Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

The first phishing attack using a bug bounty that I've seen. A blackhat submitted a proof of concept with a bug bounty submission. They first started with a plausible responsible-disclosure report. It referenced legitimate contract functions, used the standard format, and offered mitigating steps.

The Foundry configuration file, a smart contract development framework used in Solidity, contained ffi=true to turn on system command execution during test execution. A utility for the ERC20 token (a standard thing that people wouldn't look at) contained code to CURL a bash script from a URL, and execute this script in bash.

The person who triaged the bug bounty report had ran the PoC on their local machine, assuming it was a legitimate PoC. Upon doing this, they gave the attacker access to their machine. After 4.5 hours, a private key was recovered was used to steal $250K from the projects treasury.

This is a very scary thought, but something that most of the industry expected to come. Executing arbitrary code for PoC's seems like a bad idea but PoC's are a requirement for submission... So, what's the deal then? We need to sandbox our bug bounty PoC generation in order to prevent attacks like this.