Independent Smart Contract Researcher & Researcher at @ShieldifySec My mission is to find vulnerabilities in smart contracts for a safer Web3 Space!
Joined May 2021
- Tweets2.4K
- Following1.9K
- Followers8.4K
- Likes13.4K
Jeff Security retweeted
Hash-perfect decompilation of a Solana program is now a thing.
@osec_io went from a 220KB .so blob to byte-identical Rust source for GoonFi V2, using agents scored on how closely each function matched the original bytecode.
The bug they found once the code was readable? The AMM priced assets off its own vault balance. Donate tokens, skew the price, drain the other side. $6.1M at risk.
If your program is live, assume your source is public.
osec.io/blog/goonfi-decompil…
TryHackMe’s AI Security path: 25 hands-on labs on prompt injection, jailbreaks, AI supply chain attacks and RAG data poisoning. ~19h, intermediate. Worth it if you audit anything with an LLM in the loop.
tryhackme.com/path/outline/a…
ethereum.org curates 446 builder tools. Security & testing alone has 56: Slither, Aderyn, Echidna, Medusa, hevm, Certora, Kontrol, heimdall-rs. A solid map for building your audit toolchain.
ethereum.org/developers/tool…
Jeff Security retweeted
Whitehats defend every line. Blackhats only need one missed invariant. That gap is the difference between a clean launch and a 3am rekt thread
Double down on security 🫡
Sing, O Muse, of the vault that trusted its oracle. Of TVL unbounded, of a price fed by one thin pool, and of the flash loan that arrived at dawn like a god in disguise. ⚔️
Audit your feeds, anon.
Jeff Security retweeted
Prompt injection is the reentrancy of AI agents: untrusted input executing as instructions. This curated list covers OWASP LLM Top 10, adaptive attack papers, Garak, MCP tool poisoning and CTFs to practice on 🫡
github.com/Joe-B-Security/aw…
Malware C2 with no server to seize. ClearFake stashed payloads in BSC testnet contracts, and injected JS on hacked sites pulls them with a plain eth_call.
trendmicro.com/en_us/researc…
Repeat audits are the real KPI for a security team. If most engagements are one-offs, clients are trying you once and moving on. Build a pipeline where every release has a clear path to review.
Trail of Bits mapped 7 recurring Uniswap v4 hook bug patterns from real audits: missing caller checks, unvalidated PoolKeys, leaky delta accounting, logic in the wrong callback, mismatched permission bits.
blog.trailofbits.com/2026/07…
Jeff Security retweeted
The security review of @rini_xyz is complete.
The Vault OS for Hyperliquid: deploy, manage, trade and distribute trading vaults on Hyperliquid, with custom fees, daily payouts with HIP-3 and HIP-4 access.
Read the full report 👇
github.com/shieldify-securit…
Jeff Security retweeted
Another Robinhood audit report is live 🍄
We completed the security review of @shroomsdotfun, giving token and NFT communities a home on @RobinhoodApp with holder gated rooms, in-app trading, tipping and a built-in launchpad 🤝
Read the full report 👇
github.com/shieldify-securit…
Chess engines didn't kill chess, they made players sharper. Fuzzers, symbolic execution and AI auditors won't kill security research either. Humans who use them will outplay humans who don't♟️
Jeff Security retweeted
Everyone's looking for the next 100x token
The real 100x is learning to find Critical bugs in the smart contract those tokens run on
Security researchers have been getting rich in web3 for years. No scamming anyone, just skill
Start today 🫡
