UPDATED to include twitter thread from @dguido providing context on the "Finding The Greedy, Prodigal, and Suicidal Contracts at Scale" paper and we also added a mention of Shopify's 2017 Bug bounty results.
Friday, February 23
TOP STORY
Smart contracts—stateful executable objects hosted on blockchains like Ethereum—carry billions of dollars worth of coins and cannot be updated once deployed. New paper by UK and Singapore based researchers presents a systematic characterization of a class of trace vulnerabilities, including 34,200 buggy smart contracts on Ethereum but Dan Guido has serious questions on the evaluation of their results - see his tweet thread and read Motherboard's writeup.
HACKTIVITY
Path Traversal on Resolve-Path [4 upvotes] - no bounty for this report to Node.js third-party modules by @orange.
$25,000 bounty for a report submitted to Snapchat by @apfeifer27!
Toyota, Adobe, U.S. Department of Defense, Yahoo!, Uber, WordPress and more all resolved reports in the past 24-hours and Google Play awarded a $5,000 bonus.
You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity
TWEET OF THE DAY
well, the dev who created this just made my day - @_ayoubfathi_
OTHER ARTICLES WE’RE READING
Akamai: nearly half of all online login attempts are performed by cybercriminals
Harsh words for the IOTA project: IOTA:The Brave Little Toaster That Couldn't
Bug bounty tips and learnings from @prateek_0490
Shopify shares 2017 bug bounty results and 2018 improvements planned
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
Get this email forwarded to you? Click here to subscribe to the Zero Daily
After analyzing nearly one million smart contracts, the researchers found 34,200 that were critically vulnerable... On a subset of roughly 3,000 contracts, the team was able to verify and reproduce the flagged vulnerabilities with an 89 percent success rate.
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty program solutions encompass vulnerability assessment, crowdsourced testing and responsible disclosure management. Discover more about our security testing solutions or Contact Us today.