CVE-2023-34459 : OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the `verifyMultiProof`, `verifyMultiProofCalldata`, `procesprocessMultiProof`, or `processMul... cve.report/CVE-2023-34459

Recently, we received this report from Daniel Cohen Hillel and we can't understate how good it was The issue affects trees with a "0" node at depth 1, also prevented if you're using complete trees from the OpenZeppelin Merkle Tree library A security advisory was published accordingly

Pushed fix to Solady MerkleProofLib for multiproofs. Thanks!

Exposing a critical vulnerability in OpenZeppelin 's Merkle tree implementation is great, but the real alpha is in how Daniel Cohen Hillel generated those beautiful animations

Really cool finding from the repo that we thought can never have bug 👍

Introducing HijackedAI . com create an agent - give it sys prompt, a money to hold, and a deadline People can pay to try and convince it to send them the money. Failed attempts stacks in the pool till time’s up. No one broke it - you win prompt wizards, it's time to prove it

Introducing AI Key, a small device that lets AI control your entire phone. just plug it in and ask it to complete a task. pre-order now.

What happens when you open Schrödinger's box not all at once, but gradually? We answered this experimentally- and the answer isn't what anyone expected. 🧵