Web3 Security tryhard | SR @AdevarLabs
Joined September 2021
- Tweets2.9K
- Following540
- Followers1.2K
- Likes9.8K
Simple invariant + powerful fuzzer → cool finding
(1) While the hard part we all know is to come up with nice invariants
(2) The other hard part is to set up an efficient fuzzing env (otherwise this might take too long to hit a violation)
Crucible does (2) for you
Pricing vault shares in more than one place?
Our latest blog post by @arsen_bt is worth the read. 👇
🟢 A swap that priced fee shares against the wrong supply, so the fee recipient got 21 shares when about 32 were due
🟢 The one fuzz property that caught it, and the fix
🟢 How we scale the same harness to 2,000 cores
Ship Safely. 🚀
adevarlabs.com/blog/fuzzing-…
Durable nonce will be deprecated soon and replaced by onchain signature verification
I guess the Drift hack accelerated this decision
Durable Nonces will be deprecated next year!
It will move out of the protocol and into onchain programs.
Now is the time to try out the new solutions and give feedback to make the tooling around it great for the migration period.
Everything you need to know in the deprecation guide:
solana.com/upgrades/durable-…
Regarding the recent Ledger incident.
Attackers worked around the secure element by reading the screen data directly, which shows the seed phrase when setting the ledger, and sending it over LTE later on.
The hardest part here is obviously the supply chain attack, but still.
Really nice video on inference economics
And how inference providers achieve such low price per tokens compared to a self-hosting (home or cloud) solution
Spoiler: caching, batching, custom kernel for specific models, separate input/output servers
youtube.com/watch?v=xP1kjDOi…
InfectedCrypto retweeted
with token-2022 you can't just check "is this the mint" anymore... permanent delegate, transfer hooks, transfer fees all change what a transfer actually does. if a vault accepts any 2022 mint without reading the extensions it's trusting a lot more than it thinks
I guess the end goal is that they want us to treat them (the LLMs) like some sort of bayesian gods, that we, simple humans, shall respect
Exclusive: Anthropic is updating its usage policy for the first time in over a year. The new rules prohibit sustained "abusive or cruel behavior" towards Claude & add new restrictions about propaganda campaigns, surveillance & weapon development. theverge.com/ai-artificial-i…
InfectedCrypto retweeted
$20,000 in Pre-Audit Credits for Colosseum’s Crypto World's Fair Hackathon by @AdevarLabs
Prize pool: $20k USDC in Pre Audit in-kind security services
Adevar Labs is looking for technically ready teams with real codebases and a credible path to launch
superteam.fun/earn/listing/p…
On Solana, any (caller) provided account bring a risk.
When reviewing instructions, ask yourself for each account "what can I do if I control this account".
Then make sure there's a check preventing this path.
Repeat.
This new feature "ctrl+enter to send message now" while the agent is working is such a blessing
I wanted it for so long
Even though I had a workaround for this: escape to stop the agent, send the message, and let him continue
I wonder if this is the same at the end
I'd love to know more on that Near story tbh
Did the team identify him because the guy reported the vulnerability, got impatient and exploited it ?
Or did he use an address that was tied to publicly known one ?
We have identified you, sir.
Please return the funds to the following addresses:
Bitcoin: bc1qjhv3hu8rfteh5e8exfmalvx2z3pzlmjlgnzxey
BNB / Ethereum: 0xB18a1aEDfde8B70FD67012C9E9c7a088B4d0C0e7
Solana: AHTfKaeRcaK1sbSG8MFJS2uPxLBChfenigNtvbWEkhKD
You know better than most how responsible disclosure works — this is the last window to use it. After 48 hours, that window closes.
InfectedCrypto retweeted
I noticed that people like reading about ZK, and using AI for security research. This article has a bit of both.
InfectedCrypto retweeted
Building on @Solana for @Colosseum’s Crypto World’s Fair?
@AdevarLabs is offering 5 Solana/Rust teams a $4,000 pre-audit each! AI security review validated by a human security engineer 👀
Apply by Oct 12 via @superteamearn 👇
🤖 Made with AI
While studying ZK, I kept running into nullifiers without really understanding them.
So I went down the rabbit hole and ended up writing a blog post to help you understand why they matter and why they're so easy to overlook
Every valid ZK proof looks the same. So what stops you from withdrawing a mixer deposit twice? ➔ The nullifier.
In our latest article, @InfectedCrypto walks through how Tornado Cash, Zcash and Penumbra build them, and the audit findings that show up when they fail.
adevarlabs.com/functions/blo…
InfectedCrypto retweeted
The Adevar Labs security side-track is slowly becoming a tradition for each @colosseum hackathon. I'm excited to see what builders are cooking at the Crypto World's Fair.
Good luck to everyone participating!
Ship safely 🫡
We're giving away $20,000 in Preaudit Credits at the @Colosseum's Crypto World's Fair through our track on @SuperteamEarn .
Closes Oct 12. Apply Below. Ship Safely. 🚀
A multisig, with another multisig as one of the required signer, where each signers of the multisig's multisig is a hardware wallet held by an independent security company that reviews (optional) every update before signing
I think that's pretty solid
Don't launch without an audit.
If budget is tight consider option 2 at least, which imo has a really great return value.
We've been tweaking our scanner for some time now and I find the result pretty impressive.
But tbh, if this is the last audit before launch, option 3 is best as we go further, both in vulnerability research and modeling your system.
