PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bug Hunting with Crytic

blog.trailofbits.com | blog | #cloud | #web3 | #smart-contracts | #static-analysis | #vulnerability-detection | #blockchain | #trail-of-bits | #solidity | #crytic | #github-app | #bug-detection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Crytic, Trail of Bits' GitHub app for smart contracts, runs 90+ bug detectors on every commit; the team shares 12 real issues it found in major projects, from free token minting to reentrancy.
Published
Collected

Related coverage

blog · netspi.com
Ethereum Virtual Machine Internals – Part 2
Part two on EVM internals covers persistent contract Storage: how Solidity types map to 32-byte storage slots, SSTORE and SLOAD semantics, and the gas costs that make storage writes expensive.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
State divergence enables unauthorized access
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.trailofbits.com
Building secure Uniswap v4 hooks
Uniswap v4 hooks can satisfy PoolManager settlement invariants while still violating application-level accounting or authorization assumptions. The seven recurring failure patterns form a practical review checklist for hook developers and auditors.
blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
blog · blog.trailofbits.com
Using Static Analysis and Clang To Find Heartbleed
Trail of Bits built a Clang analyzer plugin that statically detects Heartbleed-style bugs: it taints ntohl/ntohs return values and flags unconstrained data used as memcpy sizes, tested on OpenSSL.
Back