Security Researcher @QuillAudits_AI | Ambassador
🌏
Joined April 2014
- Tweets2.3K
- Following489
- Followers408
- Likes7.7K
Pinned Tweet
I witnessed firsthand how a protocol could live with a live bug (and possibly never catch it) because there's no way to responsibly disclose these issues.
In a review with @QuillAudits_AI , an RWA project had forked a portion of @DinariGlobal's code but requested we treat it as a black box.
(Un)fortunately, I tend to digress when not working with code I'm familiar with -- and stumbled on a sizeable vulnerability in their codebase
Thankfully it wasn't exploited before it was patched, but they had ~$3m at risk (which grew to $60m in less than 4 months), big liquidity injection in RWA's this year (and likely for the next few years)💰
While this isn't Yearn-scale, many small drops fill a barrel.
Josselin has been talk about the need to beef up internal security -- this awareness is something I expect to grow as well, and this exploit is another example why
(ty for your talk with Rajeev and Alex at DSS).
Anu retweeted
3 criticals. 17 highs. 30 days.
That was September for our audit team at @QuillAudits_AI.
One of the criticals would have let one side of an ETH to TRON swap keep their coins and take the other side's, given 30 minutes of patience.
Here's what it was, and how we caught it 👇
ALT QuillAudits security roundup for September 2026. 102 total findings, 9 audits and 8K nLOC reviewed. Issues by severity are 3 critical, 17 high, 18 medium, 34 low and 21 informational, with critical highlighted in red. Chains covered are Ethereum, Ink, Monad, Robinhood Chain, Solana, MST Chain and Base.
Even a tiny change to a composed library or contract affects upstream code significantly.
Not being able to recognize and trace the impact of these changes is the introduction of a new series of bugs.
Glad to share we've been developing the best mitigation to this in-house!
8 years of auditing smart contracts. Thousands of findings.
And the same pattern every time: the code was done, the audit was next, the launch was waiting.
We built something that reviews the code while it's still being written.
First look at QuillShield.
The most powerful AI security reviewer for onchain code we've ever built. It reviews every pull request with the full context of your protocol, starting from a complete audit of it.
Opening a small beta. DM for access.
Excited to announce that I will speak at DSS this year in Mumbai on 1–2 November.
In my session, I will present the gamification of Daml contracts, and how to find those failures before an attacker does.
Thank you @summit_defi and @QuillAudits_AI
Register: luma.com/9qtxqqxx
On the DSS 2026 agenda: @cryptanu of QuillAudits.
“Damn Vulnerable Daml”
Explore the talk, then add it to My agenda:
defisecuritysummit.org/2026/…
Join us in Mumbai: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Anu Adeleke of QuillAudits: Damn Vulnerable Daml.
Visited an Ethereum Community Hub today and met Gbenga hard at work with ZK.
Is Ikorodu on Lagos life too? 😅
Thanks for having me, Web3Bridge!
Anu retweeted
I’ve been researching @Zcash security as part of our internal work at @osec_io.
Today, I’m happy to share that the total amount I’ll be receiving in bug bounties from @Zcash has finally been confirmed at $972K.
I’m really proud of what came out of this research. More importantly, I’m glad our work contributed to improving Zcash’s security and got more security researchers interested in Zcash. It’s especially great to see that many researchers are still looking into Zcash, finding and reporting bugs, and keeping an eye on its security.
Huge thanks to the teams across the Zcash ecosystem, including @Zcash, @zodl_co, @ZcashFoundation, @ValarGroup, @ShieldedLabs, @TachyonZcash, and @ZcashCommGrants, for taking security seriously and rewarding researchers, and to the entire Zcash community for all the support.
I’ll keep doing my best to find more bugs.
Anu retweeted
We’re starting Quill Findings 🥷
Detailed write-ups of real issues from client audits. What we caught, why it mattered, and what the fix was.
First one: Eligibility Replay in Tokenized Assets.
A gold-backed vault where the bar left and the custody certificate did not. That leftover NFT minted a second claim.
Full breakdown below 👇
This critical severity issue would have caused permanent asset loss. It proves really useful (time and time again) to not overlook an external audit before going to production.
ERC4626 vaults are interesting DeFi use-case. Adding on delays to make vault functionality asynchronous increases the surface of risk and trust assumptions.
For this audit, we consumed lots of resources on ERC7575 and ERC7540 to understand the tweaks made to the regular vault mechanism.
Happy to lend an unbiased pair of eyes to any developers pushing new changes. Reach out and I'll connect you to the best auditors on the team @QuillAudits_AI .
Anu retweeted
Getting licensed in Dubai is the easy part.
VARA doesn't shut down the projects that get hacked, it shuts down the ones that can't prove they were protected.
The 7 things that have to be in place before you go live👇
OpenAI is closing the door to new subscribers on its $200/month ChatGPT Pro plan.
Starting yesterday, September 10, @OpenAI is temporarily pausing new sign-ups and upgrades to Pro 20x. Existing subscriptions will continue to renew, and the $100 Pro plan remains available.
The catch: If you cancel or downgrade and let the change take effect, you can't get the $200 plan back until the pause is lifted. You can still reverse a scheduled cancellation before your billing cycle ends.
No reopening date is given. For anyone relying on the highest usage limits, that's a pretty consequential change.
Anu retweeted
RWA security is not an ERC-20 review with extra steps.
$38B already live. $355B represented. Almost all of it sits on three standards:
3643: identity + freeze/force
4626: share price + rounding
7518: partitions + lock math
This is the attack surface. Checklists in the thread 👇
🏆
August was one of those months where you just sit back and feel genuinely proud of the team.
Our audit team @QuillAudits_AI absolutely crushed it: ✅ 12 projects audited - all delivered on time
🔍 155 findings identified
Huge kudos to @kalp_eth, @Pro___King1,@phoenix244001, @cryptanu, and @turvec_dev for the exceptional work and relentless commitment to securing Web3.
Hats off to you all. On to the next one....
A good book sparks a new web of thinking and subsequently sponsors new actions.
If you're a frequent traveler this book here is a useful bite-sized read to improve your safety score.
Thanks to @_SEAL_Org and @theredguild
Anu retweeted
Bring Solana to your campus, help classmates ship, and build a community.
We're opening applications for the Solana University Ambassador Program.
Two undergrad ambassadors per campus will work directly with @SolanaFndn and receive hands-on training, funding, perks, swag, and access to a global community of peers.
Apply now: solana.com/university
