TutorialWeb3 Security
Proxy, UUPS & Storage Collision Bugs for Auditors
Transparent vs UUPS, uninitialized implementations, and storage-layout collisions — local forge inspect lab. No live upgrades.
35 min lab
Loading…
Published work tagged Foundry.
Transparent vs UUPS, uninitialized implementations, and storage-layout collisions — local forge inspect lab. No live upgrades.
First-depositor donation can round the next mint to zero shares. Local toy vault plus OpenZeppelin virtual-offset discussion.
Missing chainId, permit phishing, and ecrecover to the zero address — replay a toy signature across two local chain ids.
Spot, TWAP, and Chainlink staleness for bug hunters — price-assumption checklist on a local toy lender. No live oracle attacks.
Flash loans as amplifiers — not magic bugs — with Aave-style callback mental models and DVD / local CTF lab pointers. Authorized labs only.
Practical wallet, public RPC, and Etherscan/Sourcify setup for smart contract hunters — burner accounts, read-only chain access, and a lab that explains one his…
The Andrax learning path for web3 bug hunting in 2026: ethics fence, platform map, ordered guides, toolchain, CTF→First Flight→bounty ladder, and how to study p…
A beginner-friendly, ethics-first guide to how to start web3 bug hunting in 2026 — authorized bounties, local forks/CTFs, and an Immunefi scope checklist.