Daniel Von Fange DanielVF

External partners & security tooling

Here's my opinionated philopshy on external audits and security providers. This is very specific to our current position - it's not the approach for every project.

1. Internal expertise

We should never rely on external partners for our security. External partners provide additional checks, but if they find a critical, we aren't doing our job as we should be. If we miss something real and anyone downstream catches it, we should prioritize adjusting our processes to ensure that that category of issue is caught internally, every time in the future.

Some parts of the code matter more than others. We have a contract architecture that means that big pieces of our system of contracts can't lose user funds from a bug, and thus have lower security requirements. Other parts have well known interfaces which mean as long as that one or two guarantees hold, the rest can do minimal damage.

This vis code is not generalized - you will need to change it to extra the code you want.

Get changes:

git log --pretty=format:%H --reverse NAMEOFBRANCH -- contracts/vault/VaultCore.sol | xargs -n 1 -I {} git show {}:contracts/contracts/vault/VaultCore.sol | grep -A 150 'function NAME_OF_FUNCTION' >versions.txt

python animate.py

From: REDACTED

Hello Team, Hope you are doing well!

Vulnerable URL:

https://github.com/OriginProtocol/origin-dollar/blob/master/contracts/contracts/strategies/CompoundStrategy.sol

	#!/opt/homebrew/bin/fish

	# Usage:
	# ./compare_live.fish CONTRACT_ADDRESS

	# Config
	set SRC_DIR /PATH/TO/REPO/CONTRACTS
	set OZ_DIR $SRC_DIR/node_modules

	# Download

	// SPDX-License-Identifier: MIT
	pragma solidity ^0.8.0;

	/**
	* @title OUSD Vault Contract
	* @notice The Vault contract stores assets. On a deposit, OUSD will be minted
	and sent to the depositor. On a withdrawal, OUSD will be burned and
	assets will be sent to the withdrawer. The Vault accepts deposits of
	interest from yield bearing strategies which will modify the supply
	of OUSD.

	pragma solidity >=0.8.17;

	// Cursed ERC20 that does everything in events.
	// by @danielvf, based solmate by @transmissions11

	abstract contract ERC20 {
	event Transfer(address indexed from, address indexed to, uint256 amount);
	event Approval(address indexed owner, address indexed spender, uint256 amount);

	string public name;