Zellic Profile picture
Jan 10 11 tweets 4 min read Read on X
Zellic proudly announces the EVM trackooor, a modular tool for monitoring arbitrary actions on chain.

With the amount of data that blockchains contain, it’s difficult to query and process anything that isn’t indexed event fields.

This is why we built EVM trackooor 🧵👇
What is the EVM trackooor? The EVM trackooor is a framework for tracking any kind of data on a blockchain, including event logs, transactions, and blocks mined.

The EVM trackooor allows you to register what data you want from a blockchain and define what happens when you receive the data, such as processing it and recording it in a database or sending an alert through a webhook.Image
The EVM trackooor features the following:

- Real-time data monitoring, including event logs, transactions, and blocks mined
- The ability to request historical data, such as past events or transactions that occurred within a block range
- A modular approach to request and process data for any purpose
- Event and function-ABI fetching to automatically decode event logs and transaction calldata
Why did we make the EVM trackooor? Creating a new project every time you want to query and filter data is troublesome.

The EVM trackooor simplifies this process. By being a generic framework for querying and filtering data — all you need to do is tell it what data you’re looking for, and it provides the data directly to you
Let’s look at an example.

Let’s say there’s an address `0xcafe…` holding native ETH and some ERC-20 tokens, and you want to be alerted when it moves those funds.

With the EVM trackooor, all you need to do is provide the address you want to monitor and a callback function that the EVM trackooor will call with your requested data to process.

Then in the callback function, you can implement checking the value and sending alerts.Image
How has the EVM trackooor been used? We’ve already used the EVM trackooor to…

Monitor for potential exploits funded by Tornado Cash, Image
Graph funding paths to visualize movements of funds, including native ETH and ERC-20 tokens, Image
And listen for ownership transfers and proxy upgrades for high-value contracts. Image
The EVM trackooor is a command-line tool, and you can access it on GitHub. There, you can review its documentation with more info on usage, including how to use preexisting modules or create your own module: github.com/Zellic/EVM-tra…
For a more in-depth look at the EVM trackooor, including example code for a sample use case, check out the full announcement on our blog: zellic.io/blog/evm-track…
Also, go over to the January edition of the Zellic Security Roundup where we cover the latest news in Web3 security: newsletter.zellic.io/p/zellic-secur…

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Zellic

Zellic Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @zellic_io

May 5, 2023
🚨 Hack alert: $DEI was exploited on Arbitrum just a few hours ago.

It was a simple, yet hidden bug that caused a loss of $5,000,000. How many other contracts have this same problem?

Read below: 👇🧵 Image
Dissecting the original exploit transaction (arbiscan.io/tx/0xb1141785b…), there's 3 main steps: Image
- approve; approving the victim account a large amount (why?)
- burnFrom; burning 0 from the victim (huh?)
- transferFrom; the exploiter is mysteriously able to transfer a large amount from the victim?
Read 10 tweets
Mar 29, 2023
Earlier this morning, @safemoon's Liquidity Pool was compromised and USD 8.9M worth of tokens were withdrawn.

After looking at the transaction trace and the recent contract changes, we can tell you what happened:
In bscscan.com/tx/0xcb8573807… the SafeMoon token was updated to include 4 new functions. Image
It was then updated again in bscscan.com/tx/0x3307500eb… to allow burning tokens from anyone instead of the sender. Image
Read 9 tweets
Aug 3, 2022
Thread: How thousands of Slope wallets were hacked and how other wallets can avoid this 👇
1/ First, the following theories are considered very unlikely and entirely rejected:

- issues in Solana core
- issues in SPL token
- crypto issues (e.g. weak RNGs)
- widespread user devices compromise
- supply chain (compromised libraries)
2/ In the war room, we first hypothesized that wallets may be leaking mnemonics or private keys to Sentry.

After further investigation with the community, this is what we found:
Read 11 tweets
Aug 3, 2022
1/ We forked Geth to compile a list of all 23,897,838 Ethereum contract addresses—a snapshot of every contract EVER deployed on Ethereum.

We found some pretty interesting addresses out there...and you might have already interacted with some of them!

Here's what we found 👇
Addresses are 20 bytes in size. Back of the napkin calculation:

24 million * 20 bytes = 480000000 bytes = .48GB

At least half a gigabyte in the Ethereum blockchain is just occupied by contract addresses.

(This calculation isn't 100% precise, but it's a useful estimate)
Some uniquely cool-looking addresses we found:

OpenSea Seaport (0x0000..)
0x00000000006c3852cbef3e08e8df289169ede581

Gnosis Safe Proxy: (0xdeadbeef...) 0xdeadbeefadf9f06945b3dfaf4f73fdecc70e1c89

Compound Governor Bravo: (0xaaaaa...)
0xaaaaaaaaaaaa8fdb04f544f4eee52939cddce378
Read 14 tweets
Aug 2, 2022
1/ Nomad was just hacked for $190M, making it the 5th largest DeFi hack of all time. How did this happen? We break down not just the exploit, but also HOW THE VULNERABILITY WAS INTRODUCED IN THE FIRST PLACE.

Understanding bugs isn't enough. We need to stop merging them.👇
2/ The hack a mess. Most hacks occur instantly. For Nomad, the bridge was slowly drained over the course of an hour.

This was the first exploit transaction.

It was simple: it interacted directly with the bridge, calling a single function, process().

etherscan.io/tx/0xb1fe26cc8…
3/ Looking at process(), this function is responsible for executing cross-chain messages. This function's security is absolutely critical. It is the linchpin of the entire bridge. Every message ends up here.

It must ensure that only valid messages are executed, and only once.
Read 21 tweets
Aug 1, 2022
$10,000,000 is the highest bug bounty reward ever given.🏆

Earlier this year, Wormhole awarded it for a critical finding.

Let's dive into a $10M vulnerability: 👇🧵
1/ First, let's understand what proxies are.

Blockchains are immutable, meaning deployed smart contract code cannot be changed.

Even if:
- Vulnerabilities are found
- Other bugs exist
- You want to ship new features

Proxies solve this issue.
2/ Proxies act as a gateway between users and smart contract logic.

The following two diagrams visualize the basics.

1. Users interact with the proxy contract.
2. The proxy interacts with the logic contract

The proxy contract can point to a new logic contract if needed.
Read 15 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(