AI-powered platform for smart contract analysis and blockchain risk management.
Joined May 2022
- Tweets818
- Following1.2K
- Followers1.4K
- Likes985
Pinned Tweet
Thank you @pashov
Appreciate your support and look forward to evolving the tool based on community feedback.
Here is an automated (instant) report from a code4rena bot racer (they offer this as a service now).
This is crazy good IMO, 100% automated and finds some issues that might actually be of higher severity. I expect this will be a staple in audits soon.
app.auditbase.com/share/1722…
🤯 10M CYS tokens minted without authorization. Cysic suspended its bridge.
The attacker exploited a bridge-processing flaw on BNB Chain, with preliminary findings pointing to unauthorized access to a supporting database.
- The recipient address was blacklisted
- Around 2.8M CYS remained at that address, with transfers restricted
- The investigation is ongoing, and the final financial impact is still unclear
🧐 Cross-chain security goes beyond smart contracts. Bridge logic and supporting infrastructure matter, too.
buff.ly/Il08AsC
🚨 1,400+ wallets drained. Qubic had to freeze its blockchain.
The cause? Weakly generated wallet seeds, not a smart contract exploit.
The attacker stole around $1.4M by exploiting weak randomness in wallet generation.
- 87.1% of stolen funds remain frozen onchain
- MEXC froze the remaining funds sent to its platform
- Qubic replaced Math.random() with a cryptographically secure alternative
- Validators will vote on a recovery plan
buff.ly/gLCyrYi
#Web3 #CryptoSecurity #BlockchainSecurity #AuditBase
📌 ~77% of losses came from suppliers, dev tools and other components outside security reviews
📌 Smart contract bugs were the most frequent vector: 71 incidents, $228M
📌 ~33% was returned or reversed
Hacken’s advice: widen audit scope to oracles, bridges, custody and signing authorities.
🤔 Does your scope cover what attackers actually reach?
#Web3Security
buff.ly/g4pqlmY
🇪🇺 The EBA just classified USDC as the first “significant” e-money token under MiCA.
📌 Now jointly overseen by the EBA and France’s ACPR
📌 $73B in circulation vs. Tether’s $184B
Dollar stablecoins aren’t being kept out of Europe’s rulebook. They’re being brought inside it.
For platforms using USDC in the EU, regulatory status is now something to document, not assume.
#MiCA #USDC
buff.ly/jVyRHxT
Most tokenized stock trading now happens when Wall Street is closed.
📌 70%+ on BNB Chain, 63% on Solana, ~60% on Base (Blockworks, via Kobeissi Letter)
📌 SEC’s new exemption: venues must publish trade data plus liquidity pool addresses and balances
🤔 When the underlying market is shut, what does a tokenized price anchor to, and who verifies it?
#tokenization
buff.ly/sDQjw46
Pre-token. Pre-revenue. A $25K–$200K audit quote isn’t a preference you’re weighing, it’s a budget you don’t have.
That shouldn’t mean shipping blind. You can scan your contracts first: $100 in free credits, no card.👇
auditbase.com
#AuditBase
Your last audit has a date. Your code keeps changing.
New upgrades, integrations, and attack patterns can leave yesterday’s report outdated.
AuditBase helps you check where you stand today:
🔍 200+ vulnerability patterns + symbolic execution + AI analysis
📊 Clear, quantified risk scores
🔔 Continuous monitoring and alerts
Scan your code as it is now—not months ago.
Get $100 in free credits. No card required.
👉 Start your free analysis: auditbase.com
#Web3 #SmartContracts #BlockchainSecurity
Tokenized stocks trade 24/7. They're also ~1.5x more volatile than traditional stocks.
The IMF flags 3 risks as tokenized markets grow:
➡️ $65B in tokenized assets in July vs. ~$300T in global capital-market assets
➡️ 50%+ of tokenized equity trading happens outside US market hours
➡️ Lower liquidity than traditional equities
Systemic risk is limited for now. But growing leverage and interconnections could amplify fire sales, liquidity runs and contagion.
The real test isn't whether tokenized markets can scale. It's whether their infrastructure can handle the pressure when they do.
Source: buff.ly/KqnAmW1
🤓 Your audit report has a date on it. Your code doesn't.
Picture a typical launch cycle: clean report in January, then...
➡ Week 2: a fee calculation fix
➡ Week 5: a new lending integration
➡ Week 8: a dependency bump
➡ Week 11: a withdrawal flow refactor
By April, mainnet runs code the audit never saw. The report still says "clean."
AuditBase re-analyzes your deployed contracts continuously → auditbase.com
#AuditBase
🧐 Polymarket rewrote its smart contracts from the ground up. 3 audit firms, formal verification, $5M bug bounty.
Protocol V2 brings upgradeable contracts + a new OracleAggregator (UMA, Chainlink) – exactly the risk categories exploited elsewhere this year.
Complexity didn't get skipped. It got matched with scrutiny.
#Polymarket #smartcontract
Source: buff.ly/8Rp5WO7
👏 $3.8M stolen. $3.8M returned. Under 48 hours.
A bug in NEAR Intents' Omni deposit/withdrawal integration let an attacker drain funds. Team paused services, identified the attacker, gave a 48hr "responsible disclosure" deadline – full amount came back.
Compare: Liquid's return is still disputed. Symbiosis's deadline passed with nothing returned.
Full recovery, no negotiation needed.
#NEARIntents
🤔 The Bitget attackers never touched a private key.
SlowMist’s forensic report says the attackers spent weeks accessing third-party security tools before the $388M theft.
➡️ Aug. 31: hidden script accessed a security product using a stolen password
➡️ Sept. 25: another security system was accessed using a stolen employee identity
➡️ A custom tool was built to forge risk-control parameters and withdrawal requests
➡️ The first verified transfer happened at 2:31am UTC+8
Two fake withdrawal orders were rejected. The attackers kept trying until something worked.
Bitget says private keys and cold wallets were never touched. The breach wasn’t about stealing a key. It was about gaining access through systems around it.
#Bitget
buff.ly/WEWsorS
The badge satisfies the ask.
It doesn't always answer the actual question.
#AuditBase #audit #smartcontract
ALT "Just get it audited so we can raise." That request is about a badge. It's not about security.
ALT Investors want proof before they wire funds. Your community wants proof before they ape in. The pressure Both usually mean the same thing: a logo on your site that says "Audited." Nobody asked what was actually reviewed. What that pressure produces A rushed scope, cut down to fit the raise deadline A firm picked for turnaround time, not depth A report nobody outside your team actually reads A badge that satisfies the ask, without answering the real question
ALT The reaL questioNs Was the scope big enough to matter? Did it cover the functions that actually move funds? Would it survive someone asking follow-up questions?
ALT What changes with AuditBase ✔️ Full-scope analysis in hours, not months – the badge and the depth arrive together ✔️ A quantified risk score investors can actually compare, not just a logo ✔️ Findings mapped to what matters: authorization, pricing logic, external integrations ✔️ Fast enough to meet your raise timeline, thorough enough to mean something once you have it Get a real scan, on your timeline. auditbase.com
🤔 Same stolen funds. Two protocols. Two opposite answers.
THORChain: no selective freezing, no address blacklist by design.
NEAR Intents: built SHIELD, blocked $50M+ tied to the Bitget hack, froze $503K mid-execution.
"Permissionless" and "neutral to stolen funds" turned out to be two different choices.
Source: buff.ly/qcPK7hn
#NEARIntents #Bitget
Fixed-rate credit markets. UUPS upgradeable proxies. Aave-integrated yield. Rheo's architecture had a lot of moving parts before their mainnet launch, and a single bug in the pricing flow could've meant drained user funds.
Here's how we helped them validate it. 👇
#AuditBase
☝🏻 Bitget is restoring withdrawals after a $388M security breach.
The Sept. 24 incident affected part of its hot and warm wallet infrastructure, while cold wallets remained secure.
BTC withdrawals are back, with ETH and USDT to follow as security checks continue.
Meanwhile, the attacker is moving stolen crypto, including swapping ETH for Bitcoin through THORChain.
THORChain says it cannot selectively freeze specific funds or swaps.
Source: buff.ly/Rizo1GY
#Bitget #Bitcoin
🤔 Attackers found the flaw first. This time, someone else moved faster.
White hats raced to secure Bitcoin exposed by the Coldcard entropy flaw – before the theft, not after.
🌟 Nick Bax (SEAL 911) rescued ~50 BTC in July. Galaxy confirmed 52.37 BTC more this week – 40% of wave 2 – now in a Wyoming trust for victims.
No negotiation. No disputed bounty. Just moving first.
Running total: 1,830 BTC, 9,162 addresses.
Source: buff.ly/fF1ZIlk
🤓 Tokenized stocks just got a new backing model.
Ondo now lets approved institutions convert real stocks & ETFs directly into onchain tokens.
Shares in → tokens out → redeem back into shares.
But there’s a new risk: every token must stay backed 1:1.
buff.ly/AIU9jcD
🧐 Traditional finance isn't dipping a toe into regulated crypto anymore. It's moving in at speed.
📌 Banks on ESMA's MiCA register: ~40 → ~80 in under 3 months
📌 Total providers: 243 → 349
📌 Banks now ~1 in 4 listed providers, up from ~1 in 6 in June
Germany's leading it – Deutsche Bank + dozens of regional banks. They enter via Article 60, just 40 days' notice, faster than crypto firms' full CASP process.
Compliance docs: edge or table stakes now?
You don't need to commit to anything to find out where your protocol stands.
✅ Static analysis, symbolic execution, and AI-powered reasoning – all in one scan
✅ A quantified risk score, not just a list of findings
✅ Results in hours, not months
Whether you're pre-launch, post-audit, or just want a second look at code that's already live – $100 in credits covers a real scan, not a demo.
Sign up and get $100 in free credits → auditbase.com
#AuditBase
