Auditor at @chain_security. Opinions are my own.
Joined February 2021
- Tweets5.1K
- Following1.5K
- Followers2.2K
- Likes14.2K
Pinned Tweet
Lots of Alpha in my talk on MEV and block production from @EthereumZurich this weekend.
Check it out!
youtube.com/watch?v=mZYDqSPE…
Torgin (not your keys not your coins) retweeted
⚠️ It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified in this blog post: chainsecurity.com/blog/glams…
We already found 13 real-world examples and are in responsible disclosure with the affected projects.
Please check your contracts as soon as possible, as the EF is determining how many contracts are impacted in which way.
Feel free to reach out to us with questions via glamsterdam@chainsecurity.com.
We are still hiring for BD roles! Technical and non-technical.
Amazing opportunity to have a high-impact role + learn from the big brains around here. 🧠🧠
Might be the best presentation announcement I've seen 🧊
We're in Belgrade and happy to let you know @k_besic will present a playbook that will make your Solana development more secure-by-design. Or as he put it:
🤝
It is rare to meet a top tier team irl in this space (outside of a conference), but this month I was lucky to meet the @chain_security team
Great office, amazing people, fantastic nature. Thanks for the invite, gigabrains 🤝
Proud to be working with the best. I get to learn from these guys every day 💪💪
The ETHSecurity badge distribution from @thedaofund is finished.
7 ChainSecurity auditors earned their place.
@hritzdorf co-uncovered issues that delayed Constantinople and shaped Istanbul & Berlin hard forks. 100+ protocols audited since 2017. Designed ChainSecurity's deployment validation framework. 13 academic papers on blockchain & cloud security.
@a_permenev co-authored Securify and VerX, two foundational smart contract analysis tools. 3rd & 4th place at Paradigm CTF (2021, 2022).
@k_besic introduced read-only reentrancy as a vulnerability class. Lead auditor for @enzymefinance. Co-led the disclosure that protected $100M+ across Curve, MakerDAO, Enzyme, Abracadabra, TribeDAO, Opyn.
@trooocher reported 100+ bugs in the Vyper compiler. Lead auditor for @CurveFinance. Helped push ChainSecurity to #5 on the Ethereum Execution Layer Bug Bounty leaderboard.
Dominic Brütsch is auditing at ChainSecurity since 2018, before DeFi existed. Lead auditor for @SkyEcosystem. Found a bug in Geth, earning a spot on the Ethereum Foundation Bug Bounty leaderboard.
@simon_perriard is ChainSecurity's ZK lead. Found a bug in the Solidity compiler. Disclosed critical soundness bugs in EY's Nightfall V3 circuits and served as lead auditor in top-tier DeFi projects.
@MatthiasEgli co-disclosed vulnerabilities in the Ethereum protocol itself and oversees all our audits as Managing Director.
TheDAO's mission is to make Ethereum safer. ETHSecurity is how they vet the researchers capable of contributing to that work. Congrats to everyone who made it on this epic list.
Torgin (not your keys not your coins) retweeted
Here's another angle @MTorgin ✨
"To avoid getting rekt, you need to prioritize security at every level of the stack, not just the smart contracts."
It was a pleasure to discuss this topic at @EthCC last week with
@JulienBouteloup from @StakeCapital
@PabloSabbatella from @opsek_io
@0xFlint_ from @Certora
Debra Nita Ravindran from @YAPGlobalTeam
and our very own @MTorgin
Torgin (not your keys not your coins) retweeted
We made people eat bugs at Devconnect Buenos Aires. Check the first comment to see who’s in the video & vote for the best reaction.
🏆 Winner gets a lifetime bug supply + a printed copy of the EF mandate.
PS: This is not an April's fools, we're completely serious.
THE READING 📖📖📖 k
EF Mandate reading by @chain_security was AN EXPERIENCE
s/o to @EmilieRaffo and the team for putting this together!
this kind of stuff happen only at @EthCC or @EFDevcon
Looking forward to it!
Ship Fast, Get Rekt.
Tomorrow at @EthCC, @JulienBouteloup joins the panel on what happens when speed beats security.
With @MTorgin (@chain_security), @PabloSabbatella (@opsek_io) @0xFlint_ (@Certora), and Debra Nita Ravindran (@YAPGlobalTeam).
14:15 - Hepburn Stage.
The llamas have the best swap interface ❤️❤️
Google Ads scams are on the rise again. Here's what to do if you see one:
9/13
What to do if you find a malicious ad:
- Report via adstransparency.google.com
- Collect screenshots + landing URL
- Escalate through Google’s abuse form with your official domain via support.google.com/ads/troub…
- Warn your community
Torgin (not your keys not your coins) retweeted
Aave V4's third security audit has been published by @chain_security.
Review their findings below.
DeFi composability is the future of Finance.
@CurveFinance and @frankencoinzchf, both audited by @chain_security 😎
🇨🇭Just discovered that the fastest crypto-native way of paying CHF bills is this:
- Buying ZCHF on @CurveFinance;
- Sending those to @mtpelerin;
- Paying CHF from there, conversion is 1:1!
Powered by our FX pools apparently
Did not know this before!
Inaccurate gas estimates on @ton_blockchain can lead to critical security issues. 🛡️
Today, our TON specialists share the knowledge gained from vulnerabilities uncovered during recent DeFi audits.
Dive into the technical details: chainsecurity.com/blog/ton-g…
Torgin (not your keys not your coins) retweeted
Briefly checked this one. Still not everything clear to me, and @yearnfi team told that the official post-mortem is still to be made only after they understand everything.
But two takeaways for buidlers:
- Be careful with unsafe math. It's unsafe unless you proved it is safe;
- Fuzz, fuzz, fuzz. Don't trust yourself and fuzz again.
yeth exploit post mortem
github.com/banteg/yeth-explo…
Torgin (not your keys not your coins) retweeted
🧵Hola Buenos Aires! ChainSecurity is in town for @EFDevcon & @partyactionppl 🇦🇷
From talks, panels, MC duties, and community events,
here’s your full chronological guide to where you can catch our team 👇
So important and often missed these days.
If you don't fully understand what this means, I highly recommend looking into it.
Regular reminder:
A key property of a blockchain is that even a 51% attack *cannot make an invalid block valid*. This means even 51% of validators colluding (or hit by a software bug) cannot steal your assets.
However, this property does not carry over if you start trusting your validator set to do other things, that the chain does not have control over - at that point, 51% of validators can collude and give a wrong answer, and you don't have any recourse.