
Security Researcher @QuillAudits_AI | Ambassador
🌏
Joined April 2014
- Tweets2.3K
- Following489
- Followers408
- Likes7.7K
Anu retweeted
3 criticals. 17 highs. 30 days.
That was September for our audit team at @QuillAudits_AI.
One of the criticals would have let one side of an ETH to TRON swap keep their coins and take the other side's, given 30 minutes of patience.
Here's what it was, and how we caught it 👇

ALT QuillAudits security roundup for September 2026. 102 total findings, 9 audits and 8K nLOC reviewed. Issues by severity are 3 critical, 17 high, 18 medium, 34 low and 21 informational, with critical highlighted in red. Chains covered are Ethereum, Ink, Monad, Robinhood Chain, Solana, MST Chain and Base.
I’ve been researching @Zcash security as part of our internal work at @osec_io.
Today, I’m happy to share that the total amount I’ll be receiving in bug bounties from @Zcash has finally been confirmed at $972K.
I’m really proud of what came out of this research. More importantly, I’m glad our work contributed to improving Zcash’s security and got more security researchers interested in Zcash. It’s especially great to see that many researchers are still looking into Zcash, finding and reporting bugs, and keeping an eye on its security.
Huge thanks to the teams across the Zcash ecosystem, including @Zcash, @zodl_co, @ZcashFoundation, @ValarGroup, @ShieldedLabs, @TachyonZcash, and @ZcashCommGrants, for taking security seriously and rewarding researchers, and to the entire Zcash community for all the support.
I’ll keep doing my best to find more bugs.
Anu retweeted
We’re starting Quill Findings 🥷
Detailed write-ups of real issues from client audits. What we caught, why it mattered, and what the fix was.
First one: Eligibility Replay in Tokenized Assets.
A gold-backed vault where the bar left and the custody certificate did not. That leftover NFT minted a second claim.
Full breakdown below 👇
Anu retweeted
RWA security is not an ERC-20 review with extra steps.
$38B already live. $355B represented. Almost all of it sits on three standards:
3643: identity + freeze/force
4626: share price + rounding
7518: partitions + lock math
This is the attack surface. Checklists in the thread 👇
Anu retweeted
Bring Solana to your campus, help classmates ship, and build a community.
We're opening applications for the Solana University Ambassador Program.
Two undergrad ambassadors per campus will work directly with @SolanaFndn and receive hands-on training, funding, perks, swag, and access to a global community of peers.
Apply now: solana.com/university
Anu retweeted
🚨 @term_labs was hacked for 8.5M in a governance exploit.
The attacker didn't break governance. He was the governance. Across 7 USDC vault proposals attacker held 100% of the voting power, and drained 5 of those vaults. In the ETH Meta Vault attacker was the majority holder.
2,841.74 WETH and 1,679,639 USDC were drained across six vaults total, the USDC later swapped to DAI.
Attacker EOAs
etherscan.io/address/0xD5183…
etherscan.io/address/0x68645…
etherscan.io/address/0xa908b…
Example Attack tx
etherscan.io/tx/0x284fc544f3…
etherscan.io/tx/0xca084d9489…
Anu retweeted
Audit Notes: Canton - Ep. 1
Canton Network has no bugs: Myth.
DAML removes reentrancy, front-running, and delegatecall risks by design. What it can't remove: authorization gaps and business-logic flaws.
The risks don't vanish on Canton. They shift.
Anu (@cryptanu) explains in 50 seconds 👇
Anu retweeted
Before you read our H1 2026 DeFi Security Report, here is our own H1 2026 track record.
• 50+ protocols audited
• 375 vulnerabilities identified
• 0 exploits across any QuillAudits-audited project
• 36,000+ NSLOC reviewed across 25+ chains
• 20+ protocol categories covered
• Full lifecycle coverage: Design, Detect, Validate, Secure Ops, Monitor
Secure Operations (OPSec) remains our core focus, and this report's own data explains why: 82.7% of H1 2026's losses came from key and trust failures, not code bugs.
Full report 🧵👇
Anu retweeted
Incredible find and disclosure from @hexens && @kemmio 👏
Recommend a read, and thank you very much for protecting the the entirety of DeFi.
hexens.io/research/aptos-hij…
Anu retweeted
If you are lost -> The answer is education
If you are educated -> The answer is execution
If you are executing -> The answer is consistency
Web3 security for the win, let's WIN together team🫡
Anu retweeted
If you think a $300K corporate salary is payment for 40 hours of weekly labor, I've got news for you...
There is a persistent cynical narrative that large enterprises are bloated engines of inefficiency, filled with overpaid professionals who spend their days looking at slides and doing "nothing."
I mean, it's a comforting myth for critics, but I think it fundamentally misunderstands modern knowledge work.
That $300K salary (or $400K, or $500K) isn't a reward for linear effort but an option premium on high-leverage thinking.
We are still haunted by the ghost of the assembly line, ie, the outdated idea that compensation must directly correlate with time spent + physical output.
In the factory world, if you leave your station, production stops, but in the knowledge economy, value is almost totally decoupled from time.
Folks... An enterprise paying a senior leader or specialist $25K a month is not buying 160 hours of typing, they are buying *insurance* against catastrophic errors and positioning themselves for asymmetric upside.
I'll try to make it tangible with an example...
Consider a complex matrix organization busy with a $40M product migration. In this environment, the value distribution of a worker's is heavily spiked.
Most days look like nothing... alignment meetings, reading documentation, maintaining steady state. Yes, to an outsider, it looks like "doing nothing."
But then a critical day arrives. A vendor fails, a timeline slips, a crossroads appears, whatever... If that $300K professional has the institutional memory and capability to make just 4 or 5 correct decisions during those critical moments, the ROI is staggering! A single right call can avert a $5M problem.
Suddenly, that $300K salary doesn't look like bloat but, to me, seems like the cheapest asset on the p&l.
These days we are bombarded by tech CEOs promising fully autonomous, AI-driven organizations and I keep saying these pitches miss the entire point of how complex enterprises actually move.
Data computation can be outsourced to an LLM but going through the decision fabric of an enterprise cannot. You need people for:
> Knowing *how* to build consensus across disconnected departments with competing incentives;
> Understanding the unspoken history of why past projects failed, and how to position a new initiative so it doesn't trigger corporate antibodies;
> When a multi-million-dollar decision goes sideways, an algorithm cannot stand before a board of directors or regulators and take ownership of the corrective action.
An AI can give you a pristine strategic framework with nice and difficult sounding words, but it cannot navigate the human matrix required to execute it.
The ability to be effective inside a complex enterprise is a rare AND expensive skillset precisely because it cannot be automated or easily replicated.
My point is you aren't paying for the 9-to-5 "grind", but more for the readiness.
Like an elite surgeon or an expert technician, you pay for the decades of accumulated knowledge that allow them to fix a crisis in 5 minutes, not the 5 minutes itself....
Leverage, not labor.
Anu retweeted
This is coming from a guy that have earned $3.6m in bug bounties:
"I don't rest until I understand every part of the system. Even if I end up not finding a bug, I want to understand it."
Be CURIOUS guys, don't be a slacker.
If you want real success, you have to be obsessed.
Anu retweeted
Three years ago, Solana had little to no presence in Africa’s largest crypto economy 🌍
Today, dozens of global ecosystem teams have expanded into Nigeria with our support, hundreds of leading regional products have integrated Solana with our help, and thousands of Nigerians have earned, built products, landed jobs, won hackathons, raised early-stage capital, and found their place in the global Solana ecosystem through this community 💪🏿
And it still feels like we’re just getting started 🥳
Happy 3rd anniversary to everyone building with us 🫡
You can't miss reading these blogs, if you're a SR/Auditor :
- blog.trailofbits.com/
- rareskills.io/blog
- openzeppelin.com/research
- blog.asymmetric.re/
- trustsec.xyz/blog
- blog.sigmaprime.io/
- zellic.io/blog/
- cyfrin.io/blog
- osec.io/blog/
- helius.dev/blog?category=res…
- mixbytes.io/blog
Save it anon, if you're an avid reader






















