0xdalis

What I learned during preparing and auditing @MakerDAO on @sherlockdefi for 45 days, long post: - Finally learned @MakerDAO: It was like a mysterious, massive protocol for me for a long time—the granddaddy of DeFi—but I finally got it. - The notorious schema isn't scary anymore. I can even explain it now - Reading docs and code side by side makes it much easier to understand the codebase. It was really hard to grasp the meaning from just text alone. - It took me about a week to grasp the Maker docs and Endgame. I used ChatGPT and Claude extensively to explain every term until I memorized them. This could be helpful in other contests too, but they sometimes hallucinate, so I can’t rely 100% on them. - Otherwise, I would have had to stop and remember what `flap`, `flop`, `flip`, `cat`, `dog`, `kick` mean. GPTs helped by adding terms in parentheses like "it calls dog.bark (liquidation)." - For me, half of the complexity in understanding Maker was the terminology. - ChatGPT also helps translate complex math/scientific language into more readable versions. - Comments in the code or documentation would have helped me speed up my learning significantly. - Overall, I see beauty in Maker's code/vars style, but it slows others down. I’m not sure I’d use it in my codebase—better to use normal names. - Learned about subDAOs—an interesting concept. - Learned about IOU tokens to re-vote with the same votes. I hadn’t thought about this concept before. - Learned about the world of RWA (Real-World Assets), which is a bit different from pure DeFi. - Maker dashboards/data: - dune.com/steakhouse/makerdao - makerdao-governance-dashboar… (you can see how much is delegated) - Learned how to better structure my notes and thoughts in Obsidian, adding inner deep note links to blocks to avoid repetition. - This helps a lot with big contests. It might be a waste of time for smaller ones. - The notes were incredibly helpful; otherwise, I would have wasted an hour or two reunderstanding the same functions. - Example in my blog 00xsev.github.io/homepage/de… - Gained the motivation to create a website. - I think experience teaches you where *not* to look, rather than where to look more. - I was stuck on this formula: X * fee / (1 - fee). The idea is to calculate the fee based on the gross amount rather than the net amount. It's like figuring out how much to deduct so you end up with X. - For example, similar to some taxes, if you need to have a net amount of 40k, you need to pay a certain amount in taxes. So, your gross salary before taxes should be 40k plus the fee. - To calculate the fee, you use the formula 40 * 1.30 / (1 - 0.30). - github.com/sherlock-audit/20… - Learned how to use explorer.sim.io (renamed from EVM.storage) to see storage slot changes, e.g., how to see votes for a new `hat` (upgrade) grow: explorer.sim.io/eth/20432282… - @smlxldotio - Learned how to cache tests; you just need to add the block number to `vm.createSelectFork(ETH_RPC_URL, BLOCK_NUMBER);` - But Infura doesn’t work with old blocks, so it’s better to use Alchemy, public nodes, or update the block from time to time. - I sped up tests from 90 seconds per run to 1 second. - Maybe also disable the optimizer. - Played more with @DuneAnalytics: - How often `maker.pot.drip` is called (rewards accumulated): - dune.com/queries/3948662 - dune.com/queries/3948665 - How often `dog.bark` (liquidations) is called: - dune.com/queries/3957382 - Learned how `create2` calculates addresses - github.com/sherlock-audit/20… - Setting up work/tools for Solidity: - Learned how to remap Sherlock projects with several subprojects (sub git repos) to create tests using several subfolders, or to make "Tools for Solidity" work properly. You can add `subfolder:src/=subfolder/src/` to fix `import from "src/x.sol"`. - Exclude `/test`, `/lib`, `/out`, `/deploy` in `.vscode/settings.json`. - Understood why liquidation works in two steps: - First, increase the price for collateral. - (To make sure we cover all debt, or at least as much as we can.) - Then decrease the amount of collateral. - (We know we’ve covered as much as we can, so maybe someone is okay with getting less collateral now.) - We make sure to cover our debt quickly, then we take time to ensure we give the least possible collateral. - Gained motivation to reread a long list of external checklists (created by others) and organize them. - Learned how to extract slides from a video (ffmpeg). - Went deeper into UUPS, and UUPS vs. Transparent. (00xsev.github.io/homepage/de…) - Learned the formula to get the amount of token2 to supply given an amount of token1 to get a perfect 50-50: - github.com/sherlock-audit/20… - 00xsev.github.io/homepage/de… - Discovered `gitlens.heatmap` to see when the code was changed. I can see my comments added in the code marked with a colored line on the left. - Finally learned how to debug in Foundry—not the best debugger, but it helped me find the reverting reason more easily. - `--debug 1`, then `G`, to find the line where the revert happened. - No need to type the whole test name, just a substring to match. I usually use a number. - Don't assume that code on GitHub is the same as on-chain. Not the case for Maker. - For example, `chief`. I lost 2 or 3 hours trying to understand why it was reverting. - Uniswap V2 fee is always 0.3%, but they can change how much goes to LPs and how much to the protocol: - blog.uniswap.org/uniswap-v2#… - Uniswap v2 has a callback to the receiver: - rareskills.io/post/uniswap-v… @RareSkills_io - Unchecked/Yul div and modulo 0 will return 0 [ref](github.com/AmadiMichael/LowL…). - We can't use both an EOA and a contract to control an address, like if we find a collision: - See ethereum.stackexchange.com/a… - That song played constantly in my head, "Dogs Were Barking": youtube.com/watch?v=T8DNTvil… --- How I would learn Endgame if I were starting from zero: - youtube.com/watch?v=A1igTqpo… -- Gold. @Unchained_pod, about Endgame with @RuneKek. - Got me excited about the @MakerDAO audit. @laurashin is a great host. The update felt massive, could lead to a giant DAO summer. Somewhat feels like the Foundation series. - endgame.makerdao.com - A lot to absorb. Better to read after the main docs. - [How Does DAI & MakerDAO Work? | DeFi 101 - YouTube](youtube.com/watch?v=0a7W7s0K…) by @0xowenthurm. If you don’t have much experience auditing lending protocols. - [ETHDenver Presentation | MakerDAO: Endgame - Restoring Balance to a Decentralized Workforce by Retro - YouTube](youtube.com/watch?v=GgNrJ7iz…) -- Nice summary of Endgame by @0xretro. - [Debating the MakerDAO Endgame | Vance Spencer, Mark Phillips, and Hasu - YouTube](youtube.com/watch?v=Sb3WPcG7…) -- Read the summary; I read the transcript a long time ago. - Okay intro; you can skip what you don't understand, mostly at the end: drive.google.com/file/d/1VtG… - To understand MakerDAO itself: - [How Does DAI & MakerDAO Work? | DeFi 101 - YouTube](youtube.com/watch?v=0a7W7s0K…) -- by @0xowenthurm. If you don’t have much experience auditing lending protocols. - [MakerDAO on Solidity Fridays | Solidity Fridays - YouTube](youtube.com/watch?v=mH2WCbu7…) by @SolidityFridays -- Okay, but it’s better to open the glossary on the side; they missed that all the functions are explained there. Interesting high-level dive into vat.sol. Fun. - `bytes32` saves gas vs. `string` because it’s not dynamic, but fixed at 1 word size. - Mostly docs + code. Also, if you want to go really deep into the code, check out my deep dive. It may be better to read it side-by-side with the code: 00xsev.github.io/homepage/de…. If you like this post please consider following me. I plan to do deep dives and share "what I learned" after big audits, and I aim to post valuable information for SRs/devs daily.