KADA
@BAYCKada
Followers
34
Following
219
Media
0
Statuses
69
Joined February 2024
I've been teaching web3 security for several years now, both here on π and non discord with @BoringSecDAO. Every day it becomes more clear that while education is important, the only way towards mass adoption is to abstract away as much of this stuff as possible. 1/π§΅
17
41
303
ποΈ SEPTEMBER CALENDAR IS HERE! π Let's all have a #SafuSeptember and set a few hours of our month to get educated with #BoringSecDAO's FREE Security Classes! π«‘ Find a Class that suits your schedule, and hop in our Discord (link in bio) to sign-up. See you in class!
13
44
121
π¨Compound Labs Discord appears to be hacked π¨ Do not interact with any rewards/airdrop links being posted in their discord
3
9
35
DEADLINE EXTENDED for our Adventures of Boredo Art Contest! Submit your artworks before Sept 25, 12PM UTC. Full details on the #artwork channel in our Discord (link in bio). π«‘
0
2
12
BAYCKADA x BORING SECURITYπ«‘ We're looking forward to welcoming more Filipino Apes into the #BoringSecurity safu squad in our @BAYCKada Web3 Security 101 Partner Class tomorrow. π΅π See you there, Apes!
4
23
59
How do honeypot tokens on the trending list bypass detections? ππ By leaving a backdoor in permit signature verification, they can get any address's approval and transfer assets. πΌπ
TLDR; @gmgnai @evilcos @Phalcon_xyz @base @peckshield @Bitrace_team @realScamSniffer @0xAA_Science There are many honeypot ERC20 tokens in the trending list on this https://t.co/1pdCKeJlKn website. Please be cautious, even though it is labeled as "everything is SAFU." The
4
18
73
π¨ 4 hours ago, someone lost $350k worth of PT-ENA after signing a "approve" phishing transaction.πΈ
4
8
30
π Get our extension to enhance your security! π‘οΈβ¨ https://t.co/in0eXyJN1g
how to avoid being phished? be cautious of phishing attempts in these common scenarios, and familiarize yourself with common phishing signatures that can lead to the theft of your assets. https://t.co/FbeOaGkoqU
2
1
2
π Phishing ads use dynamic redirects to disguise as official domains.π
2
2
22
π¨ Phishing Alert: @Polymarket users targeted on Google search! π Protect your assetsβavoid simple mistakes. Get our security extension now! π‘οΈβ¨ Stay safe and alert! β οΈ
7
25
84
It seems today's victim @OnyxDAO (w/ >$3.8m loss) falls prey to a known precision issue in forked CompoundV2 code base. The drained funds include 4.1m VUSD, 7.35m XCN, 5k DAI, 0.23 WBTC, 50k USDT. The bug is exploited to leverage a nearly empty market to manipulate the exchange
11
16
54
π¨ 1 hour ago, another victim lost $251k worth of Aave USDC and Aave wstETH by signing multiple "permit" phishing signatures.πΈ
π¨ 4 hours ago, someone lost $350k worth of PT-ENA after signing a "approve" phishing transaction.πΈ
6
9
25
Address poisoning is on BTC now. The following is one concrete case. The phishing address (address 1) is disguising address 2 to send a small amount of BTC to address 3. Since addresses 2 and 3 have historic transactions, the attacker hopes to trick the owner into copying the
3
13
25
The upgrade issue arises from performing the upgrade by directly invoking initializeV4 without first calling initializeV3. Consequently, _totalOperatorWeight remains uninitialized, allowing the signature check to be bypassed. The upgrade tx: https://t.co/Wa2CAJSVai
The @Ronin_Network bridge suffered attacks, likely front-runned by MEV bots, and has been paused. The root cause is due to an upgrade issue. In recent months, there have been multiple incidents related to upgrades, highlighting the need for increased attention during these
1
4
24
A few hours ago, Penpie @Penpiexyz_io , a farming protocol built on the Pendle Protocol, suffered a reentrancy attack resulting in a loss of ~$27M. Since Penpie has been paused, we are now providing a detailed root cause analysis. This is a typical issue due to the lack of
9
17
75
(3/) Clear visualization of fund flow and balance changes
1
2
1
ALERT! Our system has detected hundreds of suspicious transactions targeting @InfernoBullWin since 09/11/2024. This appears to be a typical case of forced investment. While the average loss per transaction is only $1.5K, the total loss has reached ~$440K. As there is no direct
1
7
11
.@OnyxDAO was attacked, resulting in a loss of nearly $4M. The root cause was unverified user input during the liquidation process. Specifically, key parameters of the liquidateWithSingleRepay function in the NFTLiquidation contract were controllable by the attacker, allowing
3
17
54
