CharaD7

// PoC: ens-metadata-service avatar/header image fetch can be turned into a
// self-referential request-amplification loop (DoS on metadata.ens.domains).
//
// Chain (all verified against the repo + the exact npm deps it pins):
//   1. Attacker owns a name and sets its avatar text record to
//      https://attacker.example/redir, where /redir 302-redirects to
//      https://metadata.ens.domains/mainnet/avatar/<attacker-name>.
//   2. A victim (anyone, including another app that renders avatars) requests
//      https://metadata.ens.domains/mainnet/avatar/<attacker-name>.
//   3. src/service/avatar.ts:107-115 calls abortableFetch(avatarURI). That is

CharaD7

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.27;

import { IDisputeManager } from "@graphprotocol/interfaces/contracts/subgraph-service/IDisputeManager.sol";
import { DisputeManagerTest } from "./DisputeManager.t.sol";

/**
 * PoC: Indexer permanently shields a fault from ever being disputed.
 *
 * Indexing dispute ID = keccak256(abi.encodePacked(allocationId, poi, blockNumber)).

CharaD7

// SPDX-License-Identifier: AGPL-3.0
pragma solidity ^0.8.20;

import {Test, console2} from "forge-std/Test.sol";

/// Minimal, faithful reproduction of the DEPLOYED Aave RewardsDistributor index math
/// (aave-v3-periphery RewardsDistributor, mainnet INCENTIVES_IMPL 0x0ee554F6, Sourcify
/// exact-match verified). The deployed _getAssetIndex is:
///   firstTerm = emissionPerSecond * timeDelta * assetUnit / totalSupply
///   newIndex  = firstTerm + oldIndex

CharaD7

// SPDX-License-Identifier: AGPL-3.0
pragma solidity ^0.8.20;

import {Test, console2} from "forge-std/Test.sol";

/// @notice Reproduces the SC-1569 half-up rounding extraction math on DEPLOYED SparkLend
/// (pool 0xC13e21B648A5Ee794902342038FF3aDAB66BE987, pool logic 0x5aE329203E00f76891094DcfedD5Aca082a50e1b,
/// last upgraded 2024-04-08). The deployed WadRayMath uses half-up rayMul/rayDiv
/// (adds HALF_RAY before dividing). At a fractional liquidity index, choosing amounts whose
/// remainder sits on the half-up boundary lets a user mint scaled units worth more than the

CharaD7

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

import { Test } from "forge-std/Test.sol";

/**
 * PoC (mainnet fork): USDtbMinting.redeem() is permanently bricked.
 *
 * Deployed USDtb (AnchorageTokenUSDtb at 0xc139... via impl 0x9d6d77...)
 * deprecated burnFrom() to ALWAYS revert Deprecated(). USDtbMinting.redeem()

CharaD7

PoC - Chainlink Node: Unauthenticated LOOP-plugin pprof / metrics / discovery

Bug

The Chainlink node's API server registers the LOOP-plugin debug endpoints (/discovery, /plugins/:name/metrics, /plugins/:name/debug/pprof/*, /plugins/:name/debug/pprof/symbol) on the public, unauthenticated API group. Anyone who can reach the node's API port can pull a running plugin's real Go pprof profiles (heap/allocs/goroutine/CPU) and Prometheus metrics with no credentials, enumerate running plugins via /discovery, and drive CPU-DoS via

CharaD7

The initial source comes from sdcuike/issueBlog#4

http://greenteapress.com/wp/

https://papers.nips.cc

https://github.com/PacktPublishing free to download books code by Packet

https://github.com/EbookFoundation/free-programming-books Very immense

CharaD7

[alias]
        i = init
        f = fetch
        pr = fetch origin +refs/pull/*/head:refs/remotes/origin/pr/*
        cl = clone
        
        rao = remote add origin
        rso = remote set-url origin
        
        acm = "!f() { git add . && git commit -m \"$(echo $@)\"; }; f";

CharaD7

{"lastUpload":"2020-09-03T08:25:59.907Z","extensionVersion":"v3.4.3"}

CharaD7

[alias]
        acm = "!f() { git add . && git commit -m \"$(echo $@)\"; }; f";
        c = checkout
        com = checkout master
        cob = checkout -b
        b = branch
        
        # Delete branches.
        # -d for normal delete, -D for forced delete
        # Example g bd branch_name OR g bD branch_name