Eight years of work to defend against a computer that doesn’t exist yet.
NIST started standardising post-quantum algorithms in 2016. The first standards landed only in 2024.
If you verify signatures on-chain, the next step affects you directly.
A big theme of Day 1 at step: preparing Ethereum for the post-quantum era. New cryptography is being built with formal verification in mind.
The bar goes up. The risk doesn’t disappear; it moves:
→ a proof is only as good as the spec it checks against → serialisation, key handling, and client or contract integration often remain outside the proof
→ signatures get much bigger: ECDSA 65 B vs. ML-DSA 2.4 KB+ and SLH-DSA 7.8 KB+.
For contracts adopting these schemes, that changes calldata, verification, and gas costs.
Writing signature verification today? Enforce the exact encoding of every algorithm you support, but keep the interface versioned and extensible so new algorithms can be added safely.
Verified crypto plus audited integration. You need both.
NIST started standardising post-quantum algorithms in 2016. The first standards landed only in 2024.
If you verify signatures on-chain, the next step affects you directly.
A big theme of Day 1 at step: preparing Ethereum for the post-quantum era. New cryptography is being built with formal verification in mind.
The bar goes up. The risk doesn’t disappear; it moves:
→ a proof is only as good as the spec it checks against → serialisation, key handling, and client or contract integration often remain outside the proof
→ signatures get much bigger: ECDSA 65 B vs. ML-DSA 2.4 KB+ and SLH-DSA 7.8 KB+.
For contracts adopting these schemes, that changes calldata, verification, and gas costs.
Writing signature verification today? Enforce the exact encoding of every algorithm you support, but keep the interface versioned and extensible so new algorithms can be added safely.
Verified crypto plus audited integration. You need both.
1
0
3
128
@safe @rsquare @SafeLabs_ Forward defence is how you survive a long innings. When multisigs guard billions, every ball counts.
See you at the keynote 🏏
See you at the keynote 🏏
0
0
1
14
@EliBenSasson Respect for sticking with it through the doubts. Good to see it pay off.
0
0
1
88
Turns out we match the Devcon volunteers.
Not a bad match, actually. Same mission: getting builders where they’re going, safely. 🟣
Not a bad match, actually. Same mission: getting builders where they’re going, safely. 🟣
0
0
3
132
@pollar_xyz @EFDevcon Awesome, another person who made it over from Meridian! Let's have a chat. 🟣
0
0
3
36
Your job: make it work.
Ours: imagine how it could fail.
Neither is enough alone. Together, that’s purple teaming.
@EFDevcon starts today. Tell us what you’re building and we’ll swap notes on what we’ve been seeing lately.
Find us there. We’re the ones in purple. 🟣
Ours: imagine how it could fail.
Neither is enough alone. Together, that’s purple teaming.
@EFDevcon starts today. Tell us what you’re building and we’ll swap notes on what we’ve been seeing lately.
Find us there. We’re the ones in purple. 🟣
1
0
2
77
AI agents move real liquidity in DeFi, yet nobody can tell a safe one from a reckless one.
We co-developed the @owneydotapp Trust & Security Framework for agentic DeFi. Now it’s up for a grant on @thedaofund to go open source and fully automated.
We co-developed the @owneydotapp Trust & Security Framework for agentic DeFi. Now it’s up for a grant on @thedaofund to go open source and fully automated.
2
2
8
307
Week in review at CODESPECT
Hacks shake trust. Builders rebuild it.
This week ended with the Binance hack, the largest crypto theft on record. The whole industry held its breath. But…
At Stellar Meridian, we saw the exact opposite: a drive to build and secure. Teams pitched products for emerging markets, new wallets, improvements to Soroban and easier ways for everyday people to get into crypto. Fear won’t keep chains running, let alone help them grow.
Keep building, but build securely. That’s the idea behind our new DeFa case study: a full audit on Starknet, our AI-assisted pre-review on Stellar. Same logic, two chains, two security lenses.
Q: How do builders earn trust after a week like this?
A: An audit is a good start, not the finish line. What comes next matters too: reviewing every later change (AI can help), putting upgrades behind a timelock, and protecting the keys that control them. Most of the biggest hacks did not start in the code. They started with a signer.
Trust is not claimed. It is verified.
Hacks shake trust. Builders rebuild it.
This week ended with the Binance hack, the largest crypto theft on record. The whole industry held its breath. But…
At Stellar Meridian, we saw the exact opposite: a drive to build and secure. Teams pitched products for emerging markets, new wallets, improvements to Soroban and easier ways for everyday people to get into crypto. Fear won’t keep chains running, let alone help them grow.
Keep building, but build securely. That’s the idea behind our new DeFa case study: a full audit on Starknet, our AI-assisted pre-review on Stellar. Same logic, two chains, two security lenses.
Q: How do builders earn trust after a week like this?
A: An audit is a good start, not the finish line. What comes next matters too: reviewing every later change (AI can help), putting upgrades behind a timelock, and protecting the keys that control them. Most of the biggest hacks did not start in the code. They started with a signer.
Trust is not claimed. It is verified.
0
1
4
165
A new day, a new conference!
CODESPECT is heading to Mumbai for @EFDevcon8!
Meet our CEO @talfao1 and CTO @jecikpo to talk about where Ethereum is moving and what it takes to keep it secure, from Solidity and Vyper codebases to L2s and the protocols built on top of them.
If reum, come find us between talks.
CODESPECT is heading to Mumbai for @EFDevcon8!
Meet our CEO @talfao1 and CTO @jecikpo to talk about where Ethereum is moving and what it takes to keep it secure, from Solidity and Vyper codebases to L2s and the protocols built on top of them.
If reum, come find us between talks.
1
2
6
234
Meridian is behind us. Then overnight, Binance lost ~$6.3B.
No smart contract bug. A hot wallet signed an EIP-7702 authorisation that delegated it to an attacker’s sweeper contract. Every deposit after that got drained.
Web3 security has two halves:
1. Opsec/backend: who and what can make your keys sign
2. On-chain: what your contracts let anyone do
For the second one, we built a Soroban Security Checklist for @StellarOrg builders.
Use it on contracts that are live now and on whatever you’re building next. Check the link to our website⏬
No smart contract bug. A hot wallet signed an EIP-7702 authorisation that delegated it to an attacker’s sweeper contract. Every deposit after that got drained.
Web3 security has two halves:
1. Opsec/backend: who and what can make your keys sign
2. On-chain: what your contracts let anyone do
For the second one, we built a Soroban Security Checklist for @StellarOrg builders.
Use it on contracts that are live now and on whatever you’re building next. Check the link to our website⏬
3
0
2
344
AI security harness for @StellarOrg (Soroban) smart contract audits, now live.
Our first run with @defaprimitive worked. Now we want more projects to test it.
First 3 Stellar teams with ready codebase to DM us or reach @talfao1 on Telegram get a free AI review.
At Meridian in Lisbon for the next few hours. Come find us. (purple codespect shirts)
Our first run with @defaprimitive worked. Now we want more projects to test it.
First 3 Stellar teams with ready codebase to DM us or reach @talfao1 on Telegram get a free AI review.
At Meridian in Lisbon for the next few hours. Come find us. (purple codespect shirts)
0
0
9
431
Day 1 at Meridian (@StellarOrg), Lisbon. 🇵🇹
Justin Rice put it precisely this morning: builders are the “palace builders”, the core of the whole chain. Hard to disagree. A network is only as strong as the contracts people actually deploy on it.
Today showed us that projects on everywhere right now. In a few hours, we met more new projects building on Stellar than we usually come across in a month: payments, RWA, DeFi.
Different stages, same question underneath: how do we ship this so it holds up? That’s a question we’re happy to help answer.
Looking forward to the conversations that started today. See you tomorrow.
Justin Rice put it precisely this morning: builders are the “palace builders”, the core of the whole chain. Hard to disagree. A network is only as strong as the contracts people actually deploy on it.
Today showed us that projects on everywhere right now. In a few hours, we met more new projects building on Stellar than we usually come across in a month: payments, RWA, DeFi.
Different stages, same question underneath: how do we ship this so it holds up? That’s a question we’re happy to help answer.
Looking forward to the conversations that started today. See you tomorrow.
1
0
6
484
Meridian (@StellarOrg) side events start today, so a lot of Soroban code is about to get shown off.
Quick pre-deploy check worth running before you demo:
- Privileged functions call require_auth on the right address, not just any address
- Nothing that must persist lives in temporary storage. Once its TTL runs out, it’s gone for good
- update_current_contract_wasm is behind proper access control
- Custom balance logic handles from == to without corrupting state
We’re in Lisbon all week. Happy to go deeper on any of these in person.
Quick pre-deploy check worth running before you demo:
- Privileged functions call require_auth on the right address, not just any address
- Nothing that must persist lives in temporary storage. Once its TTL runs out, it’s gone for good
- update_current_contract_wasm is behind proper access control
- Custom balance logic handles from == to without corrupting state
We’re in Lisbon all week. Happy to go deeper on any of these in person.
1
0
3
112
@PropellerSwap Interesting design. The signature doesn’t cover the trader address. Is the 2 min window plus Router-only execution the intended protection against a leaked signature, or is there a cap on the signed fee too?
0
0
0
88
Read how both engagements ran: codespect.net/case-studies/d…
Building on Stellar or Starknet? Get the review before mainnet, not after: codespect.net/request-assess…
Building on Stellar or Starknet? Get the review before mainnet, not after: codespect.net/request-assess…
0
0
0
36