We keep your project secure, so you can build and innovate with confidence
Joined February 2026
- Tweets197
- Following554
- Followers629
- Likes2.6K
Pinned Tweet
Wrapped up the @Panoptic_xyz contest on @code4rena 🏆
We secured 1st place🥇 with 5 valid findings (1 High / 4 Medium), including 1 solo submission.
Really interesting system. Excited to see where Panoptic goes from here. Bright future ahead 🚀
Get the answers to these questions valvessecurity.com/auditors-…
- Why do we only put proven auditors on your code?
- What does “proven” actually mean?
- What questions should you ask before starting an audit with a security firm?
Valves Security retweeted
Was not too hard. Happy to share this!
The @ValvesSec AI security tooling just got a major update 🫣
We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models.
Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work.
We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming.
anthropic.com/news/cyber-ver…
Valves Security retweeted
🥪 The fee payer controlled how cheaply the protocol could sell its own cut.
A liquidity manager compounded the trading fees earned by a user's position. It took a percentage of those fee tokens, sold that cut for USDC to pay the protocol, and reinvested the remaining tokens for the owner.
The owner supplied the slippage tolerance for that fee sale too.
Illustrative numbers for one non-USDC fee token, with no bot fee: 100 earned TOKEN leave 90 for reinvestment after a 10 TOKEN protocol cut. If those 10 TOKEN sell for 80 USDC instead of 100, the owner still gives up 10 TOKEN. The protocol receives 20 USDC less.
⚔️ Attack path:
1. The owner targets a compound where the remaining tokens match the position's required ratio at execution, so reinvestment needs no rebalance swap. They choose a permissive slippage tolerance.
2. Front-run: the owner sells TOKEN into the market used by the fee sale, pushing its price down.
3. Compound: their transaction sells the protocol's fixed token cut at the worsened price. The loose tolerance allows the reduced USDC output, and the remaining tokens proceed to reinvestment without a rebalance swap.
4. Back-run: the owner buys TOKEN back after the compound, seeking to unwind the first trade at a lower price.
💥 Impact:
The protocol receives less USDC from the same fee-token charge. The owner can potentially recover part of that fee through the surrounding trades.
Skipping the rebalance matters: a rebalance swap could also expose the owner's remaining tokens to the manipulated price. Liquidity addition and any dust conversions still occur and affect the economics.
🔎 Root cause:
The fee payer chose the allowed execution loss on the sale funding the protocol's payout. Worse execution reduced that payout without increasing the predetermined fee-token charge.
🛠️ Fix:
Enforce a protocol-set slippage cap on fee conversions while honoring a stricter user tolerance.
Valves Security retweeted
For every protocol, we build a custom security team that brings together different strengths: auditors who find uncommon bugs and those who consistently deliver high coverage.
We know that every protocol is different, and we put together the right team for your needs 🤝
For every protocol, we build a custom security team that brings together different strengths: auditors who find uncommon bugs and those who consistently deliver high coverage.
We know that every protocol is different, and we put together the right team for your needs 🤝
🥪 The fee payer controlled how cheaply the protocol could sell its own cut.
A liquidity manager compounded the trading fees earned by a user's position. It took a percentage of those fee tokens, sold that cut for USDC to pay the protocol, and reinvested the remaining tokens for the owner.
The owner supplied the slippage tolerance for that fee sale too.
Illustrative numbers for one non-USDC fee token, with no bot fee: 100 earned TOKEN leave 90 for reinvestment after a 10 TOKEN protocol cut. If those 10 TOKEN sell for 80 USDC instead of 100, the owner still gives up 10 TOKEN. The protocol receives 20 USDC less.
⚔️ Attack path:
1. The owner targets a compound where the remaining tokens match the position's required ratio at execution, so reinvestment needs no rebalance swap. They choose a permissive slippage tolerance.
2. Front-run: the owner sells TOKEN into the market used by the fee sale, pushing its price down.
3. Compound: their transaction sells the protocol's fixed token cut at the worsened price. The loose tolerance allows the reduced USDC output, and the remaining tokens proceed to reinvestment without a rebalance swap.
4. Back-run: the owner buys TOKEN back after the compound, seeking to unwind the first trade at a lower price.
💥 Impact:
The protocol receives less USDC from the same fee-token charge. The owner can potentially recover part of that fee through the surrounding trades.
Skipping the rebalance matters: a rebalance swap could also expose the owner's remaining tokens to the manipulated price. Liquidity addition and any dust conversions still occur and affect the economics.
🔎 Root cause:
The fee payer chose the allowed execution loss on the sale funding the protocol's payout. Worse execution reduced that payout without increasing the predetermined fee-token charge.
🛠️ Fix:
Enforce a protocol-set slippage cap on fee conversions while honoring a stricter user tolerance.
We literally invest in the projects that we have secured and believe in. We are part of DeFi, we use DeFi, and we are proud to work alongside the brilliant minds building this space.
We don’t just secure Web3 from the sidelines. We are part of the ecosystem ourselves 🫡
To get a quote and kick off your project’s audit as quickly as possible, you need to have a clearly defined scope and a Github repository ready to share.
We can move fast! You can use that in your advantage 👊
Valves Security retweeted
We at @ValvesSec keep finding basic issues in protocols that have already been audited by firms with thousands of audits behind them.
This isn’t serious...
There are plenty of elite security researchers available now, and AI tools that can cover codebases better than some of these companies do.
Founders are paying for real protection - not just a badge on their website. They deserve better.
Do it right. We can all do better. 🛡️
Before starting an audit with a company of your choice, always ask who will actually be auditing your codebase.
If you’re not immediately impressed, come talk to us 😏
Currently auditing Uniswap V3/V4 with Robinhood integration. Seeing a lot of Uniswap projects lately.
Valves Security retweeted
Read more about it here: valvessecurity.com/solidity-…
🔍Scope can move. If the risk is next door to the in-scope file, we flag it. 🚩
Clients notice who stays inside the ticket and who doesn’t.
Valves Security🤝another review in progress. Two senior researchers, both co-founders in the loop. We don’t do light passes.🫡
Does not get any better then this 😏
We’re one of the teams providing DAML audits together with @ValvesSec
Together we take apart DAML code with manual review and top of the line AI tools to make Smart Contracts as safe as possible
Reach out!