Curriculum·Graduate·G305
Reading Contracts Fluently
Meerkat Finance, March 2021. Meerkat Finance was a yield vault that launched on BNB Chain and, a day later, drained about 31 million dollars of user deposits.
Start with lesson 14 lessons · about 2.3 hours · free account to read in full
Lesson 1 opens on
Meerkat Finance, March 2021
Meerkat Finance was a yield vault on BNB Chain, and about a day after it launched, roughly 31 million dollars of user deposits were drained. The mechanism was not a subtle exploit: the vault's own contracts were upgradeable through a proxy, and the party controlling that proxy could replace the vault's logic and move user funds wherever they wished. So the power to take everything was written into the contract from the very start, present at deployment and visible on-chain to anyone who read how the proxy and its admin were configured.
The lessons
- G305-01Read who controls it: owner, upgrade, and mintExplain that a contract's control powers, owner, upgrade, mint, withdraw, are stated on-chain for any readerabout 34 min · opens on Meerkat Finance, March 2021
- G305-02Read the transfer and burn functions for hidden behaviorExplain that a token's transfer, burn, fee, and blacklist functions can do far more than move balancesabout 34 min · opens on SafeMoon, March 2023
- G305-03Read the accounting and the reward mathExplain that a contract's accounting, how it tracks who is owed what, is a readable source of riskabout 34 min · opens on Popsicle Finance, August 2021
- G305-04Read the inputs it trusts, and the ones it does not checkExplain that a function acting on an unchecked input is trusting whatever the caller suppliesabout 34 min · opens on Qubit Finance, January 2022