Posts by chainsecurity

"*" indicates required fields

Request Audit

Please answer the questions below and click the Submit button.
DD slash MM slash YYYY
When will your code be 100% finished and ready for audit?
Book an Audit

How To Read Smart Contract Audit Reports

Having smart contracts audited is necessary if they are to serve a meaningful purpose. It is also essential that all stakeholders of a project read its audit report. This is so that the project and its security outlook is understood at a deeper level. However, audit reports are technical documents and reading them can prove…

Read More

Denial-of-Service Attacks In DeFi: The Balancer-Synthetix Case

How can a DeFi project’s entire liquidity become inaccessible in an instant? In this article, we explore a type of Denial-of-Service attack vector. Namely, Denial-of-service by affecting internal token balances. This particular vulnerability arises when a Balancer multi-token flash loan is taken out for tokens with double entry points. First, we will go over the…

Read More

Curve LP Oracle Manipulation: Post Mortem

On April 14, we informed Curve and affected projects about a read-only reentrancy vulnerability in some Curve pools. More specifically, the value of function get_virtual_price can be manipulated by reentering it during the removal of liquidity. Now, since all teams secured their projects, we are happy to share the technical details. Background Curve is an…

Read More

Heartbreaks & Curve LP Oracles

It’s easy to get tricked by lies and deception when you’re blinded by beauty. Taking off rose-colored glasses can be heartbreaking but getting them smashed on your face will be disastrous. Oracle manipulations are quite similar. They deceive you into not seeing the true value of something. Once you realize, the world around you is…

Read More

Why is Oracle Manipulation after the Merge so cheap? Multi-Block MEV.

Proof of Stake is coming Ethereum’s Merge is coming soon™ and will be moving the network from PoW to PoS. This is a consensus layer change and will have relatively few effects on the application layer. However, there is a consensus layer change that can affect the security model of certain smart contracts: The way…

Read More

Beware of Undefined Behavior! — Underhanded Solidity Contest Winner 22

This year’s Underhanded Solidity Contest featured many great submissions highlighting quirks in Solidity which can bite developers and auditors. We are proud to be among excellent company as judges for this contest, and even more so that this year the submission of Tynan, one of our Blockchain Security Engineers, won the contest for abusing a little known quirk in Solidity. This…

Read More

PolPatrol – Validator for Polkadot Runtimes

ChainSecurity is happy to release PolPatrol, an automated validator for testing the stability and security of Polkadot runtimes with respect to generic security and performance properties. Since Polkadot’s relay chain runtime lies at the core of the Polkadot network, the current version of PolPatrol focuses on ensuring that relay chain runtimes are secure and functionally…

Read More

Istanbul Hardfork EIPs – Changing Gas Costs and More

The Ethereum network will soon have its next hardfork called Istanbul. Many Ethereum Improvment Proposals (EIPs) were submitted to be included in that hardfork. Six EIPs have been accepted for Istanbul, but due to the large number of proposals eight have been tentatively accepted and will likely be part of another hardfork, called Berlin. The…

Read More