Git-Mirrors/blockchains-security-toolkit
1
0
Fork 0
mirror of https://github.com/autistic-symposium/blockchains-security-toolkit.git synced 2025-08-14 09:05:35 -04:00
Code Issues Projects Releases Packages Wiki Activity

organize chapters for the ongoing research, remove dead links, add new resources

Browse source
This commit is contained in:
bt3gl 2024-11-04 18:42:30 +07:00
parent 1748d1ed22
commit 184e917000
98 changed files with 421 additions and 11268 deletions
Download patch file Download diff file Expand all files Collapse all files

32
advanced_expert/vulnerabilities/delegatecall/README.md
View file

@ -2,32 +2,36 @@
<br>
#### 🖤 This is my favorite vuln
### tl; dr
<br>
---
### TL;DR
1. Call to untrusted contracts may introduce unexpected risks and errors.
2. External calls controlled by an attacker may force a contract to transition into an undefined state.
3. Types of external calls: `STATIC CALL` and `DELEGATE CALL`.
4. Using DELEGATE CALL, contract can preserve the storage state while using the logic of the contract. This introduces the concept of Proxies.
3. Types of external calls: `STATICCALL` and `DELEGATECALL`.
4. Using `DELEGATECALL`, contract can preserve the storage state while using the logic of the contract. This introduces the concept of Proxies.
5. The proxy contract redirects all the calls it receives to an "logic contract", whose address is stored in its "proxy contract". The proxy runs the "logic contract"'s code as its own (modifying its storage and the balance of the "proxy contract").
<img width="956" alt="Screen Shot 2022-09-17 at 5 30 04 PM" src="https://user-images.githubusercontent.com/1130416/190880608-1b511a87-d91e-4ae4-8714-08cd7e8eec89.png">
<br>
<p align="center">
<img width="500" src="https://user-images.githubusercontent.com/1130416/190880608-1b511a87-d91e-4ae4-8714-08cd7e8eec89.png">
</p>
<br>
* bt3gl's diagram:
<p align="center">
<img src="https://github.com/go-outside-labs/blockchain-auditing/assets/138340846/405335ca-a1c7-4d3c-83fb-4b96ee13a384" width="55%" align="center" style="padding:1px;border:1px solid black;"/>
</p>
<br>
---
### Learning resources
### cool resources
<br>
* [SWC docs on DELEGATECALL](https://swcregistry.io/docs/SWC-112)
* [Sigma Prime post on DELEGATECALL](https://blog.sigmaprime.io/solidity-security.html#delegatecall)
* **[SWC docs on DELEGATECALL](https://swcregistry.io/docs/SWC-112)**
* **[sigma prime post on DELEGATECALL](https://blog.sigmaprime.io/solidity-security.html#delegatecall)**
* **[understanding DELEGATECALL, by d. arends](https://www.derekarends.com/solidity-vulnerability-understanding-delegatecall/)**

13
advanced_expert/vulnerabilities/delegatecall/proxies.md
View file

@ -71,9 +71,10 @@
<br>
* [proxy patterns](https://mirror.xyz/0xB38709B8198d147cc9Ff9C133838a044d78B064B/M7oTptQkBGXxox-tk9VJjL66E1V8BUF0GF79MMK4YG0)
* [how diamond upgrades work](https://dev.to/mudgen/how-diamond-upgrades-work-417j)
* [the state of smart contract updates](https://blog.openzeppelin.com/the-state-of-smart-contract-upgrades/)
* [multiple ways to update a contract](https://cryptomarketpool.com/multiple-ways-to-upgrade-a-solidity-smart-contract/)
* [web3 Tutorial: write upgradeable smart contract (proxy) using OpenZeppelin](https://dev.to/yakult/tutorial-write-upgradeable-smart-contract-proxy-contract-with-openzeppelin-1916)
* [safe smart account & diamond proxies, by safe](https://safe.mirror.xyz/P83_rVQuUQJAM-SnMpWvsHlN8oLnCeSncD1txyMDqpE)
* **[proxy patterns](https://mirror.xyz/0xB38709B8198d147cc9Ff9C133838a044d78B064B/M7oTptQkBGXxox-tk9VJjL66E1V8BUF0GF79MMK4YG0)**
* **[how diamond upgrades work](https://dev.to/mudgen/how-diamond-upgrades-work-417j)**
* **[the state of smart contract updates](https://blog.openzeppelin.com/the-state-of-smart-contract-upgrades/)**
* **[multiple ways to update a contract](https://cryptomarketpool.com/multiple-ways-to-upgrade-a-solidity-smart-contract/)**
* **[web3 Tutorial: write upgradeable smart contract (proxy) using OpenZeppelin](https://dev.to/yakult/tutorial-write-upgradeable-smart-contract-proxy-contract-with-openzeppelin-1916)**
* **[safe smart account & diamond proxies, by safe](https://safe.mirror.xyz/P83_rVQuUQJAM-SnMpWvsHlN8oLnCeSncD1txyMDqpE)**
* **[the proxy pattern, by noxx](https://noxx.substack.com/p/smart-contract-patterns-the-proxy)**