Security Researcher @QuillAudits_AI | Ambassador

🌏
Joined April 2014
3 criticals. 17 highs. 30 days. That was September for our audit team at @QuillAudits_AI. One of the criticals would have let one side of an ETH to TRON swap keep their coins and take the other side's, given 30 minutes of patience. Here's what it was, and how we caught it 👇
6
3
1
16
608
Anu retweeted
I’ve been researching @Zcash security as part of our internal work at @osec_io. Today, I’m happy to share that the total amount I’ll be receiving in bug bounties from @Zcash has finally been confirmed at $972K. I’m really proud of what came out of this research. More importantly, I’m glad our work contributed to improving Zcash’s security and got more security researchers interested in Zcash. It’s especially great to see that many researchers are still looking into Zcash, finding and reporting bugs, and keeping an eye on its security. Huge thanks to the teams across the Zcash ecosystem, including @Zcash, @zodl_co, @ZcashFoundation, @ValarGroup, @ShieldedLabs, @TachyonZcash, and @ZcashCommGrants, for taking security seriously and rewarding researchers, and to the entire Zcash community for all the support. I’ll keep doing my best to find more bugs.
82
46
8
928
65,442
AI has solved security but somehow we have more work to do than ever before
14
3
3
61
3,973
We’re starting Quill Findings 🥷 Detailed write-ups of real issues from client audits. What we caught, why it mattered, and what the fix was. First one: Eligibility Replay in Tokenized Assets. A gold-backed vault where the bar left and the custody certificate did not. That leftover NFT minted a second claim. Full breakdown below 👇
2
3
16
752
Another week to be world-class 👏
5
3
1
30
546
Getting licensed in Dubai is the easy part. VARA doesn't shut down the projects that get hacked, it shuts down the ones that can't prove they were protected. The 7 things that have to be in place before you go live👇
3
17
623
RWA security is not an ERC-20 review with extra steps. $38B already live. $355B represented. Almost all of it sits on three standards: 3643: identity + freeze/force 4626: share price + rounding 7518: partitions + lock math This is the attack surface. Checklists in the thread 👇
On-chain RWAs have crossed $38B in distributed assets, representing $355B in assets and reaching 2.9M holders. All of that value runs on a handful of token standards. Each one has a live attack surface, and the industry is short on people who can find the bugs. We wrote the checklists. 🧵
2
5
1
26
1,654
Bring Solana to your campus, help classmates ship, and build a community. We're opening applications for the Solana University Ambassador Program. Two undergrad ambassadors per campus will work directly with @SolanaFndn and receive hands-on training, funding, perks, swag, and access to a global community of peers. Apply now: solana.com/university
71
94
37
601
171,722
🚨 @term_labs was hacked for 8.5M in a governance exploit. The attacker didn't break governance. He was the governance. Across 7 USDC vault proposals attacker held 100% of the voting power, and drained 5 of those vaults. In the ETH Meta Vault attacker was the majority holder. 2,841.74 WETH and 1,679,639 USDC were drained across six vaults total, the USDC later swapped to DAI. Attacker EOAs etherscan.io/address/0xD5183… etherscan.io/address/0x68645… etherscan.io/address/0xa908b… Example Attack tx etherscan.io/tx/0x284fc544f3… etherscan.io/tx/0xca084d9489…
2
4
31
1,580
Audit Notes: Canton - Ep. 1 Canton Network has no bugs: Myth. DAML removes reentrancy, front-running, and delegatecall risks by design. What it can't remove: authorization gaps and business-logic flaws. The risks don't vanish on Canton. They shift. Anu (@cryptanu) explains in 50 seconds 👇
1
3
20
776
Before you read our H1 2026 DeFi Security Report, here is our own H1 2026 track record. • 50+ protocols audited • 375 vulnerabilities identified • 0 exploits across any QuillAudits-audited project • 36,000+ NSLOC reviewed across 25+ chains • 20+ protocol categories covered • Full lifecycle coverage: Design, Detect, Validate, Secure Ops, Monitor Secure Operations (OPSec) remains our core focus, and this report's own data explains why: 82.7% of H1 2026's losses came from key and trust failures, not code bugs. Full report 🧵👇
1
3
11
603
Anu retweeted
🚨BREAKING: AUDITOR TWITTER IS BACK GET THESE AUDITS BOYS, LFG🫡
11
5
180
7,921
If you are lost -> The answer is education If you are educated -> The answer is execution If you are executing -> The answer is consistency Web3 security for the win, let's WIN together team🫡
7
10
109
2,744
If you think a $300K corporate salary is payment for 40 hours of weekly labor, I've got news for you... There is a persistent cynical narrative that large enterprises are bloated engines of inefficiency, filled with overpaid professionals who spend their days looking at slides and doing "nothing." I mean, it's a comforting myth for critics, but I think it fundamentally misunderstands modern knowledge work. That $300K salary (or $400K, or $500K) isn't a reward for linear effort but an option premium on high-leverage thinking. We are still haunted by the ghost of the assembly line, ie, the outdated idea that compensation must directly correlate with time spent + physical output. In the factory world, if you leave your station, production stops, but in the knowledge economy, value is almost totally decoupled from time. Folks... An enterprise paying a senior leader or specialist $25K a month is not buying 160 hours of typing, they are buying *insurance* against catastrophic errors and positioning themselves for asymmetric upside. I'll try to make it tangible with an example... Consider a complex matrix organization busy with a $40M product migration. In this environment, the value distribution of a worker's is heavily spiked. Most days look like nothing... alignment meetings, reading documentation, maintaining steady state. Yes, to an outsider, it looks like "doing nothing." But then a critical day arrives. A vendor fails, a timeline slips, a crossroads appears, whatever... If that $300K professional has the institutional memory and capability to make just 4 or 5 correct decisions during those critical moments, the ROI is staggering! A single right call can avert a $5M problem. Suddenly, that $300K salary doesn't look like bloat but, to me, seems like the cheapest asset on the p&l. These days we are bombarded by tech CEOs promising fully autonomous, AI-driven organizations and I keep saying these pitches miss the entire point of how complex enterprises actually move. Data computation can be outsourced to an LLM but going through the decision fabric of an enterprise cannot. You need people for: > Knowing *how* to build consensus across disconnected departments with competing incentives; > Understanding the unspoken history of why past projects failed, and how to position a new initiative so it doesn't trigger corporate antibodies; > When a multi-million-dollar decision goes sideways, an algorithm cannot stand before a board of directors or regulators and take ownership of the corrective action. An AI can give you a pristine strategic framework with nice and difficult sounding words, but it cannot navigate the human matrix required to execute it. The ability to be effective inside a complex enterprise is a rare AND expensive skillset precisely because it cannot be automated or easily replicated. My point is you aren't paying for the 9-to-5 "grind", but more for the readiness. Like an elite surgeon or an expert technician, you pay for the decades of accumulated knowledge that allow them to fix a crisis in 5 minutes, not the 5 minutes itself.... Leverage, not labor.
86
97
12
1,135
196,395
This is coming from a guy that have earned $3.6m in bug bounties: "I don't rest until I understand every part of the system. Even if I end up not finding a bug, I want to understand it." Be CURIOUS guys, don't be a slacker. If you want real success, you have to be obsessed.
9
12
165
3,223
🥷🏾
be so fucking good you never need to go through HR
1
4
117
Three years ago, Solana had little to no presence in Africa’s largest crypto economy 🌍 Today, dozens of global ecosystem teams have expanded into Nigeria with our support, hundreds of leading regional products have integrated Solana with our help, and thousands of Nigerians have earned, built products, landed jobs, won hackathons, raised early-stage capital, and found their place in the global Solana ecosystem through this community 💪🏿 And it still feels like we’re just getting started 🥳 Happy 3rd anniversary to everyone building with us 🫡
125
147
198
544
120,282