Thanks for all the bugs!
summary
Runs a decompiler and a rule-based analysis engine that builds program concepts from thousands of logical rules, powering contract-library.com and a watchdog that discloses high-value flaws; the team reports 8 significant bug bounties totaling over $2.5M. Shows a concrete exploit pattern: a phantom permit in WETH (fallback accepts permit calls) lets an attacker use transferFrom on previously approved accounts. Advises adding explicit invariants, clear comments and auditable APIs so auditors can verify assumptions quickly.
AI-written summary · about
chapters (6)
- 0:00Introduction to Ddob
- 3:38Common solidity vulnerabilities
- 6:05Analyzing the Weth phantom bug
- 10:14Writing auditable code
- 16:14Auditor-developer collaboration
- 17:47Q&A session
related talks
20mBillion Dollar Bugs
22mHow Decompilation Uncovers Smart Contract Vulnerabilities
51mA Deal with the Devil: Breaking Smart Contracts
21mFrom High-Level DeFi Properties to Concrete Security Bugs
25mCommSec D2 - Smart Contract (In)Security
01h 33mWhite Hat Panel: DeFi Exploits
53mOpening Keynote – Dr. Katie Paxton-Fear
18mFavorite DeFi Vulnerabilities