Highlights #3

As another action-packed month comes to a close, we’re back with the latest edition of our 0xCommit Monthly Recap! From securing protocols to uncovering critical vulnerabilities, we’ve been at the forefront of Web3 security. Here’s a look at our key wins, insights, and the road ahead! 🚀🔐

We published several articles that focus on key areas of blockchain security and best practices:

This EIP introduces the Instruction Specific Address (ISA) mechanism, a novel approach to user interaction with decentralized applications (DApps). ISA allows for approval-less transactions by generating dynamic, single-use addresses for each interaction. This eliminates the need for upfront wallet connections or approvals, significantly enhancing user security and simplifying DApp usage.

Reference: ERC-7838

Smart contracts on the Ethereum blockchain require careful attention to security details. Two critical global variables—`tx.origin` and `msg.sender`—often come up in discussions about authentication and access control. This article explores their differences, explains common pitfalls, and highlights best practices for building secure smart contracts.

Reference: `tx.origin` vs `msg.sender`

In the ever-evolving landscape of decentralized finance (DeFi), security remains a paramount concern. One vulnerability that continues to plague smart contracts is the reentrancy attack. Despite advancements in security practices, recent incidents in 2024 and early 2025 underscore the persistent threat posed by reentrancy exploits.

Reference: Reentrancy

We released several Twitter threads diving into various security topics:

Ethereum evolves through innovative EIPs, and EIP-7702 is no exception. It bridges the gap to Account Abstraction (AA) by letting EOAs temporarily function like smart contracts—unlocking flexibility, security, and better UX.

Reference: EIP-7702

Solidity storage types can be tricky for beginners! But mastering them is key to writing efficient, cost-effective smart contracts. Each choice impacts gas, performance, and storage layout.

Reference: Storage vs Memory vs Calldata

Understanding Solana Program Derived Addresses (PDAs). PDAs are a unique type of account on Solana that enhance security and enable cross-program communication.

Reference: PDAs

Ethereum continues to evolve, bringing major upgrades that will enhance scalability, security, and efficiency. This thread shows what changes will be happening on ethereum.

Reference: Upcoming Ethereum Upgrades

We closely monitored multiple major hacks in the Web3 ecosystem, providing insights to help improve security:

A $320K flash loan attack on MoonwellDeFi occurred due to improper validation in the ‘executeOperation’ function, while FEGtoken suffered a $1M exploit caused by an access control flaw in handling Wormhole cross-chain messages. Mosca lost $19.5K on BSC, and both SuperchainEco and SolvProtocol had their official X accounts compromised to spread phishing links.

A $1.47M loss at Moby_Trade resulted from a private key compromise, allowing attackers to upgrade smart contracts using stolen proxy keys. 0xOrangeFinance suffered an $830K exploit due to a misconfiguration in their multisig wallet. UniLend Finance was exploited for $196K on Ethereum after a critical miscalculation of user collateral balances, enabling an attacker to borrow and drain the entire stETH pool without repayment.

TheIdolsNFT lost $341K due to a business logic flaw in their referral system that allowed repeated reward claims. Phemex suffered a massive $70M breach after its hot wallets were compromised across 16 blockchains. Odos Protocol faced a $50K loss from an arbitrary call exploit, where an attacker bypassed signature checks using a precompile (0x4).

AdsPower suffered a $4.7M loss in a supply chain attack where a malicious browser extension update enabled theft from five users. DogWifTools faced a $10M exploit after hackers compromised its Windows software, leading to wallet drains in a Solana-based supply chain attack.

Ionic Money lost $8.8M after an attacker used counterfeit LBTC as collateral to secure loans. zkLend suffered a $9.55M exploit on Starknet due to an empty market manipulation using flash loans. Four Meme was drained of $0.4M in a frontrunning attack on PancakeSwap v3, exploiting a lack of price verification. Cardex lost $0.183M due to a private key leakage in its frontend code, compromising all session signer wallets. Bybit faced a massive $1.4B breach after attackers, likely Lazarus Group, used a phishing attack on Safe Multisig signers, tricking them into approving a malicious proxy upgrade, with stolen funds laundered across multiple protocols.

We are excited to announce several key partnerships & successful audits:

SOEX is an innovative crypto trading aggregation tool that integrates social attributes with professional trading functions, creating a full-stack convenient trading experience for users.

We completed security audit for Soex Solana Programs, focusing on their innovative Staking HVT mechanism & tokenomics.

Reference: Soex

We successfully completed a comprehensive security audit for NavixEcosystem’s Token, NFT and Marketplace smart contracts.

The Navix Ecosystem is a blockchain gaming hub that redefines the player experience. We are focused on delivering a suite of captivating, high-quality games that seamlessly blend the best of traditional gaming and the power of Web3 technology.

Reference: Navix

We at 0xCommit are excited to collaborate with Trireme to enhance Web3 security and project success. With Trireme’s KPI-driven strategies and our expertise in smart contract security, we ensure projects achieve longevity, scalability, and resilience. Together, we’re shaping a safer and more sustainable blockchain ecosystem.

We at 0xCommit are excited to align with $ZKAGI, a utility token powering Human-2-Machine, Machine-2-Machine, and Machine-2-Human payments for AI computations & training on a verifiable, decentralized network. With our expertise in smart contract security & auditing, we ensure the integrity and resilience of decentralized AI ecosystems

Website: 0xCommit.com

X: 0xCommitAudits

Telegram: 0xCommitAudits