owasp-scs

OWASP 智能合约安全 SCS 加入 OWASP 智能合约安全 Slack 频道 讨论与支持 这是 OWASP 智能合约安全 SCS 项目的官方 GitHub 仓库。该综合计划为智能合约的开发、审计和验证提供安全标准、指南和资源。SCS 生态系统由多个相互关联的子项目组成，它们相互补充，以促进智能合约、去中心化应用 dApps 和 EVM 区块链系统中的稳健安全实践和合规性。 📚 概述 SCS 项目围绕多个相互关联的资源构建，每个资源在智能合约安全生命周期中都有其独特作用： OWASP 智能合约安全验证标准 SCSVS：...

awesome-web3-security — Updated!

awesome-web3-security A curated list of Web3 Security materials and resources for Pentesters and Bug Hunters. If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below, perfect works of ar...

CredShields Joins Forces with Checkmarx to Bring Smart Contract Security to Enterprise AppSec Programs

Singapore, Singapore, 19th November 2025, CyberNewsWire...

EUVD-2018-5075

Malware in sbrugna...

EUVD-2018-5480

Malware in sbrugna...

EUVD-2018-5479

Malware in sbrugna...

EUVD-2018-5137

Malware in sbrugna...

EUVD-2018-5427

Malware in sbrugna...

EUVD-2018-5620

Malware in sbrugna...

EUVD-2018-5503

Malware in sbrugna...

EUVD-2018-5413

Malware in sbrugna...

EUVD-2022-6503

Malicious code in bioql PyPI...

EUVD-2025-21789

Malicious code in bioql PyPI...

EUVD-2023-1359

Malicious code in bioql PyPI...

Exploit for CVE-2025-4126

POC-CVE-2025-4126 smart contract reentrancy attack vulnerabili...

CVE-2025-54070

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...

Missing validation to ensure that the _l2CoreGovTimelock parameter is not the zero address in the initialize function

Lines of code Vulnerability details Impact The initialize function accepts a parameter l2CoreGovTimelock and does check if it's a contract address using Address.isContract. However, there's no explicit check to ensure that l2CoreGovTimelock is not the zero address...

Upgraded Q -> 2 from #7 [1677668529704]

Judge has assessed an item in Issue 7 as 2 risk. The relevant finding follows: L-01 changePayees Suggest adding to check whether newPayees are duplicated to avoid totalShares error function changePayeesaddress calldata newPayees, uint256 calldata newShares external override onlyManager ... for...

Unpacking the "0x1626ba7e" Mystery: The Risks of Unidentified Fixed Values in Smart Contracts - loss of funds

Lines of code Vulnerability details Impact The use of a fixed value in the require statement without understanding its significance creates a security vulnerability in the contract. An attacker could manipulate the returned value to bypass the require statement and execute malicious code. This ca...

Signature Replay Attack when EntryPoint contract is changed

Lines of code Vulnerability details Signature Replay Attack when EntryPoint contract is changed Impact User operations can be replayed on smart accounts once the EntryPoint is changed. This can lead to user's loosing funds or any unexpected behaviour that transaction replay attacks usually lead t...