Smart Contract Auditing and Security Services 🛡️
Some Beach
Joined October 2021
- Tweets332
- Following434
- Followers4K
- Likes38K
OShield 🛡️ retweeted
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.
Reach out to Ledger customer support through official channels with any questions: support.ledger.com/
We completed an investigation into the Snapper DEX hack.
The attack was carried out by a developer operating under the alias "Tony" — identified through on-chain tracing, OSINT analysis, and direct collaboration with the affected team.
Findings have been independently reviewed by third-party security researchers.
Tony abused legitimate server access to steal the upgrade authority keypair and drain both protocols. He routed through a Polish IP to frame a teammate.
A misdirection that held until September 2024 until the connection was made when a salary address, verified against team Telegram records, sent funds directly to the same MEXC deposit addresses that received the stolen proceeds.
OSINT revealed a network of fabricated GitHub identities with links to other ecosystem teams, and indicators revealing a possible DPRK IT worker tradecraft consistent with Tony's behaviour as reported by the team.
We assisted the team in filing an IC3 complaint in 2024. We were informed recently that the investigation could not proceed further due to timing, scale, and possible state-actor involvement.
We are publishing our findings for full transparency and as a warning to the broader community.
Read the full report on our publications page 👇
github.com/oshieldio/Publica…
OShield 🛡️ retweeted
Governments are moving to mandate online age verification
We think this is the wrong decision, and we said so in our response to the United Kingdom's consultation
But if these mandates proceed, the way these systems are built will have consequences far beyond child safety
👇
OShield 🛡️ retweeted
UPDATE: Following earlier concerns by @oshield_io tied to the exploit, SolanaFloor has confirmed from its sources that the @DriftProtocol team is safe and not in any physical danger.
🚨BREAKING: @oshield_io says two Drift multisig keys appear to have been compromised, raising concerns the team’s physical security could be at risk, as the ongoing Drift exploit has now reached $285M.
Update — @DriftProtocol uses two different multisig wallets both with the same set of members.
1 ) Risk Council —
2-of-5 multisig that two of the keys were compromised to upgrade the program’s admin key and setup the vault for the scam token CVT
app.squads.so/squads/AiLGdNi…
1) Program Upgrade —
3-of-5 multisig that around an hour ago signed a transaction to upgrade the program. It was approved by the other 3 members apart from the confirmed 2 compromised members.
app.squads.so/squads/Ad21qwC…
Attacker most likely did not compromise all wallets as the program upgrade seems to be benevolent.
This is CRAZY!
Summary of the @DriftProtocol Exploit thus far:
1) Someone on Drift multisig has updated the drift state account to change the admin here.
solscan.io/tx/4BKBmAJn6TdsEN…
2) This member on the multisig approved the change
solscan.io/account/6UJbu9ut5…
3) And the current admin and attacker is this account.
solscan.io/account/H7PiGqqUa…
4) The attacker used this key to initialize spot market vault for a CVT ( scam propped up token) with high oracle price here.
solscan.io/tx/4a5962Rdqd9pkX…
5) Deposits CVT and withdraws actual tokens using the cross-margin and swap functionality on Drift.
6) Program upgrades is happening to regain back the admin as per our latest analysis.
Update —
The main issue is that two keys from the multisig has been compromised,
solscan.io/account/39JyWr…
And
solscan.io/account/6UJbu9…
Concerning that the physical security of the team might be in danger.
The main issue is that two keys from the multisig has been compromised,
solscan.io/account/39JyWr…
And
solscan.io/account/6UJbu9…
Concerning that the physical security of the team might be in danger.
Summary of the @DriftProtocol Exploit thus far:
1) Someone on Drift multisig has updated the drift state account to change the admin here.
solscan.io/tx/4BKBmAJn6TdsEN…
2) This member on the multisig approved the change
solscan.io/account/6UJbu9ut5…
3) And the current admin and attacker is this account.
solscan.io/account/H7PiGqqUa…
4) The attacker used this key to initialize spot market vault for a CVT ( scam propped up token) with high oracle price here.
solscan.io/tx/4a5962Rdqd9pkX…
5) Deposits CVT and withdraws actual tokens using the cross-margin and swap functionality on Drift.
6) Program upgrades is happening to regain back the admin as per our latest analysis.
Oshield is proud to partner with @solflare on security.
We audited Solflare Shield (hardware wallet) and Solflare Card (crypto debit card), confirming strong protections for users.
All critical and high-severity issues were patched before launch.
Security first. 🛡
We completed an audit of @DeFiTuna ‘s leveraged product. 2 critical vulnerabilities were identified alongside a number of high and medium severity level issues.
All bugs have been patched and fixes are implemented. Tuna is safely deployed on top of @FusionAMM markets and @orca_so whirlpools.
Read the full report on our publications page 👇
OShield 🛡️ retweeted
1/
guest lecture 10:
@solana security audits: what to do & what not to do
w/ David from @oshield_io (seasoned solana auditors)
🗓 wed, july 30
🕑 2:00–3:30pm cest
📍 meet.google.com/mik-dkfe-dwa
open to all.
JOIN
The audit of @FusionAMM, a hybrid orderbook AMM DEX by DefiTuna is now complete.
We identified and resolved 2 critical vulnerabilities to strengthen protocol security.
Read the full report on our Publications page! 🔗
✅ The audit of XDEX, involving staking, and farming smart contracts is now complete.
We reviewed the entire protocol suite to ensure security and reliability.
🔗 Read the full report here: github.com/oshieldio/Publica…
Congratulations to @thevaultfinance on launching the Liquid Unstaker!
OShield audited this program pre-launch, you can unstake with confidence!
Read the full report below 👇
Introducing the Unstake Pool - Instant Liquidity for Your Staked Assets
We are excited to launch Unstake Pool, a powerful new way to unstake your LSTs instantly - no delays, no cooldowns.
Whether you are reacting to fast-moving markets or just want liquidity now, Unstake Pool gives you immediate access to SOL in exchange for a small, dynamic fee.
1/5
