Rethinking Web3 Development
Why Most Devs Are Missing the Point The problem here is that 80% of developers working in the industry have no idea how to think in terms of blockch…
Последние новости
⚑ Сообщить о проблемеTech news from the best sources
Все темы
- игры
AI
News
Tech
agents
ai
api
architecture
automation
backend
beginners
career
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
The fee-on-transfer bug that locks funds forever (with a working PoC)
Last week I found this pattern in a real audit. I can't name the protocol — it's under responsible-disclosure until the program confirms a fix — but…
Блокчейн цел, деньги пропали: атаки на оракулы и безопасное чтение цены в Solidity
В начале сентября протокол Tectonic на Cronos потерял около 75 миллионов долларов. Блокчейн при этом работал штатно — консенсус не сломался, приватн…
Тестируем смарт-контракты на Hardhat 3: node:test, viem и ни одного mocha
Hardhat 3 выбросил mocha и chai и теперь тесты гоняет родной node:test, а с контрактом разговаривает viem. Гайды по миграции подробно рассказывают п…
How to Rehearse Smart-Contract Rollback Before Calling a System Upgradeable
A smart contract can accept a new implementation and still have no safe route back. The upgrade transaction may succeed, the old bytecode may remain…
400 rounds, and the bug never showed up. So I stopped rolling dice.
The most expensive bug in the game I just shipped could only fire on 1.01% of rounds. Here is the shape of it. Replay is a betting game where the fi…
Hedera's EVM speaks tinybar, its RPC speaks weibar, and both mistakes return SUCCESS
I lost most of a day to a bug that never once failed. I was building a contract that pays for its own future: an access subscription that re-arms it…
The one fact no Ethereum receipt carries: which transaction ran first
You got sandwiched. Your swap landed between a searcher's buy and their sell, you paid for it, and every receipt you can pull agrees that you were r…
Yul Dark Arts: Understanding the EVM from first principles
In this article, I want to walk you through my experience learning Yul to better understand how the EVM manages memory and how you can use this to y…
Six contracts that pass EXTCODESIZE(owner) > 0 and still withdraw their order
On an order book, the depth you see is a promise. The market maker showing you a bid can pull it in the same block you try to take it, and nothing o…
3 Things I Learned Building a Smart Contract Project with Foundry
When I started building my NFT marketplace in Solidity, my main goal was simple: Make it work. But as the project grew, I realized that writing Soli…
Как выбирать фреймворк для разработки умных контрактов на Solidity для нового проекта?
В этом году стукнуло уже 10 лет, как я разрабатываю умные контракты на Solidity под EVM. В связи с этим решил нап…
Redbelly Network Troubleshooting Guide: 22 Common Developer Errors and Their Fixes
Redbelly Network Troubleshooting Guide 22 common developer errors, with the exact command that fixes each one. Redbelly Network is an EVM-compatible…
Two access-control hacks drained $1.4M this month - the one-line bug, and the check that catches it
In the last few weeks two protocols were drained through the same class of bug: an access-control exploit . RISEx lost ~$673k. WEMIX.FI Lend lost ~$…
5 false positives your Solidity scanner is probably reporting right now
Every automated Solidity security tool has the same disease: it cries wolf. Run one on an audited protocol and you get 600 "findings," 98% of which…
My smart-contract scanner reports almost nothing — and that's the whole point
Most Solidity security tools have the same failure mode: they cry wolf. You run them on an audited protocol and get 600 "findings," 98% of which are…
Function Calling With a Local LLM to Drive Foundry: Fuzz, Read, Repeat
The first time I let a local model drive Foundry unsupervised, it spent eleven turns trying to fix a fuzz test by renaming the test function. Not ch…
Qwen2.5-Coder vs DeepSeek-Coder for Solidity Review: What I Actually See Locally
I keep a folder of ten small Solidity contracts with bugs I planted myself: a classic reentrancy in a withdraw function, a missing access modifier o…
Dev Log 07: Mitigating RPC Latency Desyncs During Polygon Hard Forks
Maintaining real-time transaction tracking layers across a multi-tier infrastructure requires seamless node data synchronization. During heavy netwo…
I ran my Solidity scanner on 6 top-audited DeFi protocols. Every 'critical' was a false positive — here's why.
Most Solidity scanners are high-recall, low-precision. They flag 40 things, 38 are noise, and after the third report you stop reading them — so the…
Dev Log 06: Designing Reentrancy Guards and State Locks in Staking Pools
When building our live core liquidity tiers ( hNobtStaking and BroilerPlusStaking ) on Polygon Mainnet, preventing transaction-ordering dependencies…
I'm Entering My First Sherlock Audit Contest: The Setup, the Plan, the Fear
I have shipped software for 18 years. Roughly 8 of those in crypto. And this week I signed up for my first Sherlock audit contest, and my hands were…
MythX shut down in March and nothing replaced it so I built something
If you were using MythX before March 31st, you already know. ConsenSys quietly sunset the entire MythX suite. One day it was there, the next your CI…
Shipping a Solidity contract to mainnet? Do this 20-minute self-check first
You built something. Tests pass. You're days from mainnet. Before you either skip security entirely (please don't) or spend weeks lining up a full a…
I ran my Solidity scanner across the 10 most-audited codebases in web3. Here's every flag.
The dirty secret of automated smart-contract security tools isn't that they miss bugs. It's that they cry wolf. Point a typical static analyzer at a…
I almost reported a critical bug that didn't exist. One constant saved me.
Last week I was reviewing the staking engine of a protocol before its mainnet launch. Deep in a 1,400-line contract, I found what looked like a seri…
7 ways to drain an ERC-4626 vault (and how a good protocol closes each one)
Based on real audits of production vaults and AMMs. A tokenized vault (ERC-4626) looks simple: deposit assets, get shares; burn shares, get assets b…
I built my first Robinhood Chain app as an index basket
I built a small index basket app on Robinhood Chain because I wanted to understand the developer path from the first contract deploy all the way to…
The Tether Paradox: Shitty ERC-20s, OpenZeppelin, and the Unstoppable Web
I have a confession to make. When I first saw that Tether—the behemoth behind the $110 billion USDT stablecoin—was the primary financial backer of H…
Signature Replay Attacks in Solidity: The Bug That Looks Correct
Some smart contract bugs scream at you. A missing onlyOwner , a reentrancy with the state update after the transfer. Signature replay is not one of…