Underhanded Solidity Contest Winner Presentations
summary
Three short demos show concrete exploits and fixes: one uses addmod/mulmod evaluated right-to-left and a bizarre events index args eval order to set a new admin fee before protections run, allowing an unlimited-fee drain of a constant-product DEX; another shows ABI-encoded ERC20 approve calls matching the on‑chain order bytes so an attacker replays approvals as orders (fix: EIP‑1191/191 domained signatures); the last swaps ERC20 and ERC721 addresses so the identical transferFrom selector plus an XOR key collides and lets attackers steal NFTs.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 15:27Exchange Contract
- 16:45Key Mapping
- 18:33Create Bid
- 19:06Accept Bid
- 19:58Safe Transfer
- 23:11Conclusion
related talks
43mOutsmarting Smart Contracts
26mAll your Ether belong to us (Hacking Ethereum-based DApps)
46mAll your Ether are belong to us (a.k.a Hacking Ethereum-based DApps)
25mCommSec D2 - Smart Contract (In)Security
01h 33mClosing Ceremony and Finalist Demos
28mCross-Contract Ricochet Attacks & Off-Chain-On-Chain Manipulation of Billion Dollar NFT Collections
03h 01mPresentations and Awards
21mBreaking Bridges - An Incomplete Sampler of Bridges Hacks