover a broken invariant and debug the output sequence of our fuzz testing in this TSwap lesson. Duration: 7min

17. Fuzzing Recap

Stateful/Stateless Fuzzing, Handler Method Importance, ERC20 Exploit, TSWAP Testing & Bugs. Duration: 2min

18. Weird ERC20s

Patrick discusses various ERC20 quirks that can affect a protocol's security including missing return values and fee-on-transfer tokens. Duration: 4min

19. Writing Stateful Fuzz Test Suite

Stateful Fuzzing & Manual Review for TSWAP Bugs Duration: 1min

20. Constant Product Formula Explained

Explore the constant product formula and test it's implementation in TSwap through Fuzz and Unit testing. Duration: 9min

21. Invariant.t.sol

Patrick walks us through the invariant testing we perform on TSwap in invariant.t.sol. Duration: 17min

22. Handler.t.sol

Implementing the deposit function within our testing handler. Duration: 18min

23. Handler Swap Function

Implementing the swap function within our testing handler. Duration: 12min

24. Final Invariant And Tweaks

Comparing Deltas in Handler Test - Quick Guide. Demonstrates how to set up and run an assertion test for deltas in a handler. Duration: 3min

25. Debugging The Fuzzer

Debug Solidity Test Failures with Foundry Duration: 8min

26. One Last Huzzah

Patrick explains how fuzz testing methods can be used together to detect bugs in Solidity smart contracts. Duration: 10min

27. Notes On Invariants

Covers security tools like fuzzing, Echidna, and mutation/diff testing to detect issues stresses the importance of testing & learning from history. Duration: 4min

28. Recon: Manual Review Introduction

In this video, Patrick discusses the importance of manual codebase review along with tooling, specifically focusing on TSWAP pool. Duration: 2min

29. Slither

Patrick runs through using Slither on the TSwap repo. Duration: 2min

30. Aderyn

Using Cyfrin's Aderyn to find some non-critical bugs in TSwap! Duration: 2min

31. PoolFactory.sol

In this video, Patrick reviews PoolFactory.sol for TSwap liquidity pools, covering structure, functions, variables, bugs, and best practices. Duration: 6min

32. Manual Review: TSwapPool

Patrick discusses the security review of TSWAP pool in the context of Uniswap V1, He highlights a swap counting bug that breaks protocol invariants Duration: 3min

33. Using The Compiler As Static Analysis Tool

Importance is placed on addressing compiler warnings for potential issues and how they can help us in an audit scenario. Duration: 6min

34. Add Liquidity

Performing a manual review of the addLiquidity function and assessing risks found within! Duration: 8min

35. Remove Liquidity

Withdrawing Liquidity: Burning LP tokens to exchange for underlying money, parameters explained. Duration: 8min

36. swapExactInput

Understanding Swap Exact Input/Output & Protocol Checks in DeFi Duration: 6min

37. swapExactOutput

swapExactOutput lacks slippage protection for sudden price changes. Duration: 3min

38. sellPoolTokens

Sells pool tokens for WETH; business logic error: swap exact output instead of swap exact input. Duration: 2min

39. Checking the Last Few Functions

Patrick quickly skims the final few functions for vulnerabilities in TSwap. Duration: 2min

40. Phase 4: Reporting

Quick overview of reporting process - finding reports & appropriate tags. Multiple passes suggested for thoroughness. Duration: 5min

41. Reporting: Missing Deadline

TSWAP pool deposit function vulnerability. Deadline parameter accepted but unused, allowing MEV attacks during unfavourable market conditions. Medium impact. Duration: 4min

42. Reporting Continued

Patrick continues by showing how to report issues with examples and proofs to fix them. Duration: 10min

43. Reporting: No Slippage Protection

Slippage Protection Lacking in SwapExactOutput, Add Max Input for Safety. Patrick elaborates with a Proof-Of-Concept Scenario. Duration: 8min

44. Reporting: sellPoolTokens

Patrick highlights flawed SellPool tokens calculation. Recommends using swapExactInput & adding a MinWethToReceive w/Deadline to prevent exploitation. Duration: 4min

45. Reporting: Invariant Break & PoC

In this video, Patrick explains how to create a unit test that replicates a sequence found using fuzz testing to break an invariant. Duration: 9min

46. Reporting: Weird ERC20

Uniswap V1, TSWAP pool issues, breaks protocol invariance. Explore, and report weird ERC20s, DeFi vulnerabilities. Duration: 4min

47. Creating PDF For Your Portfolio

Creating a PDF of your audit report to add to your GitHub portfolio! Show case your achievements! Duration: 4min

48. Recap

Recap things covered in this section. Common issues in DeFi: liquidity, price manipulation, governance attacks. Duration: 8min

49. Exercises

Learn smart contract security testing by coding a fuzz test, discover reentrancy attacks, share insights on Twitter. Upcoming sections explained. Duration: 3min

Section 6: Thunder Loan

Duration: 4h 33min

Section 7: Boss Bridge

Duration: 2h 01min

Section 8: MEV & Governance

Duration: 1h 40min