Curriculum·Freshman·F105
Transactions: What You Are Actually Signing
October 2024.39M in PEPE, MSTR and APU, reported by Decrypt citing the security firm ScamSniffer.
Start with lesson 16 lessons · about 2.4 hours · 1 lab · open to read
Lesson 1 opens on
The 10,668 ETH gas fees
6M apiece. The first was mined by SparkPool and the second by Ethermine. The cause is disputed to this day: Vitalik Buterin first called it definitely a mistake, then suggested blackmail by attackers holding partial access to an exchange key, who could burn its funds in fees without being able to withdraw them.
The lessons
- F105-01Anatomy of a transactionName every field in a transaction and state what a wrong value in each one doesabout 26 min · opens on The 10,668 ETH gas fees
- F105-02The signature taxonomyClassify any signature request into one of eight types and state what authority each one grantsabout 24 min · opens on BadgerDAO front-end injection
- F105-03Blind signing and clear signingDefine blind signing and explain why a hex-rendered payload forces trust in the website interface rather than the walletabout 20 min · opens on Bybit
- F105-04Verification disciplineExplain why comparing the first and last characters of an address is not verification, and demonstrate the failureabout 28 min · opens on The 1,155 WBTC address poisoning
- F105-05Approval hygieneEnumerate every outstanding token approval on an address and identify which grant unlimited authorityabout 26 min · opens on Orange Finance
- F105-06Incident responseExecute the correct sequence in the first ten minutes after signing something hostile, in priority orderabout 21 min · opens on Recovery fraud against existing victims
Labs
F105-L
20 signature requests in a sandbox, classified safe / suspicious / hostile with a statement of what each would do. Pass is 18/20 with zero false negatives on the hostile ones.