Contract Level

Thank you @chainlink for awarding YieldCoin the grand prize in the Chromion hackathon! We all know the entire world is going to run on Chainlink, so this is a great honor, and (was) a personal life goal. Thank you @CyfrinUpdraft for the resources to learn invariant testing, formal verification, and the security first approach! Thank you @concero_io for inspiring the idea, Parent-Child architecture, and custom CCIP tx types! Thank you everyone for the support! YieldCoin development continues alongside researching a proposal for the vLEI hackathon, Contract Level Identity (name pending review): A Decentralized Fuzzy Extractor, to address the critical need for absolute sybil-resistance by consensus - an inherent requirement for onchain identity and compliance. Read the YieldCoin dev notes taken during the hackathon here: @contractlevel/dev-notes-yieldcoin-chromion-hackathon-26685753741c" target="_blank" rel="nofollow noopener">medium.com/@contractlevel…

Learning about vm.readCallers to get current msg.sender in @chainlink payment abstraction v2 BaseTest. This modifier pauses a given contract by caching the msg.sender and pranking the pauser before switching back to the msg.sender.

You really do get a rush when you think you've found a bug

@pashov @mikotabrbrbr thank you pashov

@mikotabrbrbr Open Source tooling can get us very far. Trying to contribute to this. We need to erase the common vulnerabilities from smart contracts. And everybody should have access to cheap AI for good initial local reviews.

🧠AI security tools are booming. Still, many are slow, painful to set up or expensive to run. solidity-auditor v2 drops tomorrow. 1 command install. 8 parallel specialist agents. <10min on 5000 nSLOC. Runs locally on a cheap API plan. Free (even though it probably shouldn't be)

WorkflowRouter in @chainlink payment abstraction v2 allowlists function selectors this adds an extra security check layer to the contract being called by the router so that if a function hasn't been allowed for a contract that has been allowed, the call will still revert

The Chainlink Audit Competition STARTS NOW! Let’s welcome back Chainlink for an audit of Payment Abstraction V2. V2 upgrades the current infrastructure with a permissionless Dutch auction mechanism to unlock enhanced efficiency and reduced execution costs. 9 days to help secure @chainlink, with the biggest prizes going to the most severe and unique vulnerabilities found. For additional details on this audit, check out the audit docs below. ⤵️

Parallel workflow writes are cool, but the risk of out-of-sync failure recovery is not

Every event, every workflow, every transition, every flow, gets mapped out in its entirety before a single line of code is written. Multiple tiers of failure mode handling for every step is inherent to the architecture, not an afterthought.

@yash_ether gm yash

@contractlevel Gm gm ser

gm to everyone mapping out events and workflows for state cleaning

Failure modes before success modes

@yash_ether Privacy in smart contracts is a huge use case and it will be interesting to see the application of ZKP evolve alongside CC

@contractlevel workflows literally open up so many possibilities. btw what do you think of chainlink CC and confidential http in CRE?

A network of workflows as a secure sequential settlement system. Looks like we're going to have more workflows than we have contracts.

gm to everyone architecting a network of cre workflows

gm to everyone building on cre

@DevDacian Having your AI agent understand certora's output is very cool

Vitalik doesn't know that 2 years after this post, I've made automated formal verification of medium complexity solidity smart contracts a working reality

Successful verification with cargo kani

@ChrisBarrett gm 🫡

Gm link marines

Looking for a Chainlink-native smart contract developer with a security-first approach? Get in touch! contractlevel.com

merkle tree fuzzing

10/Thin-liquidity oracle manipulation is a known pattern. It has happened before and it will happen again. The full post-mortem with attack walkthrough, BugPocer findings, and recommendations is on the Olympix blog 🔗 olympix.security/blog/the-yield…