OpenZeppelin’s Post

View organization page for OpenZeppelin, graphic

11,090 followers

📝 MUD The MUD system [https://lnkd.in/g-cwDuFW]  provides a cohesive range of standard and extensible functionality to quickly develop blockchain applications. It compresses the complexity of building EVM apps with a tightly integrated software stack that handles data storage, upgrades, delegations, etc. The central component of the MUD system is the STORE, which is a contract that behaves like a database. All persistent storage is presented as a set of tables, and the STORE contract takes care of mapping this structure to the linear EVM storage layout. Although the STORE contract provides the basic database functionality, it will typically be extended to provide higher-level abstractions for users and developers. One such extension is the WORLD contract (in conjunction with the CORESYSTEMS contract) which provides generic and flexible mechanisms for many standard features. We found 32 issues including 2 Critical’s and 6 Medium’s: 🔴 Critical Severity: - Namespace Access Can Be Backdoored - Core System Can Be Disabled 🟡 Medium Severity: - Incorrect Hook Parameter - REQUIREINTERFACE Is Incorrectly Specified - Sliced Bytes Are Cut Off - Memory Corruption on Load From Storage - REGISTERFUNCTIONSELECTOR Can Be Front-Run and DoS'ed - Misleading Documentation 🟢 Low Severity: - Missing Table Registration - Off-Chain Indexers Can Lose Track of On-Chain State - Namespace Balance Transfer Value Can Be Lost - Delegation Can Be Misconfigured - Deployment Edge Case - Incorrect ERC-165 Interface - Incomplete Table Validation - Incomplete Module Access Control - Incomplete Resource ID Validations - Inexplicit Revert - World Resource ID ROOT String Has Unexpected Length - Override Removes Supported Interface 👀Read the full report at https://lnkd.in/gSW3ezyE 👩💻Interested in searching vulnerabilities in world class code? Join our team: https://lnkd.in/dndAUNYA #web3 #blockchain #defisecurity #blockchainsecurity #openzeppelin #defi #hiring #remote #applicationsecurity #technology #ethereum #smartcontracts 🚀

MUD Audit

MUD Audit

blog.openzeppelin.com

To view or add a comment, sign in

Explore topics