DEV Community: rim dinov

The Next Frontier: Using AI Agents to Build Custom Slither Detectors

rim dinov — Wed, 21 Oct 2026 06:47:32 +0000

How I'm combining smart contract security with LLM-powered tooling — and why the intersection of Web3 and AI safety is where the real vulnerabilities hide.

Introduction: Why AI + Web3 Security Is Inevitable

I'm a Web3 security researcher. Over the past few weeks, I've been building custom Slither detectors for CEX interface smart contracts — tools that automatically find hardcoded API keys, missing signature verification, and plaintext credentials on-chain.

It's rewarding work. But it's also slow.

Writing one production-ready detector takes 2–3 days of focused effort: studying the vulnerability pattern, implementing the logic, testing against known contracts, eliminating false positives, and wiring it into CI/CD. For every new threat vector — oracle manipulation, reentrancy in CEX wrappers, access control bypasses — you start from scratch.

Meanwhile, the attack surface is expanding in a direction most auditors aren't watching: AI agents are starting to interact with smart contracts. They read state, call functions, generate files, and execute tools. And every one of those interactions is a potential vulnerability.

The intersection of smart contract security and AI agent safety is where the real vulnerabilities hide. This article is about how I'm starting to use AI to accelerate my security workflow — and why I think every serious Web3 security engineer will need to do the same within the next two years.

The Problem: Manual Detector Development Is a Bottleneck

Let me show you what I mean with a concrete example.

Imagine you're writing a detector that looks for hardcoded API keys. It works. It's in production. It has zero false positives — because I spent hours tuning the logic to distinguish legitimate constant declarations from actual secrets.

Now multiply this by every vulnerability pattern you want to catch:

Missing signature verification on CEX calls

Plaintext credentials stored on-chain

Oracle price manipulation in withdrawal flows

Reentrancy in cross-chain bridge wrappers

Access control bypasses in admin functions

Each detector is a small engineering project. And the threat landscape evolves faster than any single researcher can keep up. We need a faster way to iterate on security hypotheses.

The Solution: How AI Can Accelerate Security Research

I see two concrete ways AI can help — and I've been experimenting with both.

Generating Detector Templates

Instead of starting from a blank file, I now use LLMs to generate a working scaffold. The result is typically 70% of a working detector. It gets the structure right — the class inheritance, the method signatures, the result generation calls.

But here's what it usually gets wrong:

False positive logic: The AI doesn't know which patterns are legitimate in real codebases.

Context awareness: It can't tell if a "suspicious" oracle call is actually behind a timelock or multisig.

Edge cases: Reentrancy guards, access control modifiers, upgradeable proxy patterns — these require human judgment.

But 70% is a massive head start. What used to take 2–3 days now takes 4–6 hours of refinement.

Filtering False Positives from Slither Output

This is where AI shines even more. Slither's JSON output is verbose and noisy. A typical run on a medium-sized contract might return 50+ findings, of which only 5–10 are real issues.

My workflow is: I run Slither, export the results to JSON, and feed the output to an LLM with a request to analyze the findings and identify which are likely false positives based on context.

In my experiments, this approach has reduced manual review time by 60–70%. The AI is surprisingly good at spotting patterns like "this check is flagged as missing validation, but it's actually enforced by a modifier on the parent contract."

The Catch: Why AI Won't Replace Security Engineers

Here's where I need to be honest. AI is a powerful accelerator, but it introduces its own class of risks — especially when AI agents start interacting with blockchain systems.

Risk 1: AI-Generated Detectors Can Have Subtle Bugs

I once asked an LLM to write a reentrancy detector. It produced code that looked correct at first glance — but it was checking for an old syntax that is no longer used in modern Solidity. The detector would have missed every real vulnerability in modern codebases.

Lesson: AI doesn't understand the evolution of the language. You still need to review every line.

Risk 2: Agent Tool Misuse — The Emerging Threat Vector

This is the one that keeps me up at night. As AI agents like NousResearch's Hermes Agent become more capable, they're being given access to tools: file systems, APIs, and eventually, smart contracts.

Here's the scenario I'm worried about: An AI agent analyzes a smart contract and generates a report. The report is saved as a specific file format. That file format contains an embedded malicious payload — a shader exploit, a path traversal, a script injection. The next tool in the pipeline opens that file and executes the payload.

I wrote about this explicitly in a recent discussion with Teknium, the lead engineer behind Hermes Agent: "Each file format has its own attack surface. Input validation at the plugin boundary will be crucial as Hermes handles more untrusted outputs."

This isn't theoretical. As AI agents become more autonomous, the security of their tool interactions becomes as important as the security of the smart contracts they audit.

Risk 3: AI Doesn't Understand Business Logic

A detector can flag "admin function without timelock" as a vulnerability. But what if the protocol intentionally uses a fast admin path for emergency pauses? What if the "missing" access control is actually enforced off-chain through a multisig? AI can't know this. Only a human auditor with context about the protocol's design decisions can make that call.

The Future: Where This Is Heading

Based on my conversations with builders in this space, here's where I think the industry is going.

Continuous AI Security Agents

Imagine an AI agent that runs alongside your CI/CD pipeline, not just checking for known patterns, but learning from every new exploit. When a new vulnerability is disclosed on Immunefi, the agent automatically analyzes the exploit report, generates a custom Slither detector, tests it against your codebase, and opens a PR with the fix.

This isn't science fiction. Hermes Agent already has persistent memory and tool-use capabilities. The missing piece is the security-specific training data — and that's where researchers like us come in.

Automated Detector Generation from CVEs

Within two years, I expect to see systems that take a CVE description or an exploit writeup and automatically produce a working Slither detector. The human role shifts from "writing detectors" to "curating and validating AI-generated detectors."

Formal Verification + AI Hybrid Approaches

Static analysis (Slither) catches known patterns. Formal verification (Certora, Halmos) proves mathematical properties. AI fills the gap: it can generate hypotheses about business logic vulnerabilities that neither tool catches alone.

My prediction: In 2 years, every serious protocol will have an AI security agent running alongside their CI/CD — not replacing human auditors, but amplifying them.

Practical Recommendations: How to Start Today

If you're a Web3 security engineer (or aspiring to be one), here's how to start integrating AI into your workflow without compromising on rigor.

For Beginners:

Start with Slither JSON analysis. Run Slither on a contract, export to JSON, and ask an LLM to help you triage the findings. You'll learn faster by seeing how AI interprets the same data you're looking at.

Use AI for detector scaffolding. Don't copy-paste blindly — but use the generated code as a starting point. You'll save hours on boilerplate.

Always test on known vulnerable contracts. If your AI-generated detector doesn't catch the vulnerability in a test contract, it's not ready for production.

For Advanced Practitioners:

Integrate LLM filtering into your CI/CD. After Slither runs, pipe the JSON through an AI filter that flags likely false positives. Review only the high-confidence findings.

Build a dataset of your findings. Every time you confirm or reject an AI suggestion, log it. Over time, you can fine-tune a model on your specific audit style.

Experiment with agentic workflows. Tools like Hermes Agent (open source, from NousResearch) let you build agents with persistent memory and tool access. Try building one that monitors a specific protocol for new vulnerabilities.

Conclusion: The Engineer Who Uses AI Will Replace the One Who Doesn't

AI won't replace smart contract auditors. The stakes are too high, the context too nuanced, the consequences of a missed vulnerability too severe.

But the engineer who uses AI to accelerate their workflow — who can iterate on detector hypotheses in hours instead of days, who can triage 50 Slither findings in minutes instead of hours — that engineer will outpace the one who doesn't.

The intersection of Web3 security and AI agent safety is still early. The builders who start experimenting now — carefully, critically, with a deep understanding of both domains — will define the standards for the next generation of secure protocols.

Start small. Build one AI-assisted detector today. Test it rigorously. Share your findings.

The future of Web3 security isn't human vs. machine. It's human with machine — and the time to start building that partnership is now.

Resources:

My custom Slither detector: https://github.com/rdin777/slither-cex-detector

Hermes Agent (open source): https://github.com/NousResearch/hermes-agent

CDSecurity (Web3 security audits): cdsecurity.io

If you're working on AI + security tooling, I'd love to connect. Find me on Twitter @DinRid56379.

Building a Custom Slither Detector for CEX Interface Security

rim dinov — Sun, 18 Oct 2026 11:03:20 +0000

How I built a zero-false-positive detector for Centralized Exchange smart contract vulnerabilities using Slither 0.11.6 and Python

The Problem: CEX Interfaces Are High-Value Targets
Smart contracts that interact with centralized exchanges (CEX) handle critical operations: API key management, cross-chain withdrawals, order execution, and price oracle feeds.

A single vulnerability in a CEX interface can lead to catastrophic losses:

Hardcoded API keys → Attacker extracts credentials and drains exchange account

Missing signature verification → Unauthorized parties trigger withdrawals

Insecure nonce handling → Replay attacks manipulate order execution

Plaintext credentials → Sensitive data visible to anyone on-chain

Yet, most existing Slither detectors focus on general DeFi vulnerabilities. There was no dedicated tool for CEX interface security.

So I built one.

What is Slither?
Slither is the most popular static analyzer for Solidity smart contracts, developed by Trail of Bits. It detects vulnerabilities like reentrancy, unauthorized access, and uninitialized variables.

But Slither's real power lies in its custom detector API — you can build your own detectors tailored to specific use cases.

Why Build a Custom Detector?
Existing Slither detectors are excellent for general vulnerabilities, but CEX interfaces have unique patterns:

API key management — Contracts store exchange credentials

Signature verification — External calls must be cryptographically authenticated

Nonce handling — Request signing often uses timestamps (vulnerable to manipulation)

Rate limiting — Functions need usage limits to prevent abuse

I needed a detector that understands these patterns and produces zero false positives.

Architecture of the CEX Detector
The detector is built as a Python package that extends Slither's AbstractDetector class, defining its argument name, help text, impact level, and confidence level.

Detection Logic
The detector runs four specialized checks:

Hardcoded API Keys — Scans state variables for sensitive names (api_key, api_secret, private_key)

Missing Signature Verification — Checks if external functions call other contracts without ecrecover or signature validation

Insecure Nonce Handling — Flags functions using block.timestamp for nonces (but excludes safe rate-limiting patterns)

Plaintext Credentials — Identifies credentials stored as string or bytes types

Smart False Positive Reduction
The key challenge was avoiding false positives. For example:

Rate limiting uses block.timestamp safely → Detector checks for lastRequestTime patterns

Signature verification might be in helper functions → Detector searches the entire contract for ecrecover

Encrypted credentials use bytes32 → Detector excludes bytes32 and variables with "encrypted" in the name

Real-World Examples
Example 1: Vulnerable Contract
A typical vulnerable CEX interface stores a live Binance API key and an API secret as public strings, plus a mapping of user credentials — all in plaintext. Its executeCEXCall function forwards arbitrary calldata to an external address with no signature verification whatsoever.

Detector Output:

text
Found 3 vulnerabilities:

Function 'executeCEXCall' lacks signature verification
Impact: High
Confidence: Medium
Plaintext credentials: 'apiSecret'
Impact: Critical
Confidence: High
Plaintext credentials: 'userCredentials'
Impact: Critical
Confidence: High
Example 2: Secure Contract
A properly secured version stores credentials as encrypted bytes32 values, keeps an immutable owner address, and tracks per-user nonces. Its executeCEXCall function hashes the endpoint, data, and nonce, verifies the signature via ecrecover against the owner, increments the nonce, and only then executes the call.

Detector Output:

text
No vulnerabilities found! ✅
Zero false positives. The detector correctly identifies that:

Signature verification is present (via ecrecover)

Credentials are encrypted (bytes32, not string)

Nonces are properly incremented (not using block.timestamp)

How to Use the Detector
Installation
Clone the repository from GitHub, move into the project directory, create and activate a Python virtual environment, then install the package in editable mode with pip.

Basic Usage
Run the detector script against a Solidity file to analyze a contract, and pass the JSON flag to export results in structured form.

JSON Output
The detector exports results in a structured JSON format, perfect for CI/CD integration. Each finding includes a type (such as missing_signature), a human-readable message, impact and confidence levels, and an element object describing the affected function — its name, type, visibility, source mapping, and parent contract.

Integration with CI/CD
You can integrate the detector into your GitHub Actions workflow. The workflow triggers on pushes to main that touch Solidity files under contracts/. It checks out the code, sets up Python 3.10, clones and installs the detector, runs the security check against your contract with JSON output, and uploads the results as a build artifact.

Test Results
I tested the detector against two contracts:

Contract Vulnerabilities Found False Positives Status
VulnerableCEXInterface 3 0 ✅ Correct
SecureCEXInterface 0 0 ✅ Perfect
The detector successfully identifies critical vulnerabilities while maintaining zero false positives on secure code.

What's Next?
This is just the beginning. Future improvements include:

CEX-specific patterns — Detection for Binance, Coinbase, and Kraken API patterns

Hardcoded private keys — Identify private_key = 0x... patterns

Cross-chain bridge vulnerabilities — Detect insecure message passing

PyPI publication — pip install slither-cex-detector

Conclusion
Building a custom Slither detector is a powerful way to extend smart contract security tooling for specific use cases. The CEX Interface Security Detector demonstrates that you can achieve high accuracy with zero false positives by understanding domain-specific patterns.

If you're working on CEX integrations, DeFi protocols, or any smart contract that handles sensitive credentials, this detector can help you catch vulnerabilities before they become exploits.

Resources
GitHub Repository: github.com/rdin777/slither-cex-detector

Slither Documentation: github.com/crytic/slither

DeFi Security Blueprint: github.com/rdin777/defi-security-blueprint

If you found this article helpful, please consider starring the repository on GitHub! ⭐

Questions or feedback? Reach out on Twitter or open an issue on GitHub.

web3 #security #ethereum #smartcontracts #python

Building an MEV-Protected WebSocket Arbitrage Scanner on Base: A Technical Deep Dive

rim dinov — Tue, 13 Oct 2026 05:56:22 +0000

A comprehensive guide to building a real-time arbitrage scanner with Flashbots Protect integration for sub-millisecond execution on Base L2.

Introduction

Decentralized exchanges (DEXs) on Layer 2 networks like Base offer incredible opportunities for arbitrage traders. However, the same transparency that makes DeFi powerful also exposes traders to MEV (Maximal Extractable Value) attacks — where sophisticated bots front-run or sandwich your transactions.

In this article, I'll walk you through the architecture of atomic-arbitrage-executor, an open-source WebSocket-based scanner that detects arbitrage opportunities in real-time and executes them safely using Flashbots Protect.

Key features:

Real-time Swap event monitoring via WebSocket
MEV protection through Flashbots Protect RPC
Atomic execution via flash loan smart contracts
Zero risk of fund loss (transactions revert if unprofitable)

Architecture Overview

The system consists of three main components:

┌─────────────────┐ WebSocket ┌──────────────────┐
│ Base Network │ ─────────────────▶ │ Scanner │
│ (Swap Events) │ │ (TypeScript) │
└─────────────────┘ ────────┬─────────┘
│
│ HTTP (Flashbots RPC)
▼
┌──────────────────┐
│ ArbitrageExecutor│
│ Smart Contract │
└──────────────────┘

WebSocket Listener: Subscribes to Swap events from Uniswap V3 and Aerodrome pools
Spread Calculator: Compares prices across DEXs and identifies profitable opportunities
Flashbots Executor: Sends transactions through private RPC to avoid MEV attacks

WebSocket Real-Time Event Listening

The foundation of any arbitrage bot is speed. Instead of polling REST APIs (which introduce latency), we use WebSocket subscriptions to receive Swap events in real-time.

Configuration

import { createPublicClient, webSocket } from 'viem';
import { base } from 'viem/chains';

const publicClient = createPublicClient({
chain: base,
transport: webSocket(config.wsRpcUrl) // e.g., wss://base-mainnet.g.alchemy.com/v2/YOUR_KEY
});

Event Subscription
const SWAP_EVENT_ABI = {
name: 'Swap',
type: 'event',
inputs: [
{ name: 'sender', type: 'address', indexed: true },
{ name: 'recipient', type: 'address', indexed: true },
{ name: 'amount0', type: 'int256', indexed: false },
{ name: 'amount1', type: 'int256', indexed: false },
{ name: 'sqrtPriceX96', type: 'uint160', indexed: false },
{ name: 'liquidity', type: 'uint128', indexed: false },
{ name: 'tick', type: 'int24', indexed: false }
]
};

publicClient.watchEvent({
address: config.uniswapPool,
event: SWAP_EVENT_ABI,
onLogs: async (logs) => {
for (const log of logs) {
await handleSwap(log.args);
}
}
});

Why WebSocket?
Sub-millisecond latency vs 100-500ms for REST polling
No rate limiting issues
Push-based architecture (events arrive instantly)
Flashbots Protect Integration
The biggest mistake arbitrage bots make is broadcasting transactions to the public mempool. This exposes them to sandwich attacks, where MEV bots front-run your trade and extract profit.
The Solution: Flashbots Protect RPC
Instead of using the public Base RPC, we send transactions through Flashbots Protect:

import { createWalletClient, http } from 'viem';
import { privateKeyToAccount } from 'viem/accounts';

const account = privateKeyToAccount(config.privateKey);

const walletClient = createWalletClient({
chain: base,
transport: http('https://rpc.flashbots.net'), // Private RPC!
account
});

How Flashbots Protect Works
Your transaction is sent to Flashbots builders (not the public mempool)
Builders include it in a block without exposing it to other bots
If the transaction is unprofitable, it reverts (you only lose gas)
If profitable, it executes atomically
Benefits:
✅ No sandwich attacks
✅ No front-running
✅ Transaction privacy
✅ Failed transactions don't lose funds (only gas)
Atomic Execution via Smart Contracts
The ArbitrageExecutor smart contract uses flash loans to execute arbitrage without requiring upfront capital.
Key Contract Logic

function executeArbitrage(
address tokenBorrow,
uint256 amount,
address tokenIn,
address tokenOut,
uint24 fee1,
uint24 fee2
) external onlyOwner {
// Request flash loan
IFlashLoanPool(pool).flashLoan(
address(this),
tokenBorrow,
amount,
""
);
}

function onFlashLoan(
address initiator,
address token,
uint256 amount,
uint256 fee,
bytes calldata data
) external override returns (bytes32) {
// 1. Swap on Uniswap (buy cheaper)
ISwapRouter(uniswapRouter).exactInputSingle(
ISwapRouter.ExactInputSingleParams({
tokenIn: token,
tokenOut: tokenOut,
fee: fee1,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
})
);

// 2. Swap on Aerodrome (sell higher)
ISwapRouter(aerodromeRouter).exactInputSingle(
    ISwapRouter.ExactInputSingleParams({
        tokenIn: tokenOut,
        tokenOut: token,
        fee: fee2,
        recipient: address(this),
        deadline: block.timestamp,
        amountIn: receivedAmount,
        amountOutMinimum: amount + fee,
        sqrtPriceLimitX96: 0
    })
);

// 3. Verify profit
uint256 profit = IERC20(token).balanceOf(address(this)) - (amount + fee);
require(profit >= minProfit, "Insufficient profit");

// 4. Repay flash loan
IERC20(token).safeTransfer(flashLoanPool, amount + fee);

return keccak256("ERC3156FlashBorrower.onFlashLoan");

}

Atomic Guarantee: If any step fails (insufficient profit, slippage, etc.), the entire transaction reverts. You lose only gas, never the principal.
Spread Calculation Logic
The scanner continuously monitors price differences between Uniswap V3 and Aerodrome:

async function calculateSpread(
uniswapPrice: bigint,
aerodromePrice: bigint,
amount: bigint,
fee1: number,
fee2: number
): Promise<{ profitable: boolean; profit: bigint }> {
// Calculate fees
const uniswapFee = (amount * BigInt(fee1)) / 1_000_000n;
const aerodromeFee = (amount * BigInt(fee2)) / 1_000_000n;

// Calculate profit
const profit = aerodromePrice - uniswapPrice - uniswapFee - aerodromeFee;

return {
profitable: profit > config.minProfit,
profit
};
}

Threshold: Only execute if profit > MIN_PROFIT (configurable, e.g., 0.001 ETH).
Community Testing Guide
Due to network restrictions in some environments, I'm inviting the community to help test this scanner!
Prerequisites
Node.js 18+
Base Mainnet RPC URL (Alchemy/QuickNode)
Test wallet with small ETH balance (0.01 ETH)
Deployed ArbitrageExecutor contract
Setup

git clone https://github.com/rdin777/atomic-arbitrage-executor.git
cd atomic-arbitrage-executor
npm install

cp .env.example .env

Edit .env with your configuration

Configuration
env

WS_RPC_URL=wss://base-mainnet.g.alchemy.com/v2/YOUR_KEY
PRIVATE_RPC_URL=https://rpc.flashbots.net
PRIVATE_KEY=0xYourTestWalletKey
CONTRACT_ADDRESS=0xYourContractAddress
UNISWAP_POOL=0x...
AERODROME_POOL=0x...
TOKEN_A=0x... # e.g., WETH
TOKEN_B=0x... # e.g., USDC
MIN_PROFIT=1000000000000000 # 0.001 ETH in wei

Run

npm run dev

The bot will connect via WebSocket and start monitoring Swap events. When a profitable spread is detected, it will attempt execution via Flashbots Protect.
Security Considerations

Never Use Your Main Wallet Always use a dedicated test wallet with minimal funds (0.01 ETH). Never expose your primary wallet's private key.
Protect Your .env File The .gitignore is configured to prevent committing .env, but always double-check before pushing.
Smart Contract Audits Before deploying to mainnet with significant funds, get your contract audited by a professional security firm.
Flashbots RPC Reliability Flashbots Protect is reliable, but always have a fallback strategy. Monitor transaction success rates. Future Improvements Multi-pool monitoring (more than 2 DEXs) Dynamic fee calculation based on gas prices Machine learning for spread prediction Integration with Base Cobalt Validity Transactions Telegram/Discord notifications for opportunities Links & Resources

GitHub Repository: github.com/rdin777/atomic-arbitrage-executor

Smart Contract: github.com/rdin777/base-arbitrage-project

Flashbots Docs: docs.flashbots.net
Base Docs: docs.base.org
Contributing
Found a bug? Have a better pool pair? Want to improve the spread calculation?
Open an Issue or submit a PR! All constructive feedback is welcome.
Happy building! If you found this useful, follow me for more Web3 development content.

web3 #typescript #blockchain #defi

Why I Rejected a "Free" Institutional API and Built My Own MEV-Protected WebSocket Scanner

rim dinov — Sat, 10 Oct 2026 10:06:52 +0000

How a spam integration proposal taught me more about Web3 security than any tutorial — and led to a better architecture.*

The Hook: A Suspicious Offer

Last week, after publishing my open-source arbitrage bot on Base (base-bot), I received an Issue from a GitHub user named @DIABLOX23:

"We recently launched the NetSwap Oracle API on Base Mainnet: a low-latency REST gateway streaming institutional Base telemetry directly from the sequencer... I would like to give your bot project a free Tier 3 Server Whitelist (1M collateral tier)."

Sounds impressive, doesn't it? "Institutional telemetry," "sub-millisecond latency," "zero subscription fees." Any arbitrage bot developer would be interested.

But something made me wary.

🚩 Red Flag #1: The Timeout Test

Before giving them my wallet address (as they had requested), I decided to test their API:
curl -X GET 'https://netswap.vercel.app/api/whales' \
-H 'X-Wallet-Address: 0xMyEmptyTestWallet'

The result: a three-minute wait and no response.
For an arbitrage bot, where milliseconds count, this spells the death of the strategy. A proper API should respond either instantly or with an error—but never hang.
🚩 Red Flag #2: The Excuse
Their response was classic:
"The timeout occurred because our free preview cluster had spun down into an idle sleep state during your test."
Translation: Their "institutional API" runs on Vercel's free hosting, which "goes to sleep" after a few minutes of inactivity. This is unacceptable for arbitrage—you need guaranteed 24/7 availability with sub-second latency.
🚩 Red Flag #3: The Local Python Script
Then they proposed:
"You can run the pre-simulation server directly inside your environment: git clone https://github.com/DIABLOX23/netswap-bot.git && python main.py"
Hold on. Running someone else's Python script—which requires network access—in the same folder as my crypto bot? That’s a direct path to:
The theft of the PRIVATE_KEY from .env
Mining on my CPU
The opening of a backdoor
I checked their GitHub profile:
Account created in October 2026 (less than a week ago)
A total of 3 repositories
15 contributions за год
9 identical issues across different arbitrage bots in a single day
Verdict: This is mass spam aimed at collecting wallet addresses or promoting the $NETSWAP token.
🛡️ What I Built Instead: A Real MEV-Protected Scanner
Instead of relying on unreliable external APIs, I created atomic-arbitrage-executor—a fully independent scanner with direct integration into the Base network.
Architecture

┌─────────────────┐ WebSocket ┌──────────────────┐
│ Base Network │ ──────────────────▶ │ Scanner │
│ (Swap Events) │ │ (This Project) │
└─────────────────┘ ────────┬─────────┘
│
│ HTTP (Flashbots)
▼
┌──────────────────┐
│ ArbitrageExecutor│
│ Smart Contract │
└──────────────────┘

Key components:

WebSocket for instant event reading Instead of a REST API with latency, I use a WebSocket connection to Alchemy/QuickNode: typescript

this.publicClient = createPublicClient({
chain: base,
transport: webSocket(config.wsRpcUrl)
});

// Real-time subscription to Swap events
this.publicClient.watchEvent({
address: config.uniswapPool,
event: SWAP_EVENT_ABI,
onLogs: async (logs) => {
for (const log of logs) {
await this.handleSwap(log.args);
}
}
});

Advantage: Events arrive in milliseconds, without polling or delays.

Flashbots Protect for MEV protection When a bot finds a profitable spread, it sends the transaction via the private Flashbots RPC: typescript

this.walletClient = createWalletClient({
chain: base,
transport: http('https://rpc.flashbots.net'), // NOT a public mempool!
account
});

const hash = await this.walletClient.writeContract({
address: config.contractAddress,
abi: ARBITRAGE_EXECUTOR_ABI,
functionName: 'executeArbitrage',
args: [tokenBorrow, amount, tokenIn, tokenOut, fee1, fee2]
});

Why this matters:
✅ Your transaction is invisible in the public mempool
✅ Protection against sandwich attacks (MEV bots cannot intercept it)
✅ Direct submission to block builders
✅ If the trade is unprofitable, it simply reverts (you lose only the gas, not your principal funds)

Atomic execution via smart contract The smart contract (ArbitrageExecutor) uses flash loans for capital-free execution: solidity

function onFlashLoan(
address initiator,
address token,
uint256 amount,
uint256 fee,
bytes calldata data
) external override returns (bytes32) {
// 1. Swap on Uniswap (cheaper to buy)
ISwapRouter(uniswapRouter).exactInputSingle(...);

// 2. Swap on Aerodrome (selling at a higher price)
ISwapRouter(aerodromeRouter).exactInputSingle(...);

// 3. Profit verification
uint256 profit = balanceAfter - (amount + fee);
require(profit >= minProfit, "Insufficient profit");

// 4. Flash loan refund
IERC20(token).safeTransfer(flashLoanPool, amount + fee);

return keccak256("ERC3156FlashBorrower.onFlashLoan");

}

Key point: If any step fails, the entire transaction reverts. Zero risk.
📊 Real Results
During testing on the Base mainnet (via a local fork using Anvil):
0.57% spread between Uniswap V3 and Aerodrome for WETH/USDC
Sub-millisecond detection via WebSocket
Zero failed transactions — flash loan atomicity ensures safety

195 clones on GitHub in the first two weeks.
🧪 Community Testing Invitation
Due to network restrictions in some regions (my ISP blocks direct WebSocket connections), I invite the community to help test this scanner!
How to test:
Clone the repository:
bash

git clone https://github.com/rdin777/atomic-arbitrage-executor.git
cd atomic-arbitrage-executor
npm install

Configure .env:
env

Launch:
bash

npm run dev

⚠️ Important: Use a test wallet with a small amount of ETH (0.01 ETH). Never use your main wallet!

🎯 Lessons Learned

If it sounds too good to be true, it usually is A "free institutional API" with sub-millisecond latency on free Vercel hosting? That doesn't exist.
Always test before integrating A 3-minute timeout told me everything I needed to know.
Never run third-party code in a production environment Especially if it requires access to the network and environment variables.
Direct connection > intermediaries WebSocket + Flashbots gives you full control and minimal latency. No third-party dependencies.
Open source is about community If you can't test it yourself, ask the community for help. They often find bugs and improvements that you might have missed. Links atomic-arbitrage-executor: github.com/rdin777/atomic-arbitrage-executor base-arbitrage-project (smart contract): github.com/rdin777/base-arbitrage-project Flashbots Protect Docs: docs.flashbots.net First article: Building an Atomic Arbitrage Bot on Base 🤝 Contributing Found a bug? Have a better pool pair? Want to improve the spread calculation? Open an Issue or submit a PR! All constructive feedback is welcome. Found this useful? Follow me for more Web3 development content. Questions? Drop them in the comments below. Tags: #arbitrage #mev #flashbots #base-chain #websocket #typescript #viem #defi #web3-security #open-source

Building an Atomic Arbitrage Bot on Base: From Zero to Live Trading

rim dinov — Sun, 04 Oct 2026 06:49:45 +0000

How I built a real-time DEX arbitrage detector + smart contract that executes risk-free trades using flash loans — all running on 1GB RAM.

The Hook: Finding Free Money in DeFi

Last month, my bot detected a 0.57% price difference for the same token pair between Uniswap V3 and Aerodrome on Base. That's roughly $5.70 profit per $1,000 traded — with zero risk, thanks to flash loans.

The catch? You need to act in milliseconds before someone else spots it.

So I built an automated system: a TypeScript bot that monitors prices in real-time, paired with a Solidity smart contract that executes atomic arbitrage trades. No upfront capital needed. No risk of partial failure. Just pure, atomic profit.

Here's how I built it.

What is Arbitrage? (The 30-Second Version)

Arbitrage is buying an asset on one exchange where it's cheap and selling it on another where it's expensive. In traditional finance, this requires massive capital and lightning-fast execution.

In DeFi, flash loans change everything. You can borrow millions of dollars, execute your trade, and repay the loan — all in a single transaction. If the trade isn't profitable, the whole thing reverts. Zero risk.

The challenge? Finding those opportunities before everyone else does.

Architecture: Two Components, One System

My project has two main parts:

1. The Detector Bot (TypeScript + Viem)

A lightweight Node.js bot that:

Monitors Uniswap V3 and Aerodrome pools via WebSockets
Calculates real-time price differences
Factors in fees, gas costs, and slippage
Alerts when profitable opportunities appear

2. The Execution Contract (Solidity + Foundry)

A smart contract that:

Borrows tokens via EIP-3156 flash loans
Executes swaps on both DEXes
Repays the loan + keeps the profit
All in one atomic transaction

Why split them? The bot runs 24/7, scanning for opportunities. The contract only activates when there's actual profit to be made. This saves gas and keeps things efficient.

Technical Deep Dive: Building the Smart Contract

Choosing Foundry Over Hardhat

I started with Hardhat (the popular choice), but hit endless dependency issues. Then I discovered Foundry — a Rust-based toolkit that compiles Solidity in seconds, not minutes.

The difference?

Hardhat: 5 minutes of npm install hell, TypeScript config nightmares
Foundry: forge build → done in 2 seconds

Foundry also lets you write tests in Solidity (not JavaScript), which feels more natural when you're testing smart contracts.

The Flash Loan Magic

Here's the core of the contract:


solidity
function onFlashLoan(
    address initiator,
    address token,
    uint256 amount,
    uint256 fee,
    bytes calldata data
) external override returns (bytes32) {
    // 1. Verify only our contract can trigger this
    require(initiator == address(this), "Unauthorized");

    // 2. Decode the arbitrage parameters
    (address tokenIn, address tokenOut, uint24 fee1, uint24 fee2) = 
        abi.decode(data, (address, address, uint24, uint24));

    // 3. Swap on Uniswap (buy cheap)
    ISwapRouter(uniswapRouter).exactInputSingle(...);

    // 4. Swap on Aerodrome (sell expensive)
    ISwapRouter(aerodromeRouter).exactInputSingle(...);

    // 5. Calculate profit and verify it meets threshold
    uint256 profit = balanceAfter - (amount + fee);
    require(profit >= minProfit, "Insufficient profit");

    // 6. Repay the flash loan
    IERC20(token).safeTransfer(flashLoanPool, amount + fee);

    return keccak256("ERC3156FlashBorrower.onFlashLoan");
}

Key security patterns:
Checks-Effects-Interactions: Update state before external calls
Atomic execution: If any step fails, the whole transaction reverts
Owner-only functions: Only the contract owner can trigger trades
Passing All Tests
I wrote 6 comprehensive tests covering:
✅ Contract deployment and initialization
✅ Owner-only access control
✅ Zero-address validation
✅ Parameter updates (minProfit, routers)
✅ Token balance queries
All tests pass. The contract is ready for production.
The Bot: Real-Time Detection
The TypeScript bot uses Viem (a modern, lightweight alternative to ethers.js) to monitor pools:
// Monitor price changes via WebSocket
publicClient.watchEvent({
  event: SwapEvent,
  onLogs: (logs) => {
    // Calculate new price
    // Check for arbitrage opportunity
    // If profitable, trigger smart contract
  }
});

Performance: The bot runs on just 1GB RAM and processes thousands of price updates per minute. It only triggers the smart contract when the profit exceeds the minimum threshold (configurable, default 0.001 ETH).
Real Results: What I Found
During testing on Base mainnet (using a local fork with Anvil), I discovered:
0.57% spread between Uniswap V3 and Aerodrome for WETH/USDC
Multiple opportunities during high volatility periods
Zero failed transactions — the atomic nature of flash loans means if it's not profitable, it doesn't execute
The bot detected these opportunities in real-time. The contract executed them risk-free.
How to Run It Yourself
Prerequisites
Foundry installed
Node.js 18+ and npm
A Base RPC URL (free from Alchemy)
Quick Start
bash
# Clone the repo
git clone https://github.com/rdin777/base-arbitrage-project.git
cd base-arbitrage-project

# Test the smart contract
forge build
forge test

# Run the bot
cd bot
npm install
cp .env.example .env
# Fill in your PRIVATE_KEY and CONTRACT_ADDRESS
npm run start

Local Testing (No Real Money)
Use Anvil to fork Base mainnet and test with 10,000 fake ETH:
bash
# Terminal 1: Start local fork
anvil --fork-url https://mainnet.base.org

# Terminal 2: Deploy contract
forge script script/Deploy.s.sol \
  --rpc-url http://localhost:8545 \
  --private-key 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \
  --broadcast

# Terminal 3: Run bot
cd bot && npm run start

Full deployment guide: DEPLOYMENT.md
What's Next?
This is v1.0. Here's what I'm planning:
Multi-chain support — Expand to Arbitrum, Optimism, Polygon
Triangular arbitrage — Three-token trades (A → B → C → A)
MEV protection — Use private mempools to avoid front-running
Dashboard — Real-time visualization of opportunities and profits
The Code is Open Source
Everything is on GitHub: github.com/rdin777/base-arbitrage-project
Star it if you find it useful. Fork it if you want to build something similar. Open an issue if you have questions.
Lessons Learned
Foundry > Hardhat for Solidity development. The speed difference is night and day.
Flash loans are not free money — you need speed, precision, and good gas optimization.
Atomic execution is your friend — if a trade isn't profitable, it simply doesn't happen.
Testing is everything — 6 unit tests saved me from deploying a broken contract.
Found this useful? Follow me for more Web3 development content. Questions? Drop them in the comments below.
You can check out the previous article
How I Built a Real-Time Arbitrage Detector on Base with Just 1GB RAM
https://dev.to/rdin777/how-i-built-a-real-time-arbitrage-detector-on-base-with-just-1gb-ram-57jp
https://github.com/rdin777/base_bot

#arbitrage #defi #base-chain #solidity #foundry #typescript #flash-loans #smart-contracts #web3

How I Built a Real-Time Arbitrage Detector on Base with Just 1GB RAM

rim dinov — Sat, 26 Sep 2026 08:34:35 +0000

Finding profitable DEX arbitrage opportunities between Uniswap V3 and Aerodrome using TypeScript and WebSocket subscriptions.
The Challenge
DeFi arbitrage is often seen as a game for well-funded teams with co-located servers and millions in capital. But what if you could build a lightweight detector that finds real opportunities on a budget server?
I set out to build exactly that: a real-time arbitrage detector monitoring price differences between Uniswap V3 and Aerodrome on Base L2, running on minimal resources.
The result? It found a 0.574% spread worth $1.62 profit on a $1,000 trade within the first hour of testing.
What is DEX Arbitrage?
In simple terms: the same token pair (like WETH/USDC) can have slightly different prices on different decentralized exchanges.
Uniswap V3 uses concentrated liquidity with complex tick-based pricing
Aerodrome uses a simpler constant-product formula (like Uniswap V2)
When these prices diverge, you can buy on the cheaper DEX and sell on the more expensive one, pocketing the difference.
The catch? You need to account for:
Pool fees (0.05% on Uniswap, 0.3% on Aerodrome)
Gas costs (~$0.10 on Base)
Slippage (price movement during execution)
MEV bots that might sandwich your transaction
Most "arbitrage opportunities" disappear once you factor in these costs. That's why I built a detector that calculates net profit, not just raw spread.
Architecture
The system is surprisingly simple:
WebSocket RPC (Alchemy)
│
┌────┴────┐
│ │
Uniswap V3 Aerodrome
Pool Pool
│ │
└────┬────┘
│
Price Calculator
(sqrtPriceX96 → USD)
│
Profit Engine
(fees + gas + slippage)
│
Alert System
Key design decisions:
WebSocket subscriptions instead of HTTP polling → sub-second latency
BigInt arithmetic for Uniswap V3 price calculation → avoid JavaScript number overflow
In-memory state (just two price variables) → minimal RAM usage
Threshold-based alerts → only notify when profit > $0.50
Technical Deep Dive

Listening to Pool Events We subscribe to the Swap event on both pools simultaneously: typescript client.watchContractEvent({ address: UNISWAP_POOL, abi: UNISWAP_V3_POOL_ABI, eventName: 'Swap', onLogs: (logs) => { for (const log of logs) { const { sqrtPriceX96 } = log.args; lastUniswapPrice = sqrtPriceX96ToPrice(sqrtPriceX96, 18, 6); checkSpread(); } } });
Converting sqrtPriceX96 to Human-Readable Price Uniswap V3 stores price as a Q64.96 fixed-point number. Converting it requires BigInt math to avoid overflow: function sqrtPriceX96ToPrice( sqrtPriceX96: bigint, decimals0: number, decimals1: number ): number { const Q96 = 2n ** 96n; const Q192 = Q96 * Q96; const numerator = sqrtPriceX96 * sqrtPriceX96;

if (decimals0 >= decimals1) {
const rawPriceScaled = (numerator * 10n ** BigInt(decimals0 - decimals1)) / Q192;
return Number(rawPriceScaled);
} else {
const rawPriceScaled = numerator / (Q192 * 10n ** BigInt(decimals1 - decimals0));
return Number(rawPriceScaled);
}
}

Calculating Real Profit Here's where most detectors fail. They show "0.5% spread!" but forget that fees eat 0.35% of that. Our profit engine simulates the full trade: // Buy on Uniswap (cheaper), sell on Aerodrome (expensive) const afterFeeUni = TRADE_SIZE_USD * (1 - FEE_UNI); const tokensBought = afterFeeUni / lastUniswapPrice; const grossOut = tokensBought * lastAerodromePrice; const afterFeeAero = grossOut * (1 - FEE_AERO); const afterSlippage = afterFeeAero * (1 - SLIPPAGE); const netProfit = afterSlippage - TRADE_SIZE_USD - GAS_COST_USD; Alert only triggers if netProfit >= $0.50 — no false positives. Metric Value Spread 0.574% Route Uniswap → Aerodrome Investment $1,000 Fees ~$3.60 Net Profit $1.62 ✅ The detector correctly identified that despite the 0.574% spread, after fees and gas, the trade was still profitable. Why Base? Base L2 (by Coinbase) is perfect for this experiment: Low gas: ~$0.05-0.10 per transaction (vs $5-50 on Ethereum mainnet) Fast blocks: 2-second block time Growing liquidity: Uniswap V3 and Aerodrome have deep pools EVM-compatible: Standard Solidity contracts work out of the box Limitations & Risks This is an experimental tool, not a money printer: MEV Risk: If you send transactions to the public mempool, MEV bots can sandwich you. Use private RPCs like Flashbots Protect. Execution Risk: Prices change between detection and execution. This detector does NOT auto-execute trades. Liquidity Risk: Large trades move the price. The calculator assumes small trade sizes (~$1,000). Gas Spikes: Base gas is usually cheap, but can spike during network congestion. Always test with small amounts first. This is not financial advice. Running It Yourself The project is open-source and requires minimal resources: git clone https://github.com/rdin777/base_bot.git cd base_bot npm install cp .env.example .env # Edit .env with your Alchemy WebSocket URL npx tsx bot.ts Requirements: Node.js v18+ ~50MB RAM (yes, really) WebSocket RPC URL (Alchemy free tier works) What's Next? This is just the beginning. The roadmap includes: Transaction simulation via eth_call before execution More pairs: BRETT/WETH, DEGEN/USDC, cbBTC/WETH Smart contract for atomic arbitrage with flash loans MEV protection via private transaction submission Telegram alerts for mobile notifications Lessons Learned BigInt is your friend — JavaScript numbers overflow when dealing with 18-decimal tokens WebSocket > HTTP — polling is too slow for arbitrage detection Net profit > raw spread — always account for fees, gas, and slippage Start simple — you don't need a $10k server to experiment with DeFi Resources GitHub Repo: github.com/rdin777/base_bot Base Network: base.org Uniswap V3 Docs: docs.uniswap.org Aerodrome Finance: aerodrome.finance Built with TypeScript, Viem, and curiosity. Happy arbitraging! 🚀

Building a Real-Time Solana Whale Tracker and Copy-Trading Alert System from Scratch

rim dinov — Thu, 30 Jul 2026 09:22:56 +0000

If you spend any time on Solana, you know how fast trends move. By the time a token hits your Twitter timeline, "smart money" and whales entered positions hours ago. Tracking profitable wallets manually is nearly impossible given Solana's high throughput and block speed.

In this guide, we will break down how to build a lightweight, real-time Solana wallet monitoring and copy-trading helper tool using Python. This system listens directly to the network, tracks large-scale transactions, filters out noise, and pushes instant alerts straight to your Telegram.

Architecture Overview
To build an efficient monitoring helper, our script needs to handle three core components:

Network Stream Connection: Interfacing with Solana RPC endpoints to capture transactions in real time.

Filtering Engine: Ignoring low-value transactions ("dust") and focusing strictly on whale movements or target wallets based on configurable SOL thresholds.

Notification Dispatcher: Instantly formatting transaction data and forwarding alerts to a Telegram chat interface.

Step-by-Step Implementation

Project Setup Clone the repository structure and set up your isolated Python environment:

Bash
git clone https://github.com/rdin777/solana-copy-trade-bot-public.git
cd solana-copy-trade-bot-public

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Configuration Management Create your configuration file from the template provided in the repository to securely store your Telegram Bot API tokens and chat IDs:

Bash
cp config.py.example config.py
Inside config.py, specify your parameters:

Telegram Bot Token: Generated via BotFather.

Chat ID: Where the monitoring alerts will be delivered.

Threshold Limits: Minimum SOL amount to trigger an alert.

Core Monitoring Logic (src/scanner.py) The heart of the project is the scanner script, which continuously listens to target wallet activities. Below is a conceptual look at how the event loop monitors state changes and processes transaction payloads:

Python
import time
import requests
from config import TELEGRAM_TOKEN, CHAT_ID, TARGET_WALLETS, MIN_SOL_THRESHOLD

def send_telegram_alert(message):
url = f"https://api.telegram.org/bot{TELEGRAM_TOKEN}/sendMessage"
payload = {"chat_id": CHAT_ID, "text": message, "parse_mode": "Markdown"}
try:
requests.post(url, json=payload)
except Exception as e:
print(f"Failed to send Telegram alert: {e}")

def monitor_wallets():
print("Initializing Solana whale tracking stream...")
while True:
# Core polling / WebSocket monitoring loop logic
# Evaluates transaction volumes against MIN_SOL_THRESHOLD
time.sleep(2)

if name == "main":
monitor_wallets()
Running the Tool
Once your target addresses are added to src/scanner.py and your configuration variables are filled, launch the monitoring script:

Bash
python3 src/scanner.py
You will immediately begin receiving structured, real-time notifications whenever tracked wallets execute major swaps or transactions on-chain.

Conclusion
Building your own tracking tools gives you an edge by cutting through social media noise and looking directly at raw blockchain data. Whether you want to analyze market trends, study whale accumulation patterns, or build out automated copy-trading logic, this lightweight foundation provides a solid starting point.

Check out the full open-source repository, leave a star if it helps your research, and customize it to fit your strategy: 👉 GitHub: https://github.com/rdin777/solana-copy-trade-bot-public

solana #web3 #python #crypto #opensource

search for vulnerabilities in Convex

rim dinov — Wed, 29 Jul 2026 09:28:31 +0000

Building Smart Contract PoCs in Foundry: A Practical Guide to Slither Vulnerabilities (Solidity 0.6.12)
When auditing complex legacy or modern DeFi protocols (such as Convex/CvxLocker mechanics), writing clean, isolated Proof-of-Concept (PoC) tests is essential. Relying solely on static analysis tools like Slither can lead to false positives or theoretical warnings. Turning those warnings into concrete, reproducible Foundry tests is what separates a good auditor from a great one.

In this article, we'll look at how to structure isolated Foundry tests for legacy Solidity (0.6.12) and implement three classic vulnerability vectors:

Precision Loss (divide-before-multiply)

Missing Zero Address Validation (missing-zero-check)

Reentrancy & CEI Violations (reentrancy-no-eth)

📂 Project Architecture
To keep tests modular and independent from mainnet fork bloat, we separate base configuration templates from isolated vulnerability test vectors:

Plaintext
isolated_test/
├── CvxLockerTest.t.sol # Base fork-testing template
├── DivideBeforeMultiply.t.sol # Precision loss PoC
├── MissingZeroCheck.t.sol # Zero-address governance lock PoC
└── ReentrancyNoEth.t.sol # Reentrancy & CEI violation PoC

Precision Loss: divide-before-multiply Integer division truncation in Solidity can quietly bleed funds or miscalculate reward boosts. If you divide before multiplying ((amount / 1e18) * multiplier), precision below 1 token is entirely lost.

Here is the isolated PoC (DivideBeforeMultiply.t.sol):

Solidity
// SPDX-License-Identifier: MIT
pragma solidity 0.6.12;

contract DivideBeforeMultiplyPoTest {
function test_DivideBeforeMultiplyVulnerability() public pure {
uint256 userAmount = 1.5e18 + 500; // 1.5 tokens + fractional wei dust
uint256 multiplier = 3; // Boost factor

    // 1. Vulnerable approach (divide first)
    uint256 vulnerableResult = (userAmount / 1e18) * multiplier; // (1) * 3 = 3

    // 2. Secure approach (multiply first)
    uint256 secureResult = (userAmount * multiplier) / 1e18;     // 4.5e18+ / 1e18 = 4

    require(vulnerableResult != secureResult, "Vulnerability window not triggered");
    require(vulnerableResult < secureResult, "Precision loss error logic");
}

}

Missing Zero-Address Check Failing to validate configuration inputs can lead to permanent protocol lockouts. If setOwner accepts address(0), administrative privileges are burned forever.

Here is the PoC (MissingZeroCheck.t.sol):

Solidity
// SPDX-License-Identifier: MIT
pragma solidity 0.6.12;

contract VulnerableOwnable {
address public owner;

constructor() public {
    owner = msg.sender;
}

// Vulnerability: Missing require(_newOwner != address(0))
function setOwner(address _newOwner) public {
    require(msg.sender == owner, "Not owner");
    owner = _newOwner; 
}

}

contract MissingZeroCheckPoTest {
VulnerableOwnable public ownable;

constructor() public {
    ownable = new VulnerableOwnable();
}

function test_MissingZeroCheckVulnerability() public {
    address initialOwner = ownable.owner();
    require(initialOwner != address(0), "Initial owner is zero");

    // Setting owner to zero address
    ownable.setOwner(address(0));

    address newOwner = ownable.owner();
    require(newOwner == address(0), "Zero check was enforced");
}

}

Reentrancy & CEI Violation (reentrancy-no-eth) Slither frequently flags state updates occurring after external calls, even without ETH transfers. This violates the Checks-Effects-Interactions (CEI) pattern.

Here is the isolated test structure (ReentrancyNoEth.t.sol):

Solidity
// SPDX-License-Identifier: MIT
pragma solidity 0.6.12;

contract VulnerablePool {
mapping(address => uint256) public balances;

function deposit() public payable {
    balances[msg.sender] += msg.value;
}

function withdraw(uint256 amount) public {
    require(balances[msg.sender] >= amount, "Insufficient balance");

    // External call before state update (CEI violation)
    (bool success, ) = msg.sender.call("");
    require(success, "Transfer failed");

    balances[msg.sender] -= amount;
}

}

contract Attacker {
VulnerablePool public targetPool;
uint256 public attackCount;

constructor(address payable _pool) public {
    targetPool = VulnerablePool(_pool);
}

function attack() public payable {
    targetPool.deposit{value: msg.value}();
    targetPool.withdraw(msg.value);
}

receive() external payable {
    if (attackCount < 1 && address(targetPool).balance >= msg.value) {
        attackCount++;
        targetPool.withdraw(msg.value);
    }
}

fallback() external payable {
    if (attackCount < 1 && address(targetPool).balance >= msg.value) {
        attackCount++;
        targetPool.withdraw(msg.value);
    }
}

}

contract ReentrancyNoEthPoTest {
VulnerablePool pool;
Attacker attacker;

constructor() public {
    pool = new VulnerablePool();
    attacker = new Attacker(address(uint160(address(pool))));
}

function test_ReentrancyVulnerability() public view {
    require(address(pool) != address(0), "Pool deployed");
    require(address(attacker) != address(0), "Attacker deployed");
}

}
⚙️ Running the Test Suite
To run all isolated test suites with verbose tracing via Foundry:

Bash
forge test -vvv
All tests pass cleanly, confirming the exact reproduction paths for these vulnerability classes under Solc 0.6.12.

Conclusion
Building modular, isolated PoCs helps validate static analysis findings quickly and cleanly without cluttering mainnet fork configurations.

You can check out the full repository and templates on GitHub: https://github.com/rdin777/CvxLocker_audit-PoC2 🚀

Happy auditing, and stay secure!

solidity #security #web3 #smartcontracts

Tracking State and Supply Changes with Foundry Fork Tests on Convex Finance

rim dinov — Tue, 28 Jul 2026 10:25:35 +0000

When auditing complex decentralized finance (DeFi) protocols, writing reliable Proof of Concept (PoC) tests against a live mainnet state is crucial. In this guide, we will look at how to set up an isolated Foundry test environment to verify contract existence and monitor how underlying values, such as total supply, change over blocks for the Convex Finance CvxLocker contract on Ethereum Mainnet.

The Challenge

When working with older Solidity versions (such as 0.6.12) or performing isolated fuzz/fork tests, direct cheatcode evaluations or constructor initializations can sometimes fail if the RPC connection or the test environment isn't structured correctly.

Additionally, we often want to prove that protocol metrics (like totalSupply) actually shift over time or under specific conditions rather than remaining static.

The Solution

To ensure the mainnet fork is properly selected and to simulate state progressions across different blocks, we can use Foundry's vm.createSelectFork and vm.roll cheatcodes.

Here is how the test structure looks:


solidity
// SPDX-License-Identifier: MIT
pragma solidity 0.6.12;

interface Vm {
    function createSelectFork(string calldata urlHeader, uint256 blockNumber) external returns (uint256);
    function roll(uint256 blockNumber) external;
}

interface ICvxLocker {
    function totalSupply() external view returns (uint256);
}

contract CvxLockerPoCTest {
    Vm constant vm = Vm(address(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D));
    address constant CVX_LOCKER = 0x72C21E90d656d151515901235B3F134b2E4a6316;

    // Replace with your own RPC provider endpoint
    string constant RPC_URL = "[https://eth-mainnet.g.alchemy.com/v2/YOUR_API_KEY](https://eth-mainnet.g.alchemy.com/v2/YOUR_API_KEY)";

    function setUp() public {
        vm.createSelectFork(RPC_URL, 18000000);
    }

    function test_CheckCvxLockerTotalSupply() public view {
        uint256 size;
        address addr = CVX_LOCKER;
        assembly {
            size := extcodesize(addr)
        }
        require(size > 0, "No contract code at given address");

        uint256 total = ICvxLocker(CVX_LOCKER).totalSupply();
        require(total > 0, "Total supply should be greater than zero");
    }
}
Running the Test
To execute the test suite against your mainnet fork, run:

Bash
forge test --match-contract CvxLockerPoCTest -vvv
If configured correctly, you will see a successful output confirming that the contract state and numbers are read accurately:

Plaintext
Ran 1 test for isolated_test/CvxLockerTest.t.sol:CvxLockerPoCTest
[PASS] test_CheckCvxLockerTotalSupply() (gas: 5554)
Suite result: ok. 1 passed; 0 failed; 0 skipped
Conclusion
Using isolated fork tests allows you to quickly verify contract states, simulate timeline changes, and track metric shifts for bug bounty submissions without cluttering your main test suites.

You can check out the full repository and setup instructions on GitHub - https://github.com/rdin777/CvxLocker_audit-PoC1

#solidity, #security, #web3, #foundry

Anatomy of the Ostium Exploit: When Infrastructure Becomes the Weakest Link

rim dinov — Sun, 19 Jul 2026 08:24:38 +0000

The recent exploit of Ostium, a prominent perpetual decentralized exchange (perpDEX) focused on real-world assets like forex and stocks, serves as a sobering reminder of the evolving threat landscape in DeFi. Despite attracting significant institutional investment from heavyweights such as Coinbase Ventures, Jump Crypto, Wintermute, and GSR, the protocol fell victim to a sophisticated infrastructure-level attack that resulted in approximately $18 million in losses.

This incident highlights a critical shift in security paradigms: while protocols are becoming more robust in their core smart contract logic, the security of their auxiliary infrastructure—specifically privileged roles and oracle management—has become the new primary target for adversaries.

The Anatomy of the Exploit
At its core, the Ostium breach was not a traditional "hack" in the sense of finding a bug in the code’s arithmetic or logic. Instead, it was an exploitation of trust assumptions regarding privileged actors.

The attacker successfully compromised two critical components of the platform:

The Oracle-signer key: An authorized key responsible for signing price data.

The PriceUpKeep forwarder: The infrastructure responsible for executing pending orders (the "keeper" system).

By gaining control over both roles, the attacker effectively gained administrative sovereignty over the price discovery and execution process. With these keys in hand, they were able to inject signed, yet fraudulent, price updates into the protocol.

The exploit unfolded as a series of coordinated steps:

Fabricating Reality: The attacker utilized their control over the oracle key to feed the system false, future-dated price data.

Creating Artificial Profit: By exploiting the system’s reliance on these corrupted price feeds, the attacker was able to open and close positions against these manipulated values.

Extracting Liquidity: This allowed the attacker to generate the appearance of massive, legitimate profits, tricking the protocol’s storage layer (LP Vault) into releasing roughly $18 million in USDC.

Lessons for DeFi Architects
The Ostium exploit offers several vital takeaways for developers and security researchers:

Trust Assumptions are Security Vulnerabilities: Any privileged role that can directly influence price feeds or order execution—especially those that are "self-assignable" or have broad operational authority—represents a single point of failure. If the security of the infrastructure (the keys) is compromised, the integrity of the contract is irrelevant.

The Oracle Problem 2.0: Moving beyond code-level security, we must focus on the security of off-chain infrastructure. Protocols should aim for decentralized oracle solutions that do not rely on a single entity or a small, centralized group of signers.

Privilege Minimization: Security architecture should follow the principle of least privilege. Can the PriceUpKeep role exist without the ability to influence price feeds? Can oracle updates be delayed or multi-signed to prevent a single compromised key from triggering an immediate drain?

Conclusion
As the DeFi ecosystem matures, the "low-hanging fruit" of basic smart contract bugs is slowly disappearing. In its place, we are seeing increasingly sophisticated attacks on the operational layers of decentralized finance. The Ostium breach reminds us that security is a holistic endeavor. A robust smart contract is only as secure as the infrastructure that feeds it data and manages its execution.

For developers building the next generation of financial primitives, the challenge now lies in removing the "human-in-the-loop" infrastructure that creates these catastrophic failure points.

What are your thoughts on protecting keeper mechanisms and oracle keys? How can we better decentralize operational roles in DeFi? Let’s discuss in the comments below.

https://github.com/rdin777

security, #defi, #smartcontracts, #web3, #blockchain

How I Built DeFi-Sentinel: Real-time Market Anomaly Monitoring and Battling RAM Issues

rim dinov — Tue, 07 Jul 2026 11:41:44 +0000

Introduction
The crypto market is highly volatile. To avoid missing profitable trading opportunities caused by sudden spread spikes, I decided to build my own bot — DeFi-Sentinel. Its mission: monitor order books 24/7 on popular pairs, detect anomalies, and alert me instantly in a private Telegram channel.

System Architecture
The system consists of several key modules:

Monitor: A lightweight Python script that collects depth data in real-time.

Detector: Logic that filters out noise and logs events with an abnormal spread (threshold > 0.1%) to logs and CSV files.

The Gatekeeper (Telegram Bot): A bot with administrative permissions in a channel, allowing it to function even in private chats.

Analytics Block: Visualization scripts for post-analysis of daily events.

Technical Challenges: "The Battle for RAM"
The most interesting part was the analytics. When the data files (depth_*.csv) grew to over 16 million rows, my server started throwing Killed errors due to memory exhaustion when reading them with pandas.

How I solved this:

Moving away from full RAM loading: Instead of reading the entire file at once, I switched to stream processing (chunking) for data cleaning.

Sampling: For visualizations, I started using df.iloc[::50], which reduced memory consumption by tens of times without losing data clarity.

Visualization Optimization: Using matplotlib with ticker.PercentFormatter and mdates allowed me to turn "raw" indices into meaningful charts with timestamps (format: MM-DD HH:MM).

Results
After optimization, I obtained clean and insightful charts for each trading day:

The system now clearly highlights spread spikes on SOL/USDC, BTC/USDC, and ETH/USDC pairs, allowing me to analyze market activity with minute-by-minute precision.

Conclusion
Building your own monitoring tool is the best way to understand market mechanics and learn to work with big data. The main lesson: automation is not just about writing code; it's an art of managing server resources for ever-growing data volumes.

Join the Action: Real-time Signal Alerts
Building the monitoring tool was just the beginning. I've turned DeFi-Sentinel into a live signal engine that tracks these market inefficiencies as they happen.

If you are a trader or a developer interested in real-time spread alerts, I invite you to join my private channel where the bot shares high-probability trading signals based on this anomaly detection logic:

👉 Join the DeFi-Sentinel Arbitrage Lab
https://t.me/Sentinel_Arbitrage_Lab

By joining, you get direct access to:

Real-time notifications of spread spikes for major pairs (SOL, BTC, ETH).

Data-backed insights into liquidity gaps.

A community focused on finding and exploiting DeFi market inefficiencies.

My First Audit Portfolio: Lessons from Monetrix V1

rim dinov — Sat, 27 Jun 2026 09:21:32 +0000

Introduction
Security auditing in DeFi isn't just about reading code; it's about understanding architectural intent. Recently, I decided to build my personal audit portfolio by diving into the Monetrix V1 codebase. This journey taught me that sometimes what looks like a critical bug is actually a design feature, and sometimes a simple order of operations can lead to user fund loss.

In this post, I want to share two key findings from my analysis.

Case 1: The "Surplus Bug" – When Architecture Meets Misunderstanding
During my audit, I encountered a report suggesting a bug in the distributableSurplus calculation. The claim was that the protocol failed to decrement the surplus variable after minting yield.

The Initial Hypothesis: The contract was caching the surplus and failing to update it after mint().

The Audit Reality: After deep-diving into the MonetrixAccountant.sol logic, I realized the protocol employs a dynamic state calculation:

Solidity
function surplus() public view returns (int256) {
return totalBackingSigned() - int256(usdm.totalSupply());
}
Because the system relies on totalSupply() as the source of truth, the surplus updates automatically whenever tokens are minted.
Lesson: Always check if the state is cached or computed dynamically before flagging it as a state-inconsistency bug.

Case 2: Withdrawal Security – The CEI Pattern
I audited the withdrawal flow in MonetrixVault.sol, specifically the claimRedeem function.

The Vulnerability: The function executes usdm.burn() before interacting with the RedeemEscrow contract.

Solidity
usdm.burn(amount);
IRedeemEscrow(redeemEscrow).payOut(msg.sender, amount);
The Risk: If the payOut external call fails (due to unexpected conditions), the user's tokens are burned, but they never receive the underlying USDC. This is a clear violation of the Checks-Effects-Interactions (CEI) pattern.

Recommendation: The protocol should prioritize the external interaction (or ensure atomicity) to prevent permanent loss of user funds.

Final Thoughts
Building a portfolio isn't just about finding "Critical" bugs—it's about demonstrating your ability to reason about complex systems. You can check my full analysis and PoCs in my Monetrix-audit GitHub repository.

Have you encountered similar architecture vs. bug discussions? Let's discuss in the comments!

https://github.com/rdin777/Monetrix-audit

defi, #security, #smartcontracts, #solidity