After the recent events, I want to share my personal notes about web3 security

✨ My Hitchhiker's Guide to Security 🔒

A 🧵 (20) 0/ Framework: will start with 5 important properties of security, some (3) goals you should set, then tools you can implement and when

It is not exhaustive, but i'll try to be more comprehensive as I can

NB: I'll tag some projs just as an example, it's not an endorsement

1/ I'm sorry to announce that Rentable is shutting down.

We did not find product market fit, and our runway ended. After many careful considerations and conversation, we preferred to go in this direction instead to do further funding or pivots.

medium.com/@emiliano.bona…

TLDR 🧵 2/ Next Steps:

• Starting from today, rentals will be disabled and only withdrawals will be possible
• Users will have until 13th October 2022 11.59p UTC to withdraw
• At 14th October 2022 12a UTC, protocol will be suspended and official frontend won’t be accessible anymore

We made it!

At @ETHLisbon me and @0xGiovanni kicked off Rentable (@rentableworld), the Renting Protocol for NFTs 🪐✨

Rent NFTs with no collateral at fraction of their market price 😉

Bringing efficiency on scarcity

A thread 🧵 1/

Metaverses and blockchain-based games often requires new users to own highly valued NFTs 💵

It limits the audience of these platforms since the high entry level price 🚧

NFTs usually remaining idle in the owner wallet hence underutilized in the platform 📉

Today we are at the horizon of the events where Metaverse and DeFi touch

Say hello to WrapX

Supercharge your NFTs and add new actions to them while keeping their integrity and value

Read the (love) story of #meebit 7497 and its desire of getting a @CryptoKitties 🤖💕🐱

🧵👇 1/9 There was a Meebit that wanted a CryptoKitty but could not buy it because the Meebit could neither hold any fund nor interact with any protocol.

1/Y A thread on how you can leverage @iearnfinance not only as a yield source provider but also as a very powerful (and simple) framework to develop creative strategies.

A pegging mechanism which uses yield to peg @proofofhumanity $UBI to a target supply via a meta-vault

More👇

https://twitter.com/santisiri/status/1388545452849643525

2/Y Few weeks ago @ryantcwynar @rudygt and @santisiri pinged me on brainstorm about how to use yield to burn @proofofhumanity $ubi so they can keep the supply stable

https://twitter.com/ryantcwynar/status/1383093206347288580?s=20

Exploring @iearnfinance vault v2 strategies for one of my beloved projects @synthetix_io ⚔️😍⚒️

What about a simple 50% sBTC 50% iBTC strategy? 0% exposure on BTC and APY 101% as rewards in SNX

gov.yearn.finance/t/yvsnx-v2-vau… 1. Stake SNX
2. Mint sUSD
3. Exchange for sBTC iBTC
4. Claim
5. Repeat

Taking a look...

ethtx.info/mainnet/0x8bb8…

This is the second attack whish uses multiple flash liquidity,
flash swaps via Uniswap and flash loans via dYdX

We will see very complex things via @AaveAave V2 batch flash loans :)

https://twitter.com/n2ckchong/status/1339715478042759168

Quite interesting the attacker asked 3 loans via flash swaps to 3 different pools on Uniswap

WETH-WBTC 90k
WETH-USDC 82k
WETH-USDT 96k

It's definitely a batch flash loan via flash swaps!

And this is just the beginning...

Argh! No 😥

https://twitter.com/mattybchats/status/1330226503028797446

Evil jars deployed during the attack and passed in the swapExactJarForJar, investigating more on this

etherscan.io/address/0x75aa…

etherscan.io/address/0x02c8…

The are sensible ops executed in that method (e.g. approve, withdraw etc).

Giga arbitrage/exploit

etherscan.io/address/0xa773…

https://twitter.com/The3D_/status/1327638923183591425

https://twitter.com/emilianobonassi/status/1327648053013123077?s=20

I'm proud to release Gas Saver Gnosis Safe Module

github.com/emilianobonass…

a user smart-contract module for @gnosisSafe wallets which let you interact with

*ANY* protocol

and save tons of gas leveraging @1inchExchange $CHI and $GST2

Below how to use it and examples 👇 1/ Follow the instruction in the Readme and deploy your version (proxy) of the module. Then add it!

As you see in these txs, you can save up to 50% when interacting with @compoundfinance and @AaveAave

ANY protocol is supported immediately! Use in your @AragonProject DAO!