Arjuna

@calc1f4r @cantinaxyz WizaaaaaaaarD

Another Day Another @cantinaxyz Result Grinding Day by day 🔥

Happy Girlfriend’s Day! If you have one : go text her. If you don’t : stop crying in DMs and start auditing. Date security, not insecurity: 🔍 arjunasec.xyz/blogs/Soroban-… #Web3 #SmartContracts

🔥To all struggling to understand vulnerabilities in the @steller smart contract ecosystem: We wrote an article explaining issues, beyond logical vulnerabilities, that can lead to your contract being exploited. arjunasec.xyz/blogs/Soroban%… #Web3 #Web3Security

Using invoke_signed() but your PDA lamport transfer still fails? "From must not carry data." ✨Here's the subtle detail most devs (and auditors) overlook about Solana's PDA design 👇 arjunasec.xyz/blogs/Transfer… #Solana #SmartContracts #PDA #Web3Dev

Most smart contract platforms still allow contracts to share state and call each other directly leading to Reentrancy. Soroban changes this with WASM-based isolation and host-managed state. Read more about it here arjunasec.xyz/blogs/How-Soro… #SmartContracts #Soroban #Web3Security

Soroban doesn’t just patch Reentrancy : It removes conditions that make it possible With host-managed state, isolated contract calls, and a WASM-based model, the attack is almost impossible by design. ✨Read how Soroban does it in our latest blog arjunasec.xyz/blogs/How-Soro… #Web3 #Web3Security #soroban #rust

@steller New link : arjunasec.xyz/blogs/Soroban%…

🔥To all struggling to understand vulnerabilities in the @steller smart contract ecosystem: We wrote an article explaining issues, beyond logical vulnerabilities, that can lead to your contract being exploited. arjunasec.xyz/blogs/Soroban%…

@SyedGhufranHas1 @steller arjunasec.xyz/blogs/Soroban%…

@arjuna_sec @steller Mate blog post not found can you please upload again

@AbduoVo @steller arjunasec.xyz/blogs/Soroban%… here you go.

@arjuna_sec @steller the link seems to be broken

We want to share that @ctrusonchain, our co-founder, is no longer part of @arjuna_sec. We’re deeply thankful for all the passion and dedication brought to the team. Wishing @ctrusonchain the very best in this next chapter.

@RedsReporter @Bobstroudsnr @GBNEWS Absolutely, @Bobstroudsnr! That film's a mind-bender—great storytelling or subtle foreshadowing? Predictive programming always adds a fun layer of intrigue. What's your favorite "hidden" example? 🎥🕵️‍♂️

@Bobstroudsnr @GBNEWS Great film Predictive programming?

Lisa Nandy urges MPs to back Assisted Dying Bill to allow end of life 'dignity': 'We have to strike balance' gbnews.com/politics/assis…

After a lot of months of downships we are soo live to hunt again!!! 🔥

For the whole code snippet try : gist.github.com/calc1f4r/a0bfa…

🧵Remediation 🌿 Before closing the token account, make the token_account.amount ==0 and if not transfer it to some associated address then close the account.

🦀 Day 30 of #30daysOfSolanaSec 👌 Let's explore a DoS vulnerability that can occur when closing a token account. 🧵1/n Here's a concise example code snippet that allows depositing a mint into PDA token account, withdrawing, and closing the token account once fully withdrawn. Hint : there is a dos up here which can be done that will allow the withdraw instruction to fail. #30days0fSolanasec #web3security #solanasecurity #web3security #sec3 #web3

🌿Remediation When working with mint created using token 2022 instruction, try to use all the instruction associated with token 2022 program only and its vice versa.

🧵4/n What is the issue in the snippet? The super_minter program aims to create and manage a digital coin, SUPER_TOKEN, using the Token-2022 standard for its enhanced features. `Initialize function` : This correctly sets up SUPER_TOKEN using the Token-2022 program to create the mint account (the coin's blueprint). It also generates a Program Derived Address (PDA), the sole entity authorized to mint new SUPER_TOKEN coins. Mint_super_token function: This allows someone to receive new SUPER_TOKEN coins, using the PDA to authorize minting. The Problem : Using the Wrong Tool The error occurs in the mint_super_token function. It correctly identifies the PDA for minting authorization but mistakenly uses the old SPL Token program (spl_token_program) instead of the Token-2022 program (token_2022_program) that SUPER_TOKEN was created with. This will lead to dos vector in the minting.

🦀Day 29 Of #30daysofSolanasec Understanding the differences between token program and token 2022 program and how a interchange between them can create several issues in @solana A thread 🧵 Let's learn from a code snippet shared below. #web3 #web3security #solanasecurity