/biz/ - Business & Finance

https://twitter.com/spreekaway/status/1295788578962837504

2/x I am not a security expert, this is nowhere near a substitute for a real professional audit, even following all of these steps you are at extreme risk whenever touching one of these pools. Do not put more than you can lose into any ETH smart contract.

3/x The first important thing you need to do is find the contract you will be interacting with. Sometimes this is easier than others. Often the best technique is to find the token you will be farming on etherscan, then look at the top holders.

/x Once you find the contract address on etherscan, you want to click on contract then look at the code. What I usually do is use https://diffchecker.com/diff to compare with the most similar "tested" contract (e.g. from SNX, YFI, YAM, etc.).

5/x What is usually ok to see: variable name changes, date/timing/supply changes, token contract address changes. What you don't want to see: upgradable contracts, a lot of new complicated logic, weird changes that you can't understand the purpose of, etc.

6/x Ok, so the contract looks good, so I can just head over to the website and throw in my life savings, right? WRONG. Regardless of the contract, we must keep in mind that a frontend can change the contracts you are interacting with at any time.

7/x An unscrupulous dev could even randomize or specifically target high value accounts connecting to his website to reduce the chances of others calling the alarm. This frontend attack is obvious, extremely easy to execute, and really only a matter of time before it is done.

8/x You have two options to protect yourself: 1) check the address of each and every transaction being sent from the front end and make sure it matches the contract address you already looked at, 2) do all contract interactions manually from etherscan.

thought this might do some good for ya'll