banteg's personal blog
In June 2023, the engineer who runs contract verification at Etherscan filed a bug against Vyper 1 : the same source, the same compiler version, the same settings produced different bytecode depending on where you ran it. He had a freshly deployed Curve contract that refused to verify. He tried pinning PYTHONHASHSEED . It did nothing. The thread ends with Curve noting that verification “will…
Update, 12 August 2026. This post originally documented a suspected full-signing oracle built from malformed Paillier material, Type 5 and Type 7 aborts, and weaknesses in THORChain’s TSS transport wrapper. THORSec’s later technical disclosure confirmed our malformed-key and residue-leak findings but revealed a simpler, complete exploit. Bob’s ordinary MtA proof leaked the mask that our test…
Most reverse engineering tooling is still designed for either a human in a GUI or headless batch script. Agents are an emerging third type. They are very good with tools, but the tools need to be shaped in a way understandable to them. They like shell commands, structured or at least predictable output they could pipe to jq or rg , short feedback loops, or perhaps even an escape hatch to run…
some games die quietly. they get delisted, lose their multiplayer servers, fade into the digital void. others get remastered by the original authors with slightly better graphics and a battle pass. and then there’s the third way: you open the binary in ghidra and start naming functions. the history crimsonland (2003, remastered 2014, resurrected 2026) is a top-down shooter from the era when indie…
takopi 🐙 he just wants to help-pi i was running claude code from my couch when i realized something was wrong. the terminal was on my desk, but my ideas were here. same story with codex, opencode, pi. all these agents that want to write code for me, trapped behind an ssh session. if you’ve ever: started an agent run, walked away, and came back to a wall of scrollback wanted one place to keep…
When I first played this game 1 , I felt it must be the best LLM eval, so I spent the next few days shoehorning Claude into it as a player. Here is why: 1 gog.com Narrative heavy : The game features a Narrator and everything is described vividly, so we can get away with feeding the LLM just the text. Manipulative characters : Every character, including the Narrator and the Princess, is very…
In this post I will explain the design process behind a new Yearn Vaults UI I’ve built from scratch. Constraints Start with imposing some constraints on yourself and you’ll arrive at a better destination, in a more creative route, possibly learning a bunch of stuff along the way. My distaste for dapps that are dependent on external services is well-known, so the first rule is: Rule 1: No external…
Permit2 1 is a contract that allows using Permit signatures 2 with any token. You just approve a Permit2 contract once and then you can use it with any contract that integrates it. 1 uniswap/permit2 2 ERC-2612: Permit Extension for EIP-20 Signed Approvals It solves a crucial UX problem, but it has seen quite slow adoption. Possibly because its documentation leaves the developers scratching their…
This work is heavily inspired by the amazing visualizations of bitcoin inputs/outputs at utxo.live . I’ve replicated it by plotting 2.1 billion native ether transfers. This post will apply the same method to ERC20 token transfers, so you can follow along with your favortite token and without needing a large transfers dataset. We will be using jupyter , cryo , polars , matplotlib , datashader ,…
PART I: Proxy Types While working on adding support for more proxy types to Ape, I got sucked into some of the most incredible onchain archeology. Follow along and you will be able to repeat this journey even on your laptop. What is a Proxy A proxy is a tiny contract, often in hand-written assembly, that makes it cheap to deploy instances of a logic contract while making it slightly more expensive…
Today I will walk you through the development of a pipeline that helps Vyper devs identify potentially vulnerable contracts, following a real compiler bug disclosure 1 . We will find all contracts that use certain opcodes and precompiles. 1 incorrect order of evaluation for some builtins The pipeline would consist of the following steps: Find all Vyper contracts Strip them down to their code…
Summary There are currently 566 contracts implementing EIP-4626 Tokenized Vaults standard on Ethereum mainnet. Of them, 69 contracts, including some notable ones like Savings DAI and Staked Yearn Ether , don’t emit a Transfer event on mint/deposit/burn/redeem . This could affect tokens being picked up by explorers and wallets, as well as require changes to data analytics pipelines to correctly…
An introduction to evm-trace , a fast and correct Python library to work with Ethereum Virtual Machine traces. There are two common trace formats, which we’ll refer to as Geth-style and Parity-style traces. Geth traces provide opcode-level resolution, while the most commonly used Parity trace format provides a call tree. Our goal today would be to make opcode-resolution traces 100x faster, making…
cover The last time I wrote about Ethereum logs was in 2018. This time we go deeper and try to recover a ghost event that devs have forgotten to add to the Yearn Vaults contract. log Fees(management_fee, performance_fee, strategist_fee) There are several methods to recover values from an internal view method or even add custom views to batch read private storage. One of the more interesting ones…
Today we’ll look into MakerDAO voting process and recover the complete state of the governance contract. There are two types of voting: governance and executive. Governance voting can be seen a simple yes/no poll. Executive voting is much more interesting and it will be the subject of this article. How voting works Executive voting is handled like approval voting : Anyone can create a proposal;…
Syncing Ethereum blockchain head-on by fetching every block and replaying every transaction is impractical. That’s why different full nodes utilize clever techniques to speed up the initial sync and get up to speed in a reasonable time. According to Ethernodes, Etherum mainnet is dominated by Geth (55.7%), Parity Ethereum (31.5%), so we’ll discuss these two. All tests are done in October 2018 on a…
verb distribute ether or tokens to multiple addresses https://disperse.app/ Open Protocols The real beauty of Web 3.0 ecosystem we are building are open protocols. Anyone can tap into dharma loan protocol or 0x protocol exchange contract and get into shared liquidity pool for free. You can mix and match these too, creating completely unique products and markets. A protocol for fungible tokens…
Hey kids, today we are going low level trying to understand how Ethereum events and logs work. Put web3 away for a while as it abstracts things and we’d like to get as bare as it gets. Smart contracts generate logs by firing events . Here’s a transaction receipt that contains one log entry. The log entry consists of one topic and a data field. The first topic refers to the specific event, but we…