GM! Buidlers

In this latest issue of HashingBits, we're diving deep into Ethereum's Core Developers meetings, covering all the major updates in the Ethereum ecosystem. But that's not all—we'll explore the latest happenings in the Polygon, Starknet & Avalanche ecosystems, along with advancements in the AI & Web3 space. For developers, we're highlighting new tools designed to assist smart contract developers and auditors. And, of course, we'll delve into the headlines about the $235M WazirX Multisig wallet hack and LiFi Protocol’s $9.7M loss in smart contract vulnerability.

EtherScope: Core Developments 👨‍💻

  • All Core Devs - Execution (ACDE) call #192 Recap

  • Brief History and Current Situation of RIP-7212: review async & decide on inclusion (soon)

  • Verkle implementers call #21: proposal to reduce witness size, updates to EIP6800 & EIP2935 and cost of code chunking

  • Better geographic diversity is optimal, particularly outside of North America & Europe

  • Blocknative: data viz of self-built blocks, unintentionally increase base fee volatility

  • EIP7732 ePBS breakout #5: short call, proposer IP leaks requesting headers from builder and consensus spec tests fixes in progress

  • Nethermind EVMYulLean: EVM + Yul specification, executable, in Lean

Layer1 & Layer2

  • DefiLlama: narrative tracker features longer lookbacks

  • Based preconfs is now live on testnet Helder

  • Shutterized Gnosis Chain is live

  • Chromia MVP Mainnet is live

  • Announcing the Nexus 2.0 zkVM

  • Simple DVT Update: SSV Goes To Mainnet

  • TPRO Chain, a new Virtual Chain launches on Aurora

  • Viction DA testnet is live

  • Apechain Testnet Curtic launches

  • Announce the release of Ceramic-One

  • Covalent native token migration successful

  • Blockscan Multichain Explorer (Beta) is here

  • Tangem launches new cold wallet ring

  • Introducing Gwyneth — a based rollup synchronously composable with Ethereum

  • Introducing Polynomial Chain

  • Introducing Henez - OmniDeFi Liquidity layer

  • NEAR House of Stake Governance Proposal

  • Shape testnet is live

  • LYNC is building a Movement L2

  • LI.FI compensation scheme

  • Season 2 ETH.FI claims are live

  • Curve PegKeeper Assets Regulatory Brief

  • A Note On Securely Finding Minimum Mean Cycle

  • Return of the Delegation Voucher

  • The Fat Bera Thesis

  • Chainalysis Operation Spincaster

  • Scroll delayed finalization to investigate potential ecosystem incident, confirmed Rho Markets was application specific

  • L2BEAT Badges: visual display of L2 features

  • Announcing the Avail Foundation

ERCs

  • ERC7743: Multi-owner non-fungible tokens (MO-NFT)

  • ERC7744: Code index (index contract bytecode)

  • ERC7746: Composable security middleware hooks

EIPs

  • EIP7745: Two dimensional log filter data structure

  • EIP.tools adds RIPs (rollup improvement proposals)

EcoExpansions: Beyond Ethereum 🚀

Polygon

  • Aggregation Summit is here

  • Deep dive into Polygon Plonky3

  • What do Polygon PoS transactions look like if we strip them to app-action transactions?

  • Weekly Gaming Roundup on polygon

  • Polygon sets September 4th date for migration to POL

Starknet

  • Take a look at Starknet’s Roadmap

  • All reasons why you should build on Starknet

  • Starknet Wallet<>Dapp API is getting a major update with Starknet-js V6!

  • Layerswap x Starkent $STRK Rewards Program is here

Arbitrum

  • Avalanche’s ACP-77 Reawakening? Everything you need to know about ACP-77

  • Avalanche Interchain Token Transfer Explained

  • Get started with Avalanche ICTT Starter Kit

DevToolkit: Essentials & Innovations 🛠️

  • rindexer - opensource, fast EVM ndexing tool in Rust

  • spice - python client for extracting data from the Dune Analytics API

  • Lodestar v1.20.2: patch for publishing blinded blocks using Lodestar beacon node & Lighthouse/Nimbus validator client with MEV-Boost

  • Reth v1.0.3: fix for Base mainnet & async Backfill stream

  • Rindexer, EVM indexing tool in Rust, beta

  • Echidna v2.2.4: improves fuzzing speed & user experience, adds support for transient opcodes

  • Audit Wizard adds Cyfrin Aderyn (Solidity static analyzer)

  • Damn Vulnerable DeFi v4: migrated to Foundry, new challenges: curvy puppet, shards, withdrawal & rewarder

Hackathons, Workshops & Events

  • Arthur Hayes’ Maelstrom announces Bitcoin grant program of up to $250K per developer

  • Scroll bounty winners ETHGlobal Hackathon

  • ETHGlobal Hackathon Uniswap Bounty winners

  • Hyperlane bounty winners ETHGlobal Brussels

  • Superhack on the Superchain hackathon

Explore the Depths of Knowledge: Research Papers, Blogs and Tweets🔖

Twitter

  • Nexus 2.0 zkVM is here

  • Nic's Stablecoin Syllabus

  • The Risks and Rewards of (re)staking

  • How many Web3 users are real

  • Don't Build an Onchain Game

  • ELI5 - L3s

  • IoTeX has released its 2.0 whitepaper

  • Horizontal Scaling with ZKThreads

  • The Sink L2 whitepaper thread

  • Are Rollups Overvalued or Undervalued? An Analysis of Rollup’s Revenue and Cost Structure

  • A major update to FRI-Binius yields better batching, faster recursion, and smaller proofs

  • The Economics of L3s

  • ERC-7739: Readable Typed Signatures for Smart Accounts

  • Ethereum’s Scalability Crisis: The Execution Layer

  • A Deep Dive into DeAI Protocol

  • Deep Dive into Move Smart Contracts

  • Simple Explanation of EigenDa

Articles

  • Solidity via-IR compilation pipeline explainer: translates Solidity into Yul (intermediate representation) for optimization rather than direct to bytecode, plan to make default with EOF

  • Solidity hidden overflow: math expression types cast to highest type used by variables

  • Solady (Solidity snippets): adds ERC1967 minimal proxies with immutable args, auto verified on Etherscan

  • Z0r0z sstore3, read/write contract storage using balance & address, license: AGPL v3

  • Reth Execution Extension (ExEx) examples

  • OpenAI Scale Ranks Progress Toward ‘Human-Level’ Problem Solving

Research Papers

  • Anders Elowsson: sealed execution auction, Vickrey slot auction of execution proposal rights, attesters supervise commit/reveal scheme facilitated by builders & beacon proposer

  • Multi-round MEV-Boost: mitigate negatives of based preconfs & retain benefits of based rollups

  • Private Heterogeneous Federated Learning Without a Trusted Server Revisited: Error-Optimal and Communication-Efficient Algorithms for Convex Losses

  • FBChain: A Blockchain-based Federated Learning Model with Efficiency and Secure Communication

  • Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models



    Watch 🎥

Web3 Security Watch 🛡️

Articles

  • Same Mistake Twice? Decoding LiFi Protocol’s $9.7M Exploit: Post Mortem Report

  • Another Lazarus Group Attack? Decoding Wazirx Multisig Wallet’s $235M Exploit: Post Mortem Report

  • Minterest $1.4M exploit on Mantle L2 via reentrancy

  • Security Alliance (SEAL): incident response to Squarespace domain compromise

  • The $230 million crypto theft at Wazirx a wake-up call for Indian regulators, government

  • WazirX Files Police Complaint After $230M Hack, Engages With India's Cyber Crimes Unit

Research Papers

  • Identifying Smart Contract Security Issues in Code Snippets from Stack Overflow

  • Detect Llama -- Finding Vulnerabilities in Smart Contracts using Large Language Models

  • Improving the Accuracy of Transaction-Based Ponzi Detection on Ethereum

  • The Feasibility of a Smart Contract "Kill Switch"

Twitter

  • A Comprehensive analysis on how the Wazirx exploit happened

  • WazirX: PSA on hack

  • Chain analysis of $230M+ WazirX hack, likely Lazarus linked - ZachXBT

  • Blood bath in WazirX exchange due to the fact there is no Buy Side liquidity currently

  • Mudit Gupta’s analysis on Wazirx Exploit

  • Zachxbt analysis & fund tracing after Wazirx Exploit

Hacks and Scams 🚨

WazirX

Loss ~ $235M

  • WazirX’s multisig wallet, managed with Liminal, was exploited, losing $235M out of $451M on-chain assets.

  • The multisig wallet had 6 signatories: 5 from WazirX and 1 from Liminal.

  • Attackers compromised 3 WazirX and 1 Liminal signatory using phishing.

  • They directly compromised 2 WazirX signatories and used a fake Liminal UI to trick the others into signing malicious transactions.

  • Attackers upgraded the multisig wallet to a malicious contract, continuously transferring funds.

  • ZachXBT traced transactions to Tornado Cash, found test transactions, and linked Bitcoin deposits to the hack.

  • WazirX blamed Liminal’s system, suspecting payload replacement during transaction verification.

  • Liminal stated the breach involved a wallet created outside their platform.

Read the Post mortem report to know more details about the whole exploit.

Li.Fi Protocol

Loss - $9.7M

  • The LiFi team deployed the GasZipFacet contract five days prior to the attack to enable gas refueling for bridging transactions.

  • The attacker exploited an arbitrary call vulnerability via depositToGasZipERC20() in the GasZipFacet contract, allowing unauthorized transactions.

  • Users with infinite approvals for specific LiFi contract addresses were targeted, enabling the attacker to perform unauthorized transferFrom operations.

  • The attacker crafted arbitrary transaction calls to execute unauthorized transfers instead of legitimate asset swaps. This drained significant amounts of USDT, USDC, and DAI from the users who had given infinite approval to LiFi Diamond contract.

  • Stolen funds were converted into approximately 2,857 ETH using platforms like Uniswap and Hop Protocol, then dispersed across multiple wallets.

  • Tornado Cash was used to obscure the origins of the stolen funds, making it challenging to trace their final destination.

  • Exploited Tokens: The primary tokens the attacker got away with include:

    • 6,335,889 USDT

    • 3,191,914 USDC

    • 169,533 DAI

Read the Post Mortem report to know more about the exploit.

Community Spotlight

https://x.com/quillaudits_ai/status/1812741356387016828

https://x.com/quillaudits_ai/status/1813845595788120405

https://x.com/quillaudits_ai/status/1813944615613219277

https://x.com/icphub_VN/status/1813873185127031109

https://x.com/quillaudits_ai/status/1814607085612483046

#MATIC #AI #USDT #AVAX #ETH #USDC