Start with lesson 14 lessons · about 2.3 hours · free account to read in full
Lesson 1 opens on
Team Finance, October 2022
Team Finance offered token-locking and vesting services, holding projects' locked Uniswap v2 liquidity in its Liquidity Locks contract. A migrate() function let a project move a locked v2 position to Uniswap v3, and it was meant to act only for the owner of the lock being moved. PeckShield found that check could be bypassed by locking any token: the attacker locked a token of their own to obtain a valid lock, and the function did not confirm that the liquidity being migrated was the liquidity that lock held.
The lessons
- G303-01How state is really laid outExplain that a contract is its stored state as well as its code, laid out in numbered storage slotsabout 34 min · opens on Team Finance, October 2022
- G303-02Upgradeability is power that must be guardedExplain that an upgrade mechanism is the power to replace a contract's entire logicabout 34 min · opens on PAID Network, March 2021
- G303-03Trusting caller-supplied data and external codeExplain that data supplied by a caller is attacker-controlled and must be validated, not trustedabout 33 min · opens on Superfluid, February 2022
- G303-04Return values, and tokens that misbehaveExplain that not all tokens revert on failure, so a call's return value must be checkedabout 34 min · opens on Force DAO, April 2021