GeistHaus
log in · sign up

Earn $200K by fuzzing for a weekend: Part 1

secret.club

By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing.

3 pages link to this URL
Vegas 2022 - A web3 security review

This year marks 5 year since I gave my first blockchain/web3 related presentation at DEFCON 25 when I presented Porosity which was an experimental decompiler and static analysis tool for Ethereum Virtual Machine bytecode, but also mentioned on why we should keep an eye on WebAssembly Virtual Machines back when eWASM was being drafted and an option for Ethereum as a replacement for EVM itself. Since then, new layer 1 blockchains have emerged such as Solana (eBPF-variant), and NEAR & Polkadot (WebAssembly) as part of a new wave of architectures relying on the LLVM compiler and ELF file formats, instead of reinventing the wheel like the Ethereum Virtual Machine and Solidity programming language.

0 inbound links article en web3 web3