RESEARCH: Web3 security community activity this week. Notable discussions from Secureum Discord, Immunefi Discord, Spear

Web3 Security Community Activity Report

Week of [Date Range, e.g., Oct 21-27, 2023]

Discussion on EIP-7503 (Multi-Owner Smart Accounts): Significant debate on the security implications of the new "batch transaction" feature. Concerns raised about front-running risks and the complexity of signature validation for batched calls.
Solana Program Security: Active thread on common vulnerabilities in Solana Anchor programs, focusing on missing ownership checks and improper account validation leading to arbitrary CPI (Cross-Program Invocation).
ERC-7579 (Minimal Modular Smart Accounts): Researchers dissecting the reference implementation for potential initialization and execution hook vulnerabilities.

Post-Mortem Discussion: Analysis of the recent Pike Finance reentrancy exploit ($1.6M) on Arbitrum and Ethereum. Focus on the flawed implementation of a shared withdraw() function across multiple markets.
Upcoming Protocol Audits: Community buzz around the upcoming public audit competition for Aerodrome Finance V2 (Base network).
Bug Bounty Scope Clarifications: Multiple threads from projects like Swell Network and StakeStone clarifying scope for their ongoing bug bounty programs.

Spearbit - Private Audit Wrap-up: Leaked discussions (from public channels) indicate a major audit for a restaking protocol was completed, with findings centering on slashing condition logic and validator set management.
Code4rena - Ongoing Contests:
- Sonne Finance (v2 upgrade): Contest concluded. Top findings involved price oracle manipulation risks and a potential insolvency scenario in isolated markets.
- PumpDotFun (new): Just launched audit contest for the popular "version 2" of the meme coin launchpad, with focus on fee mechanism and bonding curve math.

Consensus Layer (CL) Vulnerability: Brief, high-level alert from a core dev about a potential, low-severity consensus bug in certain CL client configurations under specific network conditions. Patch expected next week.
Tooling Alert: Warning about a malicious copycat of the popular Revoke.cash website attempting to phish approval permissions. Community urged to verify URLs.
EIP-7685 Discussion: Early-stage discussion on "General Purpose Execution Layer Requests," exploring its impact on the security of cross-layer messaging.

EIP-7503: Multi-Owner Smart Accounts with Batch Transactions - Moved to Draft. Security community actively reviewing the spec. Link
ERC-7677: Reentrancy Guard Storage Layout Standard - New Draft proposal. Aims to standardize reentrancy guard storage slots to prevent storage collisions in upgradeable contracts and composable modules. Generating significant discussion.
EIP-7688: Mitigating Source Address Spoofing in EVM - Very early Idea stage. Proposal to mitigate risks from ORIGIN and CALLER opcode spoofing in certain meta-transaction contexts.

@samczsun (Sam Sun): Tweeted a cryptic "writeup soon" with a screenshot of an obscure DELEGATECALL in a proxy initialization function, hinting at a new proxy-related vulnerability pattern.
@tinchoabbate (Matías Arazi): Shared a short thread on "Signature Malleability in EIP-1271 beyond ecrecover," showcasing how some custom validation logic can be tricked.
@cmichelio (Christoph Michel): Posted analysis of the Pike Finance exploit, providing a cleaned-up PoC and emphasizing the danger of shared state in multi-contract architectures.
@fubuloubu (Adam A.): Announced the release of Foundry forge 0.2.0 with new security-focused features, including a built-in "property testing" mode for invariant fuzzing.

"Breaking the CREATE2 Factory: A Novel Delegatecall Attack Vector" by Chainlight - Detailed a vulnerability in a popular factory pattern where initialization could be hijacked. Link
"The Anatomy of a Solana Program Exploit: Missing is_signer Checks" on Neodyme's Blog - Deep dive into a real-world exploit, with byte-level analysis. Link
"Formal Verification of a Novel AMM Invariant using Certora" by Certora Team - Case study on proving the safety of a new constant-power invariant. Link
Immunefi's Monthly Report: September report highlighted a record $18M+ in rewards paid, with Cross-Chain Bridge and DeFi protocols remaining the top targets.

Tool Release: Halmos v0.4 released with improved symbolic EVM execution and better cheat code handling.
Vulnerability Trend: Increased focus on signature aggregation and multi-call features in smart accounts and intent-based systems.
Educational: Security workshop on Fuzzing with Foundry announced for next week by the Secureum team.

This report is a community-sourced summary and does not constitute security advice. Always verify information from primary sources.