Valkyri
@ValkyriSecurity
Followers
592
Following
707
Media
27
Statuses
145
Security built from the ground up - infrastructure, on-chain, and every layer in between. DM us to get started!
Joined May 2025
🧵 Introducing Fullstack Audits 1/ 99% of “audits” in web3 only check smart contracts. But attackers don’t respect boundaries. And that’s why “audited” projects still get hacked. 👇
4
15
85
our team is cooking 🔥
🚨We at @ValkyriSecurity are working on a tool which analyzes "Crypto Wallet Extension" and audits: - Wallets configuration - Supply chain security and - AI based scanner utility Gonna change how wallets are trusted. Stay tuned, LFGO🔥
0
2
10
🔐ALPHA DROP : Your Code Is Audited, Your Keys Aren’t: Why Drains Keep Happening to Web3 Builders and Users https://t.co/7utC6Qeiex
blog.valkyrisec.com
Private keys represent the ultimate authority in decentralized systems. They control assets, sign transactions, authenticate identities, and anchor an individual’s entire on-chain reputation. Once a...
1
2
7
🚨React Server Component has discovered more CVEs : - CVE-2025-55184 (DoS) - CVE-2025-67779 (DoS) - CVE-2025-55183 (Source code disclosure) Versions affected : 19.0.0, 19.0.1, 19.0.2, 19.1.0, 19.1.1, 19.1.2, 19.1.2, 19.2.0, 19.2.1 and 19.2.2 of: - react-server-dom-webpack -
react.dev
The library for web and native user interfaces
0
1
6
Vercel/Next.js has released a security fix plugin for the CVE-2025-66478. The vulnerability originates in the upstream React implementation CVE-2025-55182. https://t.co/s0TBMLa2HX
github.com
One command to fix CVE-2025-66478 (React 2 Shell RCE) in your Next.js / React RSC app. - vercel-labs/fix-react2shell-next
🚨Critical Security Alert : CVE-2025-55182 allows Pre-auth RCE on React Server Components. Affected: versions 19.0.0, 19.1.0, 19.1.1, 19.2.0 of - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack plus Next.js, Vercel, and similar frameworks which
0
0
5
🚨ALERT : USPD PROTOCOL EXPLOIT Don't buy USPD and revoke all approvals to the USPD (0x1456688345527bE1f37E9e627DA0837D6f08C925) Root cause: The attacker front-ran the initialization process on Sept. 16 using a Multicall3 transaction. The attacker jumped in before the
🚨 URGENT SECURITY ALERT: USPD PROTOCOL EXPLOIT 🚨 1/ We have confirmed a critical exploit of the USPD protocol resulting in unauthorized minting and liquidity draining. Please DO NOT buy USPD. Revoke all approvals immediately.
0
1
11
🧵 Introducing Fullstack Audits 1/ 99% of “audits” in web3 only check smart contracts. But attackers don’t respect boundaries. And that’s why “audited” projects still get hacked. 👇
4
15
85
Holy shit, dependency confusion/takeover/injection (supply chain) has been the attack of year 2025. Remove the extensions immidiately : Open VSX: - bphpburn.icons-vscode - tailwind-nuxt.tailwindcss-for-react - flutcode.flutter-extension - yamlcode.yaml-vscode-extension -
🚨 GlassWorm is back. 24 fake VS Code and Open VSX extensions are stealing developer credentials — spreading through popular names like Flutter, React, and Tailwind. The malware hides its control data on the Solana blockchain and runs Rust implants on both Windows and macOS.
1
1
9
🎉ETH FUSAKA is live. Here are all the key EIPs you should know : EIP-7594 (PeerDAS): Nodes sample L2 data fractions instead of full downloads, enabling 8x blob capacity. EIP-7823: Sets upper bounds on MODEXP precompile to prevent gas abuse. EIP-7825: Caps transactions at
0
3
10
🚨Critical CVEs found in React server components and CLI: CVE-2025-55182 : https://t.co/5xh91es4ha CVE-2025-11953 :
0
1
5
🔐 At @ValkyriSecurity, we specialize in fullstack web3 audits covering contracts, off-chain infra, frontend. Need help securing your stack. DM us or email us at sec@valkyrisec.com for audits.
0
0
5
🛡️Wake-up call : Web3 security is fullstack. Your frontend is your new attack surface, directly linked to your protocol’s keys and governance. Treat it with the same care as your contracts.
1
0
5
✅Mitigation : Upgrade to patched versions - 19.0.1, 19.1.2, or 19.2.1 and ensure your framework applies patches. Disable unneeded public Server Functions endpoints. Rotate all secrets. Cloudflare and others have mitigation rules.
1
0
1
💥Web3 Impact : Compromise here means - Stolen deployer/API keys - RPC creds (Infura, Alchemy) - Subgraph tokens - Admin panel access and all leading to governance attacks, unauthorized upgrades, pausing, and treasury thefts.
1
0
2
🐛The bug lives in React’s Flight protocol which streams component data from server to client. Malicious POST requests to exposed Server Functions cause unsafe deserialization, letting attackers run any JS code on your server resulting in remote code execution
1
0
2
🚨Critical Security Alert : CVE-2025-55182 allows Pre-auth RCE on React Server Components. Affected: versions 19.0.0, 19.1.0, 19.1.1, 19.2.0 of - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack plus Next.js, Vercel, and similar frameworks which
2
2
7