The CTF MOVEment is a major Move security competition for security professionals and developers who are interested in the Move language and the Move ecosystem. Sponsored by Aptos Foundation and hosted by MoveBit on 10–12 December, the CTF consisted of 5 challenges and attracted a total of 102 participants around…

On Oct 18th 2022, the blockchain security team at Amber Group discovered a critical vulnerability in two Mai Finance’s vaults (SCSEMVT and YCSEMVT). This vulnerability would allow an attacker to manipulate the collateral price, borrow all the funds from the pool, and walk away with bad debts. We reported the…

The MoveCTF is a major Move security competition for security professionals and developers who are interested in the Move language and the Move ecosystem. Sponsored by Sui Foundation and hosted by MoveBit on 5–7 November, the first MoveCTF consisted of four challenges and attracted a total of 345 participants around…

Introduction In the early 1800s, the five sons of Mayer Rothschild branched out from their base in Frankfurt, establishing branches in London, Paris, Vienna, and Naples. They built out an information network, using carrier pigeons, couriers, and chartered boats to shuttle information across Europe faster than anyone else. Through this network…

Introduction Over the past decade, blockchains have risen to become the leading form of distributed ledger technology. Despite their current dominance, however, a growing number of projects are proposing alternative solutions to solve certain scalability issues inherent to blockchains. One of these proposed technologies is the DAG, or Directed Acyclic Graph…

On 20 Sep 2022, a tweet indicated that Wintermute had been hacked for ~$160M . One day after, in a follow-up tweet, the victim stated that the attack was linked to Profanity-type exploit. After some preliminary research, we were able to see that the victim’s EOA account 0x0000000fe6a514a32abdcdfcc076c85243de899b was compromised…

Introduction Over the past two years, there has been an explosion of new smart-contract-enabled distributed ledgers which aim to address the perceived shortcomings of Bitcoin and Ethereum. These “alt layer 1s,” or “alt L1s,” as they’re commonly referred to, typically offer new architectures and make different design trade-offs to increase the…

Paradigm CTF is one of the most challenging Web3-focused security competitions — amazing for blockchain security folks, this competition consists of challenges created by some of the brightest minds in the field. The blockchain security team at Amber Group participated as team Amber_Labs and ranked #6 from a total of…

1. Introduction Zero-knowledge proofs allow one party to prove to another party that a given statement is true without revealing any additional information. Naturally it could be leveraged to protect privacy, proving some transactions are valid while hiding all the details. Another important property of certain ZK protocols — such as STARKs…