#offsec

New blog post! I recently completed the OffSec Expert Penetration Tester (OSEP) certificate. Here are my thoughts on it: https://ti-kallisti.com/certs/osep.html #InfoSec #RedTeam #RedTeaming #EDR #Offsec #Metasploit

Reentrancy forked Ethereum in 2016 ($60M DAO hack). It drained $52M from Curve in 2023 because Vyper 0.2.15-0.3.0 silently gave each @nonreentrant function its own independent lock. Cross-function reentrancy bypasses guards via shared state. Read-only reentrancy bypasses them via view function oracles. CEI is the foundation, guards are just backup. https://www.kayssel.com/newsletter/issue-57/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #Solidity

Flash loans: borrow $500M with zero collateral, manipulate AMM spot price oracles, hijack governance votes in a single block, run MEV sandwich attacks via Flashbots bundles. The only cost is gas. Euler Finance lost $197M via a donated-reserve trick that manufactured fake insolvency and turned Euler's own liquidation engine against itself. https://www.kayssel.com/newsletter/issue-56/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #DeFi