Highlights #2
Hack Tracks | Events | Articles | Threads and what not!!
Gm Commiters,
As we close out another dynamic month, we’re excited to share the latest edition of our recap newsletter! We’re eager to continue delivering monthly updates on our work, insights, and key achievements in Web3 security.
Articles: In-Depth Security Insights
We published several articles that focus on key areas of blockchain security and best practices:
Essential Security Tips for Solana Developers
When writing Solana programs, it's essential to validate account ownership, manage data integrity, handle rent exemptions, and ensure proper error handling. By following best practices in access control, concurrency, program upgrades, and security testing, developers can significantly mitigate vulnerabilities and ensure a secure blockchain application.
Reference: solana-security
Security Overview on Vesting Contracts
Token vesting is essential in Web3 to prevent large token dumps and align stakeholder incentives, but improper implementations can lead to significant security risks. This article explores common vesting patterns and provides secure coding practices to safeguard smart contracts.
Reference: token-vesting-contracts
BLS Signatures
BLS signatures enable efficient signature aggregation, reducing storage and verification costs while maintaining cryptographic security. They are particularly valuable in multi-signature wallets, validator committees, and projects like Ethereum 2.0 for optimizing blockchain performance.
Reference: understanding-bls-signatures
Solana Best Practices
Solana's growing ecosystem demands secure and efficient development practices. This guide highlights key best practices for building robust programs, focusing on security, performance, and scalability.
Reference: solana_best_practices
Threads: Quick, Actionable Reads
We released several Twitter threads diving into various security topics:
Gas Optimization Techniques in Solidity
Gas optimization is essential for developing cost-effective and scalable dApps, as it helps reduce gas consumption and improve contract efficiency. Understanding these techniques is crucial for developers to enhance the performance of their applications.
Reference: gas_optimization_techniques
Zero-Knowledge Proofs (ZKPs)
Zero-Knowledge Proofs (ZKPs) enable the validation of knowledge without disclosing the actual information, enhancing privacy in blockchain applications. They are revolutionizing secure data handling for private transactions and identity verification.
Reference: ZKPs
Fully Homomorphic Encryption (FHE)
Fully Homomorphic Encryption (FHE) enables computations on encrypted data without decryption, preserving the privacy of sensitive information during processing. This technology allows smart contracts and DApps to operate without exposing raw data.
Reference: FHE
Hack Tracks: Insights from Industry Incidents
We closely monitored multiple major hacks in the Web3 ecosystem, providing insights to help improve security:
Hack Track #1
Recent security incidents include a $27M reentrancy attack on Penpie's farming protocol and a reentrancy exploit draining 21 ETH from Pythia Stablecoin. Additionally, compromised DAI addresses on L2 were exposed, Chainlink's Discord suffered a phishing attack, and hackers laundered $42.7M in ETH via Tornado Cash.
Hack Track #2
Exploits include $26K lost by OTSea, $130K by Seamless Protocol, $22M by indodax, and $1.4M by cut2024cut, with a security tip to stay vigilant across all platforms.
Hack Track #3
Security breaches include approximately $6M lost by DeltaPrime, $2M by Banana Gun, $4.9M by Shezmu, and a significant $52M by BingX, with additional losses reported by Rivus DAO.
Hack Track #4
Exploits affected several platforms, with losses including $235K from Bankroll Network, $5.23M from Truflation, $3.8M from Onyx, and $2M from Bedrock.
Hack Track #5
Security incidents include $24K lost by Fire Token ($FIRE), $5.7M from EigenLayer, and $130K from an unknown lending project hack.
Monthly Hack Track
In September 2024, the crypto space suffered $161M in losses from exploits, flash loan attacks, and exit scams, with only $2M recovered. Exploits accounted for $155.7M, led by BingX ($48.5M) and Penpie ($27.3M). Flash loan attacks drained $4.7M, while exit scams took $0.7M, highlighting the need for stronger security practices across the industry.
Events: Industry Engagement
We participated in Token2049 Singapore, one of the premier blockchain events. We had an incredible experience. It was exciting to explore various innovative projects and see security becoming a key focus for many, a shift that's not always common in the Web3 space. We also had the opportunity to share our expertise and insights on the evolving blockchain security landscape among projects. Check out the event highlights here!
Check out the event highlights here.
Partnership Announcements
We are excited to announce several key partnerships:
ETHMemeFun
We will be assisted in auditing our contracts, which will further enhance the safety and security of token deployment and trading on their platform.
Reference: 0xCommit partners with ETHMemeFun
Manta Ecosystem
As the official security partner for Manta ecosystem, 0xCommit will offer a range of security services designed to enhance the safety and success of projects building on Manta.
Reference: 0xCommit becomes a security partner for Manta Ecosystem
Hela Space
This collaboration will bolster Hela's mission by enhancing the security of their ecosystem through our state-of-the-art smart contract auditing service. Together, we're committed to providing comprehensive protection for their users, ensuring the highest standards of security in the blockchain space.
Reference: 0xCommit partners with HeLa Space
Bitduc8
This collaboration brings together our expertise in blockchain security and Bitduc8's educational focus to provide holistic Web3 solutions. By this strategic partnership, we aim to empower individuals and organizations to navigate the rapidly evolving decentralized landscape with the highest level of security and knowledge. Together, we're building a more secure and informed future for Web3.
Reference: 0xCommit Partners with Bitduc8
AMAs: Engaging with the Community
We held insightful AMAs with key partners:
AMA with Manta Ecosystem
We held a Twitter AMA session to discuss our collaboration with MantaNetwork, focusing on the importance of blockchain security solutions. Participants engaged in insightful discussions about our initiatives and the benefits of this partnership for the Manta ecosystem.
Reference: AMA_with_ManataNetwork
AMA with Hela Space
In this session we discussed HeLa's mission and the challenges they aim to solve as a next-generation layer 1 blockchain protocol. We introduced 0xCommit, sharing our origin and role in enhancing blockchain security. We highlighted the critical importance of security for Hela and how 0xCommit provides comprehensive solutions through smart contract auditing and advanced security measures. We also explored emerging attack vectors in layer 1 protocols, how auditors are addressing these evolving threats, and proactive steps to secure platforms. The session underscored our joint commitment to safeguarding the blockchain ecosystem.
Reference: AMA_with_HeLa_Space
Best regards,
The 0xCommit Team
Empowering Web3 Security
Connect With Us:
Website: 0xCommit.com
Telegram: 0xCommitAudits