solidity_CVE-2021-42574-POC

solidityCVE-2021-42574-POC Jan 31 2023, Altin tin-z, github.com/tin-z PoC POC of CVE-2021-42574 for solidity and solc compiler. install solc and select 0.8.17 version https://github.com/crytic/solc-select foundry https://github.com/foundry-rs/foundry deploy contract SOLV=0.8.17 foldert=testopen...

slither

Slither, the smart contract static analyzer Join the Empire Hacking Slack - Discussions and Support Slither is a Solidity & Vyper static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to...

slither-mcp

Slither MCP Server A Model Context Protocol MCP server that provides static analysis capabilities for Solidity smart contracts using Slither. Overview This MCP server wraps Slither static analysis functionality, making it accessible through the Model Context Protocol. It can analyze Solidity...

BlockchainC2

BlockchainC2 BlockchainC2 is a small POC server/agent to assess how the Blockchain specifically Ethereum's Smart Contract functionality can be used by an attacker for C2. Details regarding this application can be found here. Smart Contract The Smart Contract used within this POC is quite simple:...

aether

Aether v6.0 — Smart Contract Security Analysis Framework Version 6.0 | What's New in v6.0 | Changelog Aether is a Python-based framework for analyzing Solidity smart contracts, generating vulnerability findings, producing Foundry-based proof-of-concept PoC tests, and validating exploits on mainne...

CVE-2026-1111-Smart-Contract-Cross-Function-Reentrancy

CVE-2026-1111 – Smart Contract Cross‑Function Reentrancy Program Code Solidity + Python // VulnerableBank.sol - Simplified reentrancy example with cross-function bypass pragma solidity ^0.8.0; contract VulnerableBank mappingaddress = uint256 public balances; function deposit public payable...

evm-audit-helpers

evm-audit-helpers Overview evm-audit-helpers is a curated collection of Solidity snippets, Foundry scripts, and test templates designed to accelerate EVM smart‑contract security audits. The repository bundles reusable building blocks for common audit concerns such as reentrancy, storage layout...

CVE-2026-23003-Cross-Chain-Bridge-Message-Forging-via-Missing-Origin-Chain-ID

CVE-2026-23003 – Cross‑Chain Bridge Message Forging via Missing Origin Chain ID Program Code Solidity + Python exploit // Bridge.sol - Vulnerable bridge contract contract Bridge mappingbytes32 = bool public processed; event Depositedaddress from, address to, uint256 amount, uint256 chainId;...

SoliditySecurity

What's this This post aims to be a relatively in-depth and up-to-date introductory post detailing the past mistakes that have been made by Solidity developers in an effort to prevent future devs from repeating history. Table of Contents 1. Re-Entrancy The Vulnerability Preventative Techniques...

slither

Slither, el analizador estático de contratos inteligentes Únete al Slack de Empire Hacking - Discusiones y Soporte Slither es un framework de análisis estático para Solide y Vyper escrito en Python3. Ejecuta un conjunto de detectores de vulnerabilidades, imprime información visual sobre los...

CVE-2026-23008-Solidity-Assembly-Return-Data-Size-Confusion

CVE-2026-23008 – Solidity Assembly Return Data Size Confusion Program Code Solidity // ReturnSizeConfusion.sol contract Victim function callExternaladdress target external returns bytes memory bool success, bytes memory ret = target.callabi.encodeWithSignature"someFunc"; requiresuccess, "call...

Malicious Package

Overview solidity-lock is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17302 Malicious code in solidity-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB...

Malicious code in solidity-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB...

Verifiable Randomness for Blockchain-Based Lottery Systems

As lotteries and other high-stakes decentralized applications increasingly depend on unpredictable randomness for their operations, the lack of a secure and transparent on-chain random number generator that is verifiable by all participants remains a critical open problem. Various approaches to...

Solidity Meets LLMs: A Transformer-Based Approach to Smart Contract Vulnerability Detection

The growing adoption of blockchain technologies, particularly the Ethereum platform, has amplified the critical role of smart contracts in decentralized applications. However, the increasing complexity and financial value of these contracts make them prime targets for cyber attacks. In this work,...

CVE-2026-57583: Improper Control of Generation of Code

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

PT-2026-91282

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges

Cross-chain bridges move value between blockchains. Intent-based bridges are a variant where a solver fulfills a user's declared outcome and an off-chain settlement layer later reconciles the fill against the deposit. Existing smart-contract fuzzers and static analyzers only flag known-bad code...

Automated Vulnerability Injection in Smart Contracts Using Large Language Models

Assessing vulnerability detection tools for smart contracts requires datasets with known ground truth, yet such datasets are scarce and difficult to build by hand. We propose an approach that uses Large Language Models LLMs to automatically inject vulnerabilities into Solidity smart contracts, an...