Keyword šš ļø
@xKeywordx
Followers
531
Following
1K
Media
110
Statuses
3K
Reviewing smart contracts and making Web3 safer one protocol at a time | SR @NethermindSec
Joined September 2021
--- Real Talk --- "If I want to be a Web3 Security Researcher, where should I start?" I get this question pretty often from people who want to go full-time into Web3 security. I feel humbled by the question every time because I'm not like some of the people out here who make
12
32
175
Banger, but I'm afraid it's closer to reality than we think.
Last quarter I rolled out Microsoft Copilot to 4,000 employees. $30 per seat per month. $1.4 million annually. I called it "digital transformation." The board loved that phrase. They approved it in eleven minutes. No one asked what it would actually do. Including me. I
1
0
2
@samczsun @SEAL_911 @tayvano_ @pcaversaccio @_SEAL_Org But mostly I'm grateful that public goods like https://t.co/6TZSGS1W5M and especially @_SEAL_Org exist.
revoke.cash
Take back control of your wallet and stay safe by revoking token approvals and permissions you granted on Ethereum and over 100 other networks.
4
8
143
I think the reason for this is, we (the Web3 sec people) evolve every year. We learn new attack vectors, build different mental models, etc. If you audit {protocol} today you may find X bugs. If you audit {protocol} again 3 years from now, after learning a lot of new things in
> In 2026, the crypto industry should adopt annual re-audits as the fourth step in securing a protocol. Our recent finding during a re-audit ( https://t.co/UcOFSwyFWB) proves that highly security focused teams like @avax are already adopting this approach and it works
0
0
1
Okay, 2025 is almost over and I was thinking yesterday about "what did I learn this year?" I'll write down all the things that I can remember on the top of my head. I'm doing this because this just goes to show how much you need to learn if you want to stay relevant.
github.com
Why are you blindly signing? Stop it. Get some help. Get wise. Wise Signer. - Cyfrin/wise-signer
0
0
0
Is it just me, or is ChatGPT's "Thinking" model unusable lately?? By lately, I mean last ~4 weeks. I hoped that it would "go away" but it doesn't. The model spends ~12-15 mins before answering my queries, and then I get something like: - stopped thinking - network connection
1
0
3
They both got downgraded to High ... I did not escalate any of them, but I guess others did, and during the "dispute period" severity changed, although the initial comment from the protocol didn't mention anything about not agreeing with the severity. It is what it is.
Both confirmed, both Critical. The protocol didn't argue the severity.
1
0
21
My comment has more views than the original post. Quality content at its finest
1
0
20
Tomorrow is Monday, so I get to audit more
Oh no, tomorrow is Monday
2
0
8
How protocols think an SR's calendar looks like for December
0
0
1
Sent it. Hope it's not some false-positive (due to me hallucinating at almost 2 AM) or an "already known/acceptable risk" type of thing. We'll see
Ok, it's 1AM and I'm grinding the @aave V4 competition on @sherlockdefi and I think I might've found something. Sending it soon š @0xSimao
0
0
10
Ok, it's 1AM and I'm grinding the @aave V4 competition on @sherlockdefi and I think I might've found something. Sending it soon š @0xSimao
1
0
35
Both confirmed, both Critical. The protocol didn't argue the severity.
They were escalated last week by the protocol (I think). Waiting for either "Confirmed" or "Closed" status update. Pretty sure they're valid though.
12
2
81
Is he clickbaiting, or did he really get fooled by Anthropic's post?
80% of auditors will be jobless in 1 year
2
0
9
After you look at the article and see that the "root cause" of the Balancer hack was ... checks notes "an authorization bug", I can confidently say that: They don't have Web3 security people in their team, so that study was (probably) made by great developers, but not Web3 SRs.
New on our Frontier Red Team blog: We tested whether AIs can exploit blockchain smart contracts. In simulated testing, AI agents found $4.6M in exploits. The research (with @MATSprogram and the Anthropic Fellows program) also developed a new benchmark:
0
1
3
Are you just trying to "farm points" for the Academy? :))
1/ Introducing The Mentorship Series https://t.co/EavHXaNBXT Iām personally mentoring a small, hand-picked group of auditors in 2026. 1st announced tmr. 3 months of 1-on-1 mentoring with me each. Targets: 0 ā 4 figures 4 ā 5 figures Step 1: Like and repost this post.
0
0
2
I checked the code, and it is as I suspected. If you looked at the `Hub::add` function, that function is not meant to be called by users directly; it is meant to be called through a Spoke. Users call the `Spoke::supply` function to add collateral and the Spoke will be calling
The ERC-4626 standard has a built-in safeTransferFrom() for deposits However, some deposit functions like Aave V4's add() make you do the safeTransferFrom() separately Why is this? What determines when to include safeTransferFrom() in the function or not?
0
0
13
They were escalated last week by the protocol (I think). Waiting for either "Confirmed" or "Closed" status update. Pretty sure they're valid though.
gm, how was your weekend? Mine was pretty busy, let's see if I got them right.
2
0
17