Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute...

A Comprehensive Study of Exploitable Patterns in Smart Contracts: from Vulnerability to Defense

With the rapid advancement of blockchain technology, smart contracts have enabled the implementation of increasingly complex functionalities. However, ensuring the security of smart contracts remains a persistent challenge across the stages of development, compilation, and execution...

Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages

An ongoing campaign is targeting npm developers with hundreds of typosquat versions of their legitimate counterparts in an attempt to trick them into running cross-platform malware. The attack is notable for utilizing Ethereum smart contracts for command-and-control C2 server address distribution...

Vyper Buffer Error Vulnerability

Vyper is a Pythonic smart contract language for EVM open sourced by vyperlang. A buffer error vulnerability exists in Vyper 0.3.10 and earlier versions, which stems from allowing concat to write to memory buffer boundaries built-in, thereby overwriting existing valid data...

CVE-2023-32675 Nonpayable default functions are sometimes payable in vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

Anyone can add Bribe reward tokens and cause DoS

Lines of code Vulnerability details Impact The Bribe.notifyRewardAmount function does not have any access restriction. Anyone an attacker can frontrun and call this function to add arbitrary even malicious reward tokens up to MAXREWARDTOKENS = 16. An attacker is able to frontrun and add 16 fake...

Dynamic Binary Analysis Tool: Manticore

Manticore is a prototyping tool for dynamic binary analysis, with support for symbolic execution, taint analysis, and binary instrumentation. Manticore comes with an easy-to-use command line tool that quickly generates new program “test cases” or sample inputs with symbolic execution. Each test...