Rubén Santos García

In an upgradeable proxy, the funds live in the proxy and the logic is swappable. Own the pointer, own everything. This issue covers delegatecall storage collisions (Audius), uninitialized implementations (Wormhole's other bug), UUPS selfdestruct bricking (Parity froze 513k ETH), and the 2025 mempool bots front-running initialize() on fresh proxies. Plus slither-check-upgradeability to catch it. https://www.kayssel.com/newsletter/issue-61/ #InfoSec #CyberSecurity #Web3 #SmartContracts #BugBounty #DeFi

Flash loans: borrow $500M with zero collateral, manipulate AMM spot price oracles, hijack governance votes in a single block, run MEV sandwich attacks via Flashbots bundles. The only cost is gas. Euler Finance lost $197M via a donated-reserve trick that manufactured fake insolvency and turned Euler's own liquidation engine against itself. https://www.kayssel.com/newsletter/issue-56/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #DeFi

Reentrancy forked Ethereum in 2016 ($60M DAO hack). It drained $52M from Curve in 2023 because Vyper 0.2.15-0.3.0 silently gave each @nonreentrant function its own independent lock. Cross-function reentrancy bypasses guards via shared state. Read-only reentrancy bypasses them via view function oracles. CEI is the foundation, guards are just backup. https://www.kayssel.com/newsletter/issue-57/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #Solidity

Cross-chain bridges lost ~2B USD in 2022 alone. Every major hack lived in the same place: the attestation layer that decides a deposit really happened. Ronin (stolen validator keys), Wormhole (forged guardian signature via unchecked account), Nomad (0x00 trusted root looted by hundreds), BNB Token Hub (forged IAVL Merkle proof). New issue breaks down all five. https://www.kayssel.com/newsletter/issue-58/ #InfoSec #CyberSecurity #Web3 #SmartContracts #BugBounty #DeFi

Browser exploitation isn't web bugs. It's memory corruption across three processes. This issue walks the full chain: V8 JIT type confusion for arbitrary read/write, WebAssembly RWX pages to run shellcode, WebGPU/Dawn as the softer GPU-process target, and the renderer→GPU→broker sandbox escape that ends in --no-sandbox. https://www.kayssel.com/newsletter/issue-59/ #InfoSec #CyberSecurity #Pentesting #BugBounty #BinaryExploitation #WebGPU

XS-Leaks steal data the same-origin policy swears it protects. SOP hides response contents, not response behavior. This issue covers error-event oracles, frame counting via window.length, the single global socket pool that turns any browser into a stopwatch, and cache probing (terjanq leaked private Google emails this way). Blind injection, cross-origin, against a site you cannot read. https://www.kayssel.com/newsletter/issue-62/ #InfoSec #CyberSecurity #WebSecurity #BugBounty #AppSec #XSLeaks

@hannaB@social.vir.group Exactly. In DeFi the safety net is just another callable function, and atomicity lets someone chain it against you in one transaction. Euler's liquidation engine did precisely what it was built to do, aimed at a state that shouldn't have been reachable. Every feature is an entry point here, that's the tax on composability

@hannaB@social.vir.group Honestly, mostly theoretical for me so far. I keep seeing the setup, unguarded view reading state mid-execution, but I haven't landed a real read-only reentrancy myself. The dForce case is real, I just haven't caught one in the wild yet

@hannaB@social.vir.group Yeah, that's the scary part. The code was fine, the audit passed, and the compiler quietly broke the lock anyway. 2016 taught us to write safe code. 2023 taught us that's not enough if you don't trust the toolchain that compiles it. Pin your compiler versions and treat their bug reports like security patches, because that's what they are :)

@hannaB@social.vir.group More the second, honestly. The attestation layer isn't doomed by design, plenty of light-client bridges are solid. The problem is it concentrates all the trust in one spot, so any shortcut there has zero margin for error. None of these hacks were exotic: an unchecked signer, an uninitialized root, five keys in one org's hands. Known weak points. It's just that on a bridge, "known weak point" and "9-figure loss" are the same sentence.

@hannaB@social.vir.group After, through the post-mortems and reproducing it on a fork. Didn't catch it live. Honestly the fork replay taught me more than the real-time chaos would have.