Programming Bao @ProgrammingBao

Co-founder and programmer of @theramennft. Blockchain Security Geek linkedin.com/in/DemisK Lat:Skewe's Long:Googolplex. Joined January 2022

Tweets

117
Followers

1K
Following

163
Likes

25

Programming Bao @ProgrammingBao

6 months ago

Requesting $ETH funds from the #Stakely Faucet on the Ethereum Holesky Testnet blockchain. Request ID: OLCSKZUH stakely.io/faucet/ethereu… .

1 0 3 64 0

Brian Roemmele @BrianRoemmele

8 months ago

THANK YOU. Your tolerance and support of me here on X by just interacting with my postings and subscribing if you care to here or my very long form at ReadMultiplex.com helps pays for this. I ain’t got no one else. I love you folks. Gratitude.

Brian Roemmele @BrianRoemmele

8 months ago

830 2K 16K 2.2M 10K

Download Image

106 112 1K 54K 141

code call @codecallapp

12 months ago

🌐 Work from anywhere, anytime! 🏖️ CodeCall lets you choose projects, work remotely, and get paid for your contributions. One-click GitHub signup makes it a breeze! 🌬️💨 Join us today! 💪 #RemoteWork #Developers #TechTrends #DigitalNomad #CodingLife

0 2 4 175 0

Download Gif

code call @codecallapp

a year ago

🚀 Hey Developers! Join CodeCall—where skill meets opportunity. Work on impactful projects, earn rewards, gain XP, and climb the leaderboard to get noticed by top companies. One-click signup, no email needed! 🔗 Compete. Learn. Earn. #DevCommunity #Programming #Developer

1 2 2 138 0

Download Image

code call @codecallapp

12 months ago

🚀 Code, Compete, Get Paid—It’s That Simple! 🚀 Earn more, get hired faster, and work on real projects with top businesses. Join us and make your skills count. Launching in October! #TechJobs #DevCommunity #TechCareers #Remotework #codinglife

0 2 2 92 0

Download Image

Programming Bao @ProgrammingBao

a year ago

Startup allowing devs to contribute code and get paid Like bug bounties but for development Launching soon with some MERN based projects with bounties ranging from €5,000 to €160,000 discord.gg/UNdgzxZEJq codecall.xyz

0 0 0 68 0

Slavcheww @Slavcheww

2 years ago

These days, we've managed to uncover a Critical issue stemming from misunderstandings about who is the msg.sender in a nested Uniswap call, all thanks to @TenderlyApp. If you find yourself needing to debug a transaction with numerous nested functions in external contracts,…

2 2 12 1K 4

pashov @pashovkrum

2 years ago

If you are doing a smart contract security audit and see this `require(token.balanceOf(address(this)) == ….` You’ve most probably found an issue. Anyone who can get 1 wei worth of `token` can send it to the contract as a front-run attack, forcing the method call to revert

18 18 291 20K 188

pashov @pashovkrum

2 years ago

If you deploy smart contracts on multiple chains like Ethereum, Arbitrum, Polygon, Optimism and others you would greatly benefit from this resource. GJ @0xJuancito github.com/0xJuancito/mul…

4 48 226 15K 235

pashov @pashovkrum

2 years ago

Special `try-catch` case from Solidity's docs: If the return data decoding throws an error it is not caught by the `catch` block.

4 7 81 8K 38

Download Image

pashov @pashovkrum

2 years ago

My learning technique has always been "just read 10 articles or watch 5 videos on the topic or more until you understand it" You can go very far with just this, especially by remembering that whatever is hard for you is in most cases hard for others as well

9 31 250 13K 70

pashov @pashovkrum

2 years ago

In smart contracts, whenever you see ">" (or "<") check that it shouldn't actually be ">=" (or "<=") and vice versa. Off-by-one errors are quite common and can result in a High severity vulnerability. Every experienced security researcher has caught such a bug at least once✌️

5 11 191 9K 53

pashov @pashovkrum

2 years ago

Your code might have a critical severity vulnerability, allowing an attacker to steal 100% of the TVL. This is your daily reminder to check each division in your application (especially when it comes to pool/vault shares math) and make sure it rounds down/up AGAINST the user.

3 5 105 7K 19

pashov @pashovkrum

2 years ago

Common smart contract attack vector? Flawed/missing input validation. For every `external/public` method check that each of its parameters is sufficiently validated, for example that a `uint256` isn't too small or too big. By just doing this you'll find many bugs as an auditor

3 11 127 9K 53

pashov @pashovkrum

2 years ago

Good place to look for smart contract bugs - duplication of code and reimplementation of the same business logic. Often in such code there can be discrepancies/differences, where one part of the code has an important check which is missing in the other. Possibly a Critical bug✌️

5 2 70 6K 20

pashov @pashovkrum

2 years ago

Exclusion from this rule is when the `payable` function actually forwards the `msg.value` directly to some recipient

0 1 7 1K 1

pashov @pashovkrum

2 years ago

First thing you MUST check when you see a smart contract that has a `payable` function is if the native asset can be withdrawn from it. Imagine deploying a contract, accruing hundreds of ETH of value in it and not being able to withdraw them. Critical severity vulnerability

16 15 156 10K 61

pashov @pashovkrum

2 years ago

One of the best ways to learn about previous smart contract hacks, understand them in depth and read the code with which the attack can be executed? Here it is, 10/10 resource github.com/coinspect/lear…

9 86 403 24K 492

pashov @pashovkrum

2 years ago

If you are auditing a smart contract and see math calculations for the slippage parameter to be passed to a swap operation, it is highly likely this is a Medium/High severity issue. Slippage parameters should only be calculated off-chain, because of possible sandwich attacks

4 20 196 12K 118

pashov @pashovkrum

2 years ago

Allowing deposits and withdraws in the same block for a staking/vault mechanism can be dangerous. An attacker can use a flashloan to deposit a large amount of tokens and withdraw them in the same block, simultaneously claiming the reward accrued (if any), essentially stealing it