Skip to content

Latest commit

 

History

History
81 lines (60 loc) · 5.69 KB

README.md

File metadata and controls

81 lines (60 loc) · 5.69 KB
Raw

Learn EVM Attacks

A collection of Foundry tests reproducing exploits, bug bounty reports, and theoretical vulnerabilities on EVM chains. Diagrams and context links accompany each attack reproduction to make it more helpful as a reference or study material for anyone trying to learn more about vulnerabilities in smart contract systems.

Want to take a quick look? Just go to a vulnerability folder (say, MBCToken). Read the README or jump ahead to running the reproduction in your computer! You only need Foundry installed.

$ git clone https://github.com/coinspect/learn-evm-attacks
$ forge install
$ forge test --match-contract Exploit_MBCToken -vvv

Index

We now have 31 reproduced exploits. Of those 31, we have chosen a few in case you want to start studying up with some of the most interesting ones.

  • Furucombo is an excellent way to show the dangers of DELEGATECALL.
  • MBC Token is a primer on how sandwich attacks can be made with an interesting backstory on suspicious tokenomics.
  • Uranium is a great excuse to study up on the actual code that guards the famouse AMM constant product x*y=k.

To run an specific exploit, you can just use:

forge test --match-contract Exploit_MBCToken -vvv

Vary the amount of verbosity (-v, -vv...) according to the data you want. -vvvv includes traces!

The full list is below:

Access Control

Bad Data Validation

Business Logic

Reentrancy

Bridges

Contributing

To contribute, create a new file inside the most appropriate category. Use the template.txt file in the test folder including the information related to the attack.

Utils that perform flashloans and swaps are provided in test/utils to ease the job of reproducing future attacks. Also, modules that provide enhanced features to Foundry are included in the test/modules folder.

The tests should pass if the attacker succeeded, for examples: your requires should show that the attacker has more balance after the attack than before.

Past work and further study

  • DefiHackLabs has a similar repository with more exploits and more focus on the test reproductions alone, with no context or further explanations. It is nevertheless great if you only care about the attack reproductions! Go check it out.