Getting started with smart contract in Bug Bounty

This guest blog post explains smart contract security fundamentals and walks through a real-world bug hunting session where an overridden ERC20 transferFrom in AxonsToken lacked proper authorization checks, allowing an attacker to move arbitrary user balances into the auctionHouse and then to an attacker-controlled address; the author demonstrates a working PoC on a Rinkeby mainnet fork and recommends enforcing sender/msg.sender checks or explicit auctionHouse authorization as the fix.