SmartState blog

December 9, 2022

What is SRS?

SRS (Software Requirement Specification documentation) is a type of document which describes how the software is required to be written. It includes an in-depth description of the system or software in question, which makes it different from the SyRS (System Requirements Specification), which only presents data with regards to the system or software requirements. It is usually made ‘once and for ever’. Different people are ...

Read more
December 5, 2022

Crypto phishing attacks: CertiK deceptive copycat site example

Surfing the web in search of Ankr audits (see the Ankr hack review by the SmartState team) we found a strangely duplicated CertiK page: Looking more closely, we realized that we had come across a fraudulent phishing copycat site mimicking CertiK, cerLik - cerlik.com.We wrote to CertiK but got no reply, so we decided to inform the community ourselves and wrote a short article about phishing, using the fake site as an example.What a phishing ...

Read more
December 4, 2022

Framework: Anchor

Anchor is a framework which allows users to create secure projects on Solana and develop smart contracts in Rust for the Solana blockchain. It helps to do it quickly thanks to a number of boilerplates (e.g. account serialization and deserialization or instruction data). It also offers security checks and keeps them separately from the business logic. This allows developers to decrease the time spent on working with raw code and focus on the ...

Read more
December 3, 2022

Ankr hack review by SmartState team

Ankr, a Web3 infrastructure provider, was hacked on December 1st. The loss amounted to approximately $5.5M. Seems the attacker somehow gained access to Ankr's deployer private key.Shortly before the hack, Ankr had performed project updates. The private key could have been compromised during those updates, or the attacker could have gotten access to the key earlier and just used that moment to execute the attack.Source: linkThe malicious ...

Read more
December 2, 2022

What is PASTA threat modeling method

PASTA (Process of Attack Simulation and Threat Analysis) is a ‘risk-centric’ threat modeling method, aimed at helping objectives meet technical requirements using a large range of tools. PASTA brings about an attacker-centric perspective and makes an asset-centric output in the form of threat enumeration and scoring. It makes the threat modeling process even more effective by means of requiring security input from operations, ...

Read more
November 27, 2022

White Box testing method

The White box (Open box, Transparent / Clear / Glass box, structural testing) is a testing method where security, usability and input-output flow of the internal structure of a system, its design and code are checked. The code is ‘open’ (visible) to testing specialists using this method. It concerns the inner works of applications and revolves around internal tests.White box testing involves a series of inputs verified against ...

Read more
November 20, 2022

Black Box testing method

What is ‘Black box’? Black box (Opaque, Closed box, Function-centric) is a testing method that examines the functionality of an application without peering into its internal structures or workings. This method of testing can be applied virtually to every level of software testing: unit, integration, system and acceptance. It is sometimes referred to as specification-based testing. It is a powerful method, which is used to test ...

Read more
November 8, 2022

What is: cross-chain bridge

A cross-chain bridge is a protocol that connects blockchains and testnets and enables users to transfer their tokens, data and other assets from one network to another, including both 1 and 2 level chains and sidechains. It also allows transfer of smart contract instructions between blockchains. They may differ in protocol or execution models, but any bridge aims at building a convenient and secure connection, helping avoid complications ...

Read more