BlockchainC2

BlockchainC2 BlockchainC2は、攻撃者がC2にブロックチェーン（特にEthereumのスマートコントラクト機能）をどのように利用できるかを評価するための小さなPOCサーバー/エージェントです。 このアプリケーションの詳細はこちらで確認できます。 スマートコントラクト このPOC内で使用されるスマートコントラクトは非常にシンプルです: root@kitploit: pragma solidity ^0.5.0; contract EventC2 address owner; event ServerDatabool f, bool enc, int seq, stri...

aether

Aether v6.0 — スマートコントラクトセキュリティ解析フレームワーク バージョン 6.0 | v6.0の新機能 | 変更履歴 Aetherは、Solidityスマートコントラクトの解析、脆弱性の発見、Foundryベースの概念実証（PoC）テストの生成、メインネットフォーク上でのエクスプロイト検証を行うPythonベースのフレームワークです。Solidity AST解析、汚染解析、制御フローグラフ解析、クロスコントラクト解析、Halmosシンボリック実行、180以上のパターンベースの静的検出器、共有 SAGE 組織記憶を備えた協調型マルチエージェントLLMパイプライン...

slither-mcp

Slither MCP Server 一个基于模型上下文协议（MCP）的服务器，利用 Slither 为 Solidity 智能合约提供静态分析能力。 概述 此 MCP 服务器封装了 Slither 静态分析功能，使其可通过模型上下文协议进行访问。它能够分析 Solidity 项目（Foundry、Hardhat 等），并生成关于合约、函数、继承层次结构等的全面元数据。 您也可以将 Slither MCP 作为易于使用的 Slither API 用于其他场景。 特性 缓存 ：Slither 运行结果会缓存到...

slither

Slither, the smart contract static analyzer Join the Empire Hacking Slack - Discussions and Support Slither is a Solidity & Vyper static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to...

slither

Slither，智能合约静态分析器 加入 Empire Hacking Slack - 讨论与支持 Slither 是一个用 Python3 编写的 Solidity 和 Vyper 静态分析框架。它运行一套漏洞检测器，打印合约细节的可视化信息，并提供 API 以轻松编写自定义分析。Slither 使开发者能够发现漏洞，增强代码理解，并快速原型化自定义分析。 功能 使用 安装方法 使用 uv（推荐） 使用 Pip 使用 Git 使用 Docker 集成 Detectors Printers 快速审查 Printers 深度审查 Printers 工具 API 文档 获取帮助 常见问题...

CVE-2026-1111-Smart-Contract-Cross-Function-Reentrancy

CVE-2026-1111 – 智能合约跨函数重入 程序代码（Solidity + Python） root@kitploit: // VulnerableBank.sol - Simplified reentrancy example with cross-function bypass pragma solidity ^0.8.0; contract VulnerableBank mappingaddress = uint256 public balances; function deposit public payable balancesmsg.sender +=...

solidity_CVE-2021-42574-POC

solidityCVE-2021-42574-POC 2023年1月31日，Altin tin-z，github.com/tin-z PoC 针对solidity和solc编译器的CVE-2021-42574的PoC。 安装 root@kitploit: solc 并选择 0.8.17 版本 https://github.com/crytic/solc-select foundry https://github.com/foundry-rs/foundry 部署合约 root@kitploit: SOLV=0.8.17 foldert=testopen mkdir $foldert &&...

evm-audit-helpers

evm-audit-helpers 概述 evm-audit-helpers 是一个精心整理的 Solidity 代码片段、Foundry 脚本和测试模板集合，旨在加速 EVM 智能合约安全审计。该仓库打包了针对常见审计问题的可复用构建模块，如重入攻击、存储布局不匹配和 gas 优化陷阱，使审计人员和开发者能够专注于逻辑而非样板代码。 核心目标： 加快审计准备 ，提供现成的检查和模式。 确保审计报告的一致性 ，通过提供标准测试套件。 促进学习 ，通过文档完善的示例和最佳实践指南。 功能特性 类别| 描述| 主要文件 ---|---|--- 重入检查器| 辅助修饰符、nonReentran...

CVE-2026-23003-Cross-Chain-Bridge-Message-Forging-via-Missing-Origin-Chain-ID

CVE-2026-23003 – 因缺失源链 ID 导致的跨链桥消息伪造 程序代码（Solidity + Python 漏洞利用） root@kitploit: // Bridge.sol - Vulnerable bridge contract contract Bridge mappingbytes32 = bool public processed; event Depositedaddress from, address to, uint256 amount, uint256 chainId; function depositaddress to, uint256 amount,...

CVE-2026-23008-Solidity-Assembly-Return-Data-Size-Confusion

CVE-2026-23008 – Confusión de tamaño de datos de retorno en ensamblador Solidity Código del programa Solidity root@kitploit: // ReturnSizeConfusion.sol contract Victim function callExternaladdress target external returns bytes memory bool success, bytes memory ret =...

SoliditySecurity

What's this Esta publicación pretende ser una introducción relativamente profunda y actualizada que detalla los errores pasados cometidos por desarrolladores de Solidity, con el fin de evitar que los futuros desarrolladores repitan la historia. Table of Contents 1. Reentrancia La Vulnerabilidad...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

MAL-2026-6706 Malicious code in hardhat-plugin-solidity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142 Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hardhat-plugin-' name while...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by unknown CVE via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-9WXG-VF3R-56HC...

MAL-2026-5907 Malicious code in chai-solidity-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6482febfb9b57ff5c59a2170dab31ec0dd814ccc21b6996dbb9e7a0c9e575c The package masquerades as a Web3/Solidity testing toolkit but its shipped source is an unrelated stream-pipeline library plus a hidden payload runne...

MAL-2026-5514 Malicious code in solidity-abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d00c844413b4c809e5d57d1952a17f67f2c72324fd379c91d5fdd8aa3fdd9da9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview solidity-abi is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in solidity-abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d00c844413b4c809e5d57d1952a17f67f2c72324fd379c91d5fdd8aa3fdd9da9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview solidity-coverage-plus is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

MAL-2026-4672 Malicious code in solidity-coverage-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44e5a7775aa2bbde61d35a548198d976f9bdc6e9b11de33a2e28f6a6a9929de6 Package name impersonates the well-known solidity-coverage Hardhat plugin sc-forks and ships a verbatim copy of the upstream README. On...