博客
技术洞察
深入探讨智能合约漏洞、区块链安全最佳实践以及 CertiK 工程师的技术研究。
教育Introducing Aleo: A Premier Platform for Private Blockchain ApplicationsAleo Systems has created a Layer 1 blockchain named Aleo with a focus on privacy achieved through the use of zero-knowledge proofs (ZKPs) and other cryptographic methods. Unlike most popular blockchains where data used and created by transactions can be viewed by an external observer, Aleo provides the ability to hide such information. 
技术分析Breaking Down Proof Construction in Plonky3: The Fibonacci Example UnveiledThis article examines the inner workings of Polygon’s Plonky3, a state-of-the-art prover utilized in zero-knowledge Virtual Machines (zkVMs). 
技术分析EVM – Cosmos Convergence Research From Security Base: Part 3This in-depth analysis will illuminate how the judicious separation of concerns between these layers can engender enhanced scalability, flexibility, and interoperability within the blockchain domain, ultimately shaping the future trajectory of decentralized applications and networks.
技术分析Threshold Cryptography V: Auxiliary Zero-knowledge ProofsIn this post, we analyze the specific ZKP constructions implemented in Binance’s tss-lib [1]. These proofs address previously identified weaknesses in the Multiplicative-to-Additive (MtA) protocol, Paillier encryption parameters, and auxiliary RSA modulus generation. Our discussion is grounded in the improvements formalized by the specifications in CGGMP21 [4], which strengthen the robustness of threshold ECDSA against known attacks.
教育为 Solidity 开发人员而动 IV：跨合同呼叫In this article, we delve into the concept of cross-contract calls and examine the distinctions between Solidity and Move contracts in this area. We will assess the mechanisms and security of executing cross-contract calls in Move, aiding developers in better comprehending how to manage contract interactions within the Move environment.
技术分析Lottie File Incidents: Case Studies of Third-Party Supply Chain RisksThis post details two security incidents involving the Lottie animation format and its ecosystem, highlighting the persistent and evolving nature of third-party dependency and supply chain risks in the modern web landscape.
技术分析Threshold Cryptography IV: Multiplicative-to-Additive (MtA) Protocol and Paillier Encryption SchemeIn this post, we provide a detailed examination of the MtA protocol, which utilizes the additively homomorphic properties of the Paillier encryption scheme to facilitate the exchange of encrypted secret shares among the participating parties.
技术分析Threshold Cryptography III: Binance tss-lib’s 9-Round Threshold ECDSAThis third post in the Threshold Cryptography series provides a bird’s-eye view of the 9-round threshold ECDSA protocol implemented in tss-lib [1]. Detailed exposition of the underlying MtA secret share conversion protocol and zero-knowledge proofs will follow in the next two posts.
技术分析Security Risks of StablecoinsStablecoins are a type of crypto-asset designed to maintain a stable price by linking each token to an external reference asset, most often a national currency like the U.S. dollar, but sometimes commodities like gold. In theory, every coin in circulation should be redeemable for an equal amount of that reference asset, protecting holders from the sharp price fluctuations typical of unpegged digital currencies.
技术分析Private Key, Public RiskIn Web3, private keys are critical for controlling assets, governance, and trust, but their mismanagement poses significant risks, including financial loss and reputational damage. This article explores secure private key generation, storage, and usage to mitigate these vulnerabilities.
技术分析Move for Solidity Developers: Token Standard II — Advanced Fungible Token ExtensionsBuilding on our previous analysis of basic token functionalities across Solidity, Sui Move, and Aptos Move, this report focuses on the advanced features of fungible tokens. We specifically explore how these platforms implement fungible token standards, with extensions such as whitelisting/blacklisting, fee mechanisms, pausing, and whitelisting/blacklisting.
技术分析Threshold Cryptography II: Unidentifiability in Decentralized FROST Implementation The second post in our Threshold Cryptography series explores the FROST threshold signing protocol, as proposed in FROST: Flexible Round-Optimized Schnorr Threshold Signatures [1], and highlights a potential issue that arises when implementing the protocol in a decentralized setting. This issue allows a malicious participant to send inconsistent nonce commitments, leading to honest participants to be falsely accused of misbehavior.