博客
技术洞察
深入探讨智能合约漏洞、区块链安全最佳实践以及 CertiK 工程师的技术研究。
教育What is Formal Verification in Smart Contract Auditing?Formal verification is a method of mathematically proving that a computer program functions as intended. It involves expressing the program's properties and expected behavior as mathematical formulas, and then using automated tools to check that these formulas hold true. This process helps ensure that the program meets its desired specifications.
教育Hacktivism Report: Part OneHacktivism is the act of misusing a computer system or network for a socially or politically motivated reason. This report examines the history and techniques of hacktivism in Web3, the laws and regulations developed in response to Web3 hacks, and looks at several case studies that are most famous for their hacktivism.
技术分析Web3 Mobile Wallet Apps: A Secret Key Protection Perspective The security of private keys and mnemonic phrases is of paramount importance in the world of cryptocurrency, as they grant access to one's digital assets and their loss or theft can lead to financial ruin. With the rise of mobile wallet apps in the Web3 space, it's crucial to understand the various security mechanisms that are in place to protect these keys.
漏洞研究Cross-Function Reentrancy Attacks in Kadena Smart ContractsIn this post, we briefly explain the difference between reentrancy and cross-function reentrancy, and how Turing incompleteness can prevent some such attacks. We then provide an example of a cross-function reentrancy exploit not prevented by Turing incompleteness using Pact, the programming language utilized on the Kadena blockchain.
技术分析How to Protect Crypto Projects from Insider ThreatsNot all threats come from external sources. Some of the most devastating can come from inside a project team, from a trusted member of the group. A vital element in reducing the risk of insider threats in crypto projects is to thoroughly vet new team members. 
技术分析Security Considerations When Designing Blockchain Governance SystemsGovernance is one of the primary features of decentralized blockchain networks. Users come to consensus, or at least majority agreement, on the management of decentralized protocols. The unique features of blockchain governance systems offer many benefits, and a number of risks.
技术分析Aptos Capture The Flag - MOVEment 2022CTF MOVEment is a contest hosted on Aptos that offers participants the chance to learn about Move – a programming language used to build secure smart contracts, and the differences between Move-compatible blockchains.
漏洞研究How to Secure NFTs: Part Two - NFT Smart Contract SecurityIn Part Two of this series on NFT security, we examine some of the most common smart contract bugs that expose NFT projects to security vulnerabilities.
技术分析AI-Powered Code Auditing – Using ChatGPT to Capture the FlagCan AI tools be leveraged to audit smart contract code? We applied ChatGPT to a recent Capture the Flag competition to see how well it would fare.
漏洞研究How to Secure NFTs: Part OneNon-fungible tokens (NFTs) are one of the newest and most popular applications of Web3 technology. Their specific security considerations are similar to other cryptocurrencies and tokens, but there are a couple of important differences worth exploring.
教育An Introduction to the Cairo Programming LanguageEthereum layer 2 scaling solutions are rapidly evolving, and zero-knowledge rollups are one of the most exciting developments in the space. This article examines StarkNet - a general purpose ZK-rollup - and the programming language it uses: Cairo.
技术分析Move Capture the Flag Competition RecapMove is a programming language specifically designed for building secure smart contracts that can be formally verified. Recently, Sui hosted a Capture the Flag competition on its developer testnet. In this article, we run through each of the challenges and their solutions.
The Contest includes four challenges. In the followings, we will introduce them one by one:
Challenge 1 - CheckIn
Challenge 2 - SimpleGame
Challenge 3 - FlashLoan
Challenge 4 - MoveLock