EVM | DeFi | ZK | DM for audits | prev @cyfrin
Joined April 2019
- Tweets2.9K
- Following290
- Followers26.7K
- Likes17.2K
🐸Smart🐸Contract🐸Programmer🐸 retweeted
There’s also a YT playlist with the lessons from the Defense module/course from Zealynx Academy
youtube.com/playlist?list=PL…
🐸Smart🐸Contract🐸Programmer🐸 retweeted
Unfortunately, I went through a very similar case, @ProgrammerSmart
After that, I thought of gathering the most relevant and common hacks of this type, and I created this free course on @ZealynxAcademy
academy.zealynx.io/defense
I'd be honored if you'd like to act on this and collaborate to raise awareness in the community.
🐸Smart🐸Contract🐸Programmer🐸 retweeted
Nice way of education, seems alot of people don't understand the .vscode executable yet.
See my latest startup interview .vscode/setting.json.
Warning, don't every open the code locally with vscode
bitbucket.org/royalcity_work…
Lines 4 and 5
🐸Smart🐸Contract🐸Programmer🐸 retweeted
Literally happened two days ago with potential "Client".
The guy was unhinged. He first asked me to screen share the code, and I immediately went to the .vscode/.
I was literally screen-sharing the exploit and he was still telling me "please download it"
🐸Smart🐸Contract🐸Programmer🐸 retweeted
had a similar thing happen. they made me install vscode since i use a different editor. I even inspected the code they wanted me to use but they injected a shell script above the json for the vscode preferences that did NOT render on github. I nuked my HD
I thought so too. I was home. I git cloned their repo which had solidity challenges. Opened in vim, but was told to open in vscode.
Ok, I opened in vscode
Didn't run any scripts. So I am guessing that vscode auto executed something
Coding challenges on my pc was automatically deleted (by vscode?)
So I don't know what else was executed through vscode
What else is gone? I don't know yet
Things I learned
- Ask interviewer to turn their camera on
- Check email sent from the claimed org
- Ask interviewer to send an email from the org's domain
- Use burner laptop
- Don't use VSCode
- Don't use linkedin
I got hacked doing a code interview
Got a dm on linkedin from a verified account associated with pancakeswap
Interviewer insisted to use vscode for the coding
Next repeatedly asked me to create a new wallet to see their prototype
I said no. Interview end. Coding file gone
If Groth16 is missing something fundamental, Zcash and Tornado Cash are in big trouble😇💀
I believe Groth16 checks all 3 boxes (soundness, completeness and ZK). But the proof is too difficult for me to understand