ERC-1155: one operator approval can cover many token IDs
An approval for a collection contract is broader than permission for the item pictured on a page.
MASTR
Apoiar o trabalho
MASTR CRYPTO WIKI
Todas as entradas · 5 / 13
Os artigos de investigação e as referências são publicados em inglês. A navegação está disponível em sete idiomas.
Os artigos de investigação e as referências são publicados em inglês. A navegação está disponível em sete idiomas.
ERC-1271: a contract decides whether a signature is valid
Smart-wallet signatures depend on validation logic and state, not only public-key recovery.
ERC-165: interface support is a claim, not a security certificate
A contract recognising a function set does not prove that its implementation behaves honestly.
ERC-1967: finding the implementation behind a proxy address
The address users recognise can remain unchanged while the code they execute changes.
ERC-20 allowances
An allowance lets a spender transfer tokens for an owner.
ERC-2612: a permit deadline is not an allowance expiry
The time limit governs submission of the signature, not necessarily the life of the resulting approval.
ERC-4337: programmable accounts without assuming one private key is enough
Bundlers, account validation and optional paymasters split a transaction flow into distinct responsibilities.
ERC-4626: a vault share is not an immediately withdrawable balance
Read conversion rates, fees and withdrawal limits as separate quantities.
Ethereum: applications share a settlement system
ETH, smart contracts and tokens have distinct roles and distinct risks.
EthereumMax paid promotion
Kim Kardashian settled SEC charges over an undisclosed $250,000 payment to promote EthereumMax.
Euler donation-to-reserves exploit
Euler was exploited in 2023 through interactions involving lending positions and its donation mechanism.
Events and transaction logs
Contracts emit indexed logs consumed by wallets and explorers.
Evidence snapshots: make a finding reproducible
A claim needs enough context to survive a changed interface.
EVM account state
Ethereum tracks balances, nonces, code and contract storage.
Exchange API-key theft
A fake portfolio or bot collects exchange API credentials.
Exchange mark-price discretion
A venue liquidates from an index or mark instead of the last trade.
Fake airdrop claims
An unsolicited token or post directs holders to a claim site.
Fake airdrops and claim pages
An unexpected asset can be an advertisement for a malicious website.
Fake bridge interfaces
A clone accepts approvals or deposits without a valid destination route.
Fake browser extensions
A malicious extension appears beside a legitimate wallet in store or search results.
Fake crypto recruitment tests
A supposed employer asks an applicant to install software, clone a repository or run a coding task.
Fake exchange deposit pages
A clone shows plausible balances after funds reach attacker wallets.
Fake exchange-listing announcements
A promoter claims a large venue will list a token at a fixed time.
Fake firmware updates
A message claims an urgent wallet update is required.
Fake law-firm recovery
A website copies lawyers, regulators or investigators and claims seized assets await release.
Fake listings and borrowed exchange credibility
A screenshot of an announcement is easy to copy and difficult to date.
Fake MEV-bot contracts
A supposed MEV system advertises passive sandwich or arbitrage income.
Fake NFT mints
A promoted mint asks for broad permissions or transfers unrelated to the purchase.
Fake partnership announcements
A token uses a recognised company's logo or a minor vendor interaction as a partnership.
Fake proof-of-reserves claims
A provider publishes selected wallet balances without complete customer liabilities.