PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking Aave Upgradeability

blog.trailofbits.com | vulnerability | #smart-contracts | #defi | #vulnerability-disclosure | #blockchain | #aave | #delegatecall | #upgradeability
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits found a critical bug in Aave's live contracts: public initializers on the LendingPool proxy enabled arbitrary delegatecall. Aave mitigated it within an hour of disclosure.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Building secure Uniswap v4 hooks
Uniswap v4 hooks can satisfy PoolManager settlement invariants while still violating application-level accounting or authorization assumptions. The seven recurring failure patterns form a practical review checklist for hook developers and auditors.
blog · blog.trailofbits.com
Upgradeable contracts made safer with Crytic
Crytic adds a suite of 17 upgradeability checks that run on every commit and pull request, catching delegatecall proxy flaws such as storage collisions, function shadowing, and initialization bugs.
blog · hackenproof.com
1inch Bug Bounty Report: Aqua Edition, H1 2026
This report highlights common smart contract and DeFi logic vulnerabilities discovered through crowdsourced security testing.
blog · hackenproof.com
HackenProof, in Partnership with Hack The Box—the Four Million Platform—Has Launched a CTF Security Challenge for the Blockchain Industry
HackenProof and Hack The Box turn blockchain security into a gamified CTF track with weekly challenges and a ten-quest series, giving top performers a path into the bug bounty ecosystem.
blog · hackenproof.com
HackenProof, in Partnership with Hack The Box—the Four Million Platform—Has Launched a Course for the Blockchain Industry
HackenProof has launched a blockchain-industry course with Hack The Box, the four-million-member ethical hacking platform, aimed at building practical blockchain security skills.
blog · hackenproof.com
Maiar DEX went offline. Bug in Elrond smart contract a reason
Analysis of the Maiar DEX exploit: a callback flaw in Elrond's new VM function let an attacker drain over 1.6M EGLD, forcing an emergency shutdown and a 95% price crash in half an hour.
Back