Team of experts doing security audits right. 🤝 Trusted by @origami_fi, @letscashfun, @ClutchMarkets & @ponsdotfamily. https://xitter.cf/t.co/eVpq3lxXAY
Joined November 2023
- Tweets417
- Following46
- Followers2.1K
- Likes1.2K
SBSecurity retweeted
You'd be amazed how many bugs sit in live contracts.
- 90% aren't critical. Still impactful.
- 10% drain funds.
We keep pointing our AI auditor at deployed code, and everything worth reporting gets disclosed.
You should too.
Cover as much ground as we can. That's the point.
In 3 weeks, our AI auditor found 2 High and 14 Medium issues that prior audits missed.
The protocols we scanned:
- Went through 2025 C4 contests
- Were audited by tier-1 firms we admire
Most issues were in code that's live with real TVL. All responsibly disclosed.
That's not a knock on anyone.
Audits have limits, and deployed code deserves more eyes.
The more of us hunting, the fewer nine-figure hacks.
We hope more researchers point their tools at live protocols too.
If your protocol is deployed and you're wondering what slipped through your last audit, DM us.
We'll run a pass and show you what we find. 🫡
You'd be amazed how many bugs sit in live contracts.
- 90% aren't critical. Still impactful.
- 10% drain funds.
We keep pointing our AI auditor at deployed code, and everything worth reporting gets disclosed.
You should too.
Cover as much ground as we can. That's the point.
In 3 weeks, our AI auditor found 2 High and 14 Medium issues that prior audits missed.
The protocols we scanned:
- Went through 2025 C4 contests
- Were audited by tier-1 firms we admire
Most issues were in code that's live with real TVL. All responsibly disclosed.
That's not a knock on anyone.
Audits have limits, and deployed code deserves more eyes.
The more of us hunting, the fewer nine-figure hacks.
We hope more researchers point their tools at live protocols too.
If your protocol is deployed and you're wondering what slipped through your last audit, DM us.
We'll run a pass and show you what we find. 🫡
SBSecurity retweeted
Security Alpha:
If you open an audit report and the audit findings start with:
- Potential
- Maybe
- Possible
The job is half-finished.
An auditor's job is to decide: exploitable or not. There's no in-between.
Security Alpha:
If you open an audit report and the audit findings start with:
- Potential
- Maybe
- Possible
The job is half-finished.
An auditor's job is to decide: exploitable or not. There's no in-between.
SBSecurity retweeted
Robinhood Chain is the hooks chain.
Builders are shipping Uniswap v4 integrations like crazy.
Most underrated way a v4 hook breaks?
A) Reentrancy during unlock callbacks
B) Fee/accounting rounding
C) Bad PoolManager assumptions
Real example from our reports 👇
SBSecurity retweeted
@ClutchMarkets's Smart LP v2 report is public.
They did a great job fixing every issue before launch.
That's how you raise the standard.
Proud to keep securing @OxSimpleFarmer's innovations.
Full report 👇
SBSecurity retweeted
This is really cool bug in GoldPesa uni v4 hook
Attacker took a 175k USDC flash loan from Morpho and opened one-sided liquidity position in WETH/USDC pool below the price range using `MINT_POSITION`, skipped `SETTLE_PAIR` which created ~115k USDC unpaid debt on the shared POSM
Your v4 hook can pay the attacker's debt.
GoldPesa on @base lost ~$115K.
Hook rebalanced inside someone else's unlock.
Deltas are shared across the whole unlock.
Attacker's unpaid debt got settled by the hook.
Always assume PoolManager can be used for cross-function reentrancy.
SBSecurity retweeted
Your v4 hook can pay the attacker's debt.
GoldPesa on @base lost ~$115K.
Hook rebalanced inside someone else's unlock.
Deltas are shared across the whole unlock.
Attacker's unpaid debt got settled by the hook.
Always assume PoolManager can be used for cross-function reentrancy.
Your v4 hook can pay the attacker's debt.
GoldPesa on @base lost ~$115K.
Hook rebalanced inside someone else's unlock.
Deltas are shared across the whole unlock.
Attacker's unpaid debt got settled by the hook.
Always assume PoolManager can be used for cross-function reentrancy.
AI still writes buggy code.
If you let it.
We've audited fully AI-written codebases with zero serious issues.
At the same time, teams on the same models are shipping 10+ Highs.
SBSecurity retweeted
5 bugs we keep finding in @Uniswap v4 hooks
9 v4-hook protocols we audited in the last quarter, 38 v4 findings: 1 Critical, 14 High, 23 Medium.
The core protocol held up every time. Every bug was in the code around it.
The same 5 classes keep coming up ↓
We audited 3 protocols with UniV4 hooks in 2 months.
21 hook-related findings:
- 1 Critical
- 7 High
- 13 Medium
Write-up on the most common hook issues coming.
Took us a while, but here it is.
The write-up is live, with data from 9 protocols and 38 findings:
xitter.cf/SBSecurity_/status/210…
5 bugs we keep finding in @Uniswap v4 hooks
9 v4-hook protocols we audited in the last quarter, 38 v4 findings: 1 Critical, 14 High, 23 Medium.
The core protocol held up every time. Every bug was in the code around it.
The same 5 classes keep coming up ↓
5 bugs we keep finding in @Uniswap v4 hooks
9 v4-hook protocols we audited in the last quarter, 38 v4 findings: 1 Critical, 14 High, 23 Medium.
The core protocol held up every time. Every bug was in the code around it.
The same 5 classes keep coming up ↓
5. Fixed MEV caps don't hold on thin pools.
"Max 1 ETH per swap" looks safe until it's a fresh launch pool with a few ETH of depth.
Sandwich profit follows size vs depth:
Shallow pool → cap-sized swap → big price move → big sandwich
Cap by price impact, not a constant.
The PoolManager protects its own invariants. Not yours.
If you're building around @Uniswap v4, we're your security guys.