Founder @ https://xitter.cf/t.co/gcgrMm5l8P, JohnnyTime @ Youtube, Securing Web3 @ https://xitter.cf/t.co/wJdpJyYK5y & https://xitter.cf/t.co/3d9aL8nDvG
Web3
Joined February 2012
- Tweets10.6K
- Following1.5K
- Followers12.8K
- Likes37.1K
Pinned Tweet
Smart contract security pays WELL.
💰 Top auditors make $500K+ per year
💰 Bug bounties can 10x that
💰 Even “mid” auditors make six figures
BUT… Only if you actually put in the work. No shortcuts here.
An upgradeable proxy holds state; its implementation supplies code. Deploying the implementation doesn't initialize the proxy.
Initialize the proxy during deployment. Verify owner/roles, block repeat initialization, lock implementation and test upgrade permissions.
Lending protocols pay a liquidation bonus to accounts that repay unhealthy debt.
In Euler V1's March 2023 exploit, an attacker made an account eligible for liquidation, then collected that bonus through self-liquidation. 1/4
3/4 The attacker self-liquidated for a bonus larger than the donation loss.
Review the whole sequence: can an attacker reduce collateral, trigger liquidation and recover more through the bonus than they gave up?
4/4 Euler Labs' account of the historical V1 exploit and recovery:
euler.finance/blog/war-peace…
Euler V2 has a different architecture.
A Solidity withdrawal can complete without paying the user.
In this toy vault, credit records the ETH owed to a user. The function clears it before a low-level payment call and ignores the success flag. 1/4
3/4 Requiring the call to succeed makes the rejected payment revert the transaction and restore the user's credit.
A separate test confirms a normal receiver gets paid. An unpaid user must keep their claim in this design.
An ERC-20 approval lets a spender move tokens from your wallet. Before signing, check:
- Chain
- Token
- Spender address
- Amount
NFT operator approvals, permits and signed orders can have different scopes and cancellation rules. Check the permission type too.
The SCH dashboard now shows your current course, progress and next lesson together. Open your dashboard to continue from where you stopped.
🎯🎯🎯🎯🎯🎯
These global Codex resets are genuinely frustrating.
A “free reset” sounds great until you realize it can wipe your remaining usage nd restart your 7 day timer.
So people who carefully manage their quota can actually end up losing out.
And the higher your subscription tier, the more unused usage you potentially sacrifice.
The solution is simple:
- give a bank the reset
- don't restart our weekly timer
- at least give us an opt out
And please announce resets inside Codex, not through some employee's X account. LOL
Even after paying, managing usage shouldn't feel like gambling.
@thsottiaux
AI changed the tools around smart contract auditing.
The route into the field looks much the same: read code, break small contracts, write tests, and document bugs clearly.
That is the roadmap I made in 2024:
youtube.com/watch?v=rpnFJMYb…
One vesting position must never spend another user's allocation.
Blockaid reports an UNCX exploit where a tiny leftover vest withdrew other users' locked tokens.
For shared pools, test the whole lifecycle: deposit, partial release, top-up, donation and cancellation. Check who can withdraw what after every step.
🚨 Blockaid detected an ongoing exploit on @UNCX_token on ethereum.
~$86k drained from the shared vesting pool so far across 1 drain tx. Attack still ongoing. 🧵
New SCH CTF Arena challenge: MagicNumber.
Worth 1125 EXP and up to 1675 HP.
smartcontractshacking.com/to…
An audit logo doesn't show what code was reviewed.
Our index links 331 incidents to firm records, yet scope and deployed versions often remain unknown. After a hack, firms and protocols owe users those answers.
smartcontractshacking.com/to…
Running AI agents for security research? You can now inspect a long evaluation run as an interactive timeline.
AISI's new Transect tool links recorded activity back to the transcript so you can check what actually happened.
Open source. Its structural view needs no model calls.
github.com/AI-Safety-Institu…
