Highlights #2

Gm Commiters,

As we close out another dynamic month, we’re excited to share the latest edition of our recap newsletter! We’re eager to continue delivering monthly updates on our work, insights, and key achievements in Web3 security.

We published several articles that focus on key areas of blockchain security and best practices:

When writing Solana programs, it's essential to validate account ownership, manage data integrity, handle rent exemptions, and ensure proper error handling. By following best practices in access control, concurrency, program upgrades, and security testing, developers can significantly mitigate vulnerabilities and ensure a secure blockchain application.

Reference: solana-security

Token vesting is essential in Web3 to prevent large token dumps and align stakeholder incentives, but improper implementations can lead to significant security risks. This article explores common vesting patterns and provides secure coding practices to safeguard smart contracts.

Reference: token-vesting-contracts

BLS signatures enable efficient signature aggregation, reducing storage and verification costs while maintaining cryptographic security. They are particularly valuable in multi-signature wallets, validator committees, and projects like Ethereum 2.0 for optimizing blockchain performance.

Reference: understanding-bls-signatures

Solana's growing ecosystem demands secure and efficient development practices. This guide highlights key best practices for building robust programs, focusing on security, performance, and scalability.

Reference: solana_best_practices

We released several Twitter threads diving into various security topics:

Gas optimization is essential for developing cost-effective and scalable dApps, as it helps reduce gas consumption and improve contract efficiency. Understanding these techniques is crucial for developers to enhance the performance of their applications.

Reference: gas_optimization_techniques

Zero-Knowledge Proofs (ZKPs) enable the validation of knowledge without disclosing the actual information, enhancing privacy in blockchain applications. They are revolutionizing secure data handling for private transactions and identity verification.

Reference: ZKPs

Fully Homomorphic Encryption (FHE) enables computations on encrypted data without decryption, preserving the privacy of sensitive information during processing. This technology allows smart contracts and DApps to operate without exposing raw data.

Reference: FHE

We closely monitored multiple major hacks in the Web3 ecosystem, providing insights to help improve security:

Recent security incidents include a $27M reentrancy attack on Penpie's farming protocol and a reentrancy exploit draining 21 ETH from Pythia Stablecoin. Additionally, compromised DAI addresses on L2 were exposed, Chainlink's Discord suffered a phishing attack, and hackers laundered $42.7M in ETH via Tornado Cash.

Exploits include $26K lost by OTSea, $130K by Seamless Protocol, $22M by indodax, and $1.4M by cut2024cut, with a security tip to stay vigilant across all platforms.

Security breaches include approximately $6M lost by DeltaPrime, $2M by Banana Gun, $4.9M by Shezmu, and a significant $52M by BingX, with additional losses reported by Rivus DAO.

Exploits affected several platforms, with losses including $235K from Bankroll Network, $5.23M from Truflation, $3.8M from Onyx, and $2M from Bedrock.

Security incidents include $24K lost by Fire Token ($FIRE), $5.7M from EigenLayer, and $130K from an unknown lending project hack.

In September 2024, the crypto space suffered $161M in losses from exploits, flash loan attacks, and exit scams, with only $2M recovered. Exploits accounted for $155.7M, led by BingX ($48.5M) and Penpie ($27.3M). Flash loan attacks drained $4.7M, while exit scams took $0.7M, highlighting the need for stronger security practices across the industry.

We participated in Token2049 Singapore, one of the premier blockchain events. We had an incredible experience. It was exciting to explore various innovative projects and see security becoming a key focus for many, a shift that's not always common in the Web3 space. We also had the opportunity to share our expertise and insights on the evolving blockchain security landscape among projects. Check out the event highlights here!
Check out the event highlights here.

We are excited to announce several key partnerships:

We will be assisted in auditing our contracts, which will further enhance the safety and security of token deployment and trading on their platform.

Reference: 0xCommit partners with ETHMemeFun

As the official security partner for Manta ecosystem, 0xCommit will offer a range of security services designed to enhance the safety and success of projects building on Manta.

Reference: 0xCommit becomes a security partner for Manta Ecosystem

This collaboration will bolster Hela's mission by enhancing the security of their ecosystem through our state-of-the-art smart contract auditing service. Together, we're committed to providing comprehensive protection for their users, ensuring the highest standards of security in the blockchain space.

Reference: 0xCommit partners with HeLa Space

This collaboration brings together our expertise in blockchain security and Bitduc8's educational focus to provide holistic Web3 solutions. By this strategic partnership, we aim to empower individuals and organizations to navigate the rapidly evolving decentralized landscape with the highest level of security and knowledge. Together, we're building a more secure and informed future for Web3.

Reference: 0xCommit Partners with Bitduc8

We held insightful AMAs with key partners:

We held a Twitter AMA session to discuss our collaboration with MantaNetwork, focusing on the importance of blockchain security solutions. Participants engaged in insightful discussions about our initiatives and the benefits of this partnership for the Manta ecosystem.

Reference: AMA_with_ManataNetwork

In this session we discussed HeLa's mission and the challenges they aim to solve as a next-generation layer 1 blockchain protocol. We introduced 0xCommit, sharing our origin and role in enhancing blockchain security. We highlighted the critical importance of security for Hela and how 0xCommit provides comprehensive solutions through smart contract auditing and advanced security measures. We also explored emerging attack vectors in layer 1 protocols, how auditors are addressing these evolving threats, and proactive steps to secure platforms. The session underscored our joint commitment to safeguarding the blockchain ecosystem.

Reference: AMA_with_HeLa_Space

Best regards,

The 0xCommit Team

Empowering Web3 Security

Website: 0xCommit.com

X: 0xCommitAudits

Telegram: 0xCommitAudits