Wiki
Biturai Trading Wiki
The Biturai crypto encyclopedia: AI-assisted, data-informed, and continuously quality-audited.
Timestamp Dependence: Block Timestamps as an Attack Vector
Timestamp dependence is a vulnerability in smart contracts where critical logic relies on the block.timestamp value. This value, set by miners, can be slightly manipulated, creating an attack vector for unfair advantages.
Unchecked External Calls: Ignored Return Values in Solidity
An unchecked external call in Solidity occurs when a smart contract interacts with another contract or address but fails to verify if that interaction was successful. This oversight can lead to the calling contract operating on incorrect
Force-Feeding Ether as a Smart Contract Attack
Force-feeding Ether is a smart contract vulnerability where an attacker can send Ether to a contract even if it lacks explicit functions to receive it. This can disrupt the contract's internal accounting and logic, leading to unexpected
Gas Griefing and Denial-of-Service via Gas Limits
Gas griefing is a type of attack where an attacker manipulates gas consumption in a smart contract to cause transactions to fail or become excessively expensive for other users. This can lead to a denial-of-service condition, preventing
The ERC-4626 Donation Attack Explained
The ERC-4626 Donation Attack is a vulnerability in tokenized vaults where an attacker manipulates the asset-to-share exchange rate. This manipulation causes subsequent small deposits to receive zero shares, effectively losing the deposited
First-Depositor Attack on DeFi Vaults and Pools
A First-Depositor Attack exploits a vulnerability in DeFi protocols where an attacker manipulates the share price of an empty liquidity pool or vault. This allows them to claim a disproportionately large share of future deposits made by
Rounding Error Exploits in DeFi Protocols
Rounding errors in DeFi protocols are subtle vulnerabilities arising from integer arithmetic limitations in smart contracts. These minute precision losses can be strategically amplified through repeated operations to drain significant
Nonce Reuse as a Cryptographic Vulnerability
A nonce is a unique, arbitrary number used once in cryptographic communications to prevent replay attacks and ensure data integrity. When a nonce is improperly reused, it creates a severe cryptographic vulnerability that can compromise the
Signature Malleability: Manipulating ECDSA Signatures
Signature malleability allows a valid digital signature to be altered into another equally valid one without needing the private key. This can change a transaction's unique identifier, causing tracking issues or enabling certain
Signature Replay Attacks in Smart Contracts
A signature replay attack occurs when a valid digital signature is intercepted and reused to authorize an unintended action, often exploiting vulnerabilities in smart contract verification logic. This can lead to unauthorized fund
Price Oracle Manipulation Through Spot Prices
Price oracle manipulation via spot prices involves attackers distorting asset prices on decentralized exchanges to trick smart contracts. This sophisticated attack, often using flash loans, exploits vulnerable DeFi protocols for financial
Front-Running as a Smart Contract Vulnerability
Front-running is a predatory market strategy where an entity exploits advanced knowledge of pending transactions to execute their own trades first, profiting from subsequent price movements. This vulnerability arises in blockchain
Storage Collision in Proxy Contracts
A storage collision is a critical vulnerability in upgradeable smart contracts where the proxy and implementation contracts inadvertently use the same storage slots for different state variables. This misalignment can lead to data
Understanding the Uninitialized Proxy Vulnerability
The uninitialized proxy vulnerability allows attackers to seize control of smart contract proxies during deployment. This occurs when a proxy contract is deployed but not immediately and atomically initialized, creating a critical window
Access Control Vulnerabilities in Smart Contracts
Access control vulnerabilities occur when a smart contract fails to properly restrict who can execute its sensitive functions. These flaws are a leading cause of financial loss in the blockchain ecosystem.
Unprotected Selfdestruct: The Contract Destruction Vulnerability
An unprotected selfdestruct vulnerability allows unauthorized termination of a smart contract, leading to loss of funds or disruption of essential functionalities. This critical flaw can be exploited by malicious actors to manipulate
Delegatecall Vulnerabilities in Smart Contracts
Delegatecall is a low-level function in Solidity that allows a contract to execute code from another contract while preserving its own storage context. If not implemented with extreme care, this mechanism can introduce severe security
tx.origin Phishing: The Authentication Trap in Solidity
tx.origin phishing exploits a critical vulnerability in Solidity smart contracts where authentication relies on the original transaction initiator rather than the immediate caller. This allows malicious intermediary contracts to trick
SafeMath and Protection Against Integer Overflows
Smart contracts rely on precise arithmetic, but standard operations can lead to unexpected results if numbers exceed their storage limits. SafeMath is a crucial library designed to prevent these integer overflows and underflows,
Checks-Effects-Interactions Pattern for Reentrancy Prevention
The Checks-Effects-Interactions pattern is a fundamental security practice in smart contract development. It structures code to prevent reentrancy attacks by ensuring state updates occur before external calls.