3yr speedrun auditor -> executive, ask me anything
October 2022 - started learning solidity as a hobby
March 2023 - focusing on security & began writing my "Deep Dive" series
October 2023 - blessed to join @cyfrin as a full-time smart contract security researcher!
🚀A lot can change in a year if you put your mind to it🚀
Oct 9, 2026 · 12:26 PM UTC
16
2
69
4,084
@DevDacian Congrats man, love your work 🫡
We started around the same time
We started around the same time
1
0
5
417
@DevDacian Congrats Dacian!
Curious what other skills / habits were key to make as a executive once you knew how to find bugs
Curious what other skills / habits were key to make as a executive once you knew how to find bugs
1
0
3
467
@GalloDaSballoience/understanding how to run a profitable business, correct decision making on tricky decisions, consistent revenue/business growth over time.
basically in any business if you can build a systematic operation which makes that business systematically grow bringing in more $ over time then you will likely be promoted and eventually become an executive if you can keep doing that especially in bear markets.
at the end of the day businesses need to make $ and the people who can help them scale, function well operationally, bring in tons of $ etc typically get promoted.
basically in any business if you can build a systematic operation which makes that business systematically grow bringing in more $ over time then you will likely be promoted and eventually become an executive if you can keep doing that especially in bear markets.
at the end of the day businesses need to make $ and the people who can help them scale, function well operationally, bring in tons of $ etc typically get promoted.
0
0
9
332
@DevDacian Congrats Dacian! When reviewing a junior auditor's work, what tells you their reasoning is improving before their finding count goes up? I would be interested in how you assess the hypotheses they ruled out, and whether they ruled them out correctly.
1
0
2
363
@RealJohnnyTimeith juniors so that isn't applicable for us.
What I'm looking for in auditor performance are things like:
* finding high-value findings missed by our internal AI & human teammates
* doing high-quality peer-review finding and correcting errors in other teammate findings, leveraging teammate findings into higher severity issues, finding new impacts etc
* good communication, work well as both individual & team
* different ways of thinking, different methodologies (if everyone thinks the same way they all find the same bugs, so diversity of thought is very useful)
* proven speciality/expertise - some auditors just perform much better on certain protocol types than others, which helps me pick the best suited team for each audit
What I'm looking for in auditor performance are things like:
* finding high-value findings missed by our internal AI & human teammates
* doing high-quality peer-review finding and correcting errors in other teammate findings, leveraging teammate findings into higher severity issues, finding new impacts etc
* good communication, work well as both individual & team
* different ways of thinking, different methodologies (if everyone thinks the same way they all find the same bugs, so diversity of thought is very useful)
* proven speciality/expertise - some auditors just perform much better on certain protocol types than others, which helps me pick the best suited team for each audit
1
0
8
357
@DevDacian I still remember watching that 2023 Opensense video and thinking, “this guy is gonna kill it”
so I’m not surprised at all lol
great job!
so I’m not surprised at all lol
great job!
1
0
2
114
@0xDmitry thank you for the kind words, I worked harder than I ever have over the last 3 years and thankfully it worked out 🙏
0
0
1
101
@DevDacian want to learn to how you see the code when analyzing it. what did you see if you see any encounter or invarient like require == condition; this = this how you see the invarient so you can think of attack vector into a contract when you are seeing a function what you think ofit
2
0
5
190
@yoursbyteomes naturally to me by now, breaking code is just intuitive, part of my very being.
whenever i'm reading code i just ask lots of questions like "what X happens ?" or "could Y happen?" then answer them.
one thinking technique that might be useful to you is to try to work backwards, eg imagine that your exploit scenario (tokens drained) happened, then try and work backwards from that to figure out how it happened (or prove to yourself it cant happen).
basically every really interesting bug needs a set of preconditions to trigger so if you work backwards from the bug when you can reverse-engineer the preconditions if they are possible.
whenever i'm reading code i just ask lots of questions like "what X happens ?" or "could Y happen?" then answer them.
one thinking technique that might be useful to you is to try to work backwards, eg imagine that your exploit scenario (tokens drained) happened, then try and work backwards from that to figure out how it happened (or prove to yourself it cant happen).
basically every really interesting bug needs a set of preconditions to trigger so if you work backwards from the bug when you can reverse-engineer the preconditions if they are possible.
1
1
8
293
@DevDacian I want to learn how to reproduce vulnerabilities on mainnet forks. If you're using AI to find bugs, how do you validate and reproduce an exploit against the actual on-chain state at a specific block?
Most PoCs AI generates in Foundry turn out to be false positives.
Most PoCs AI generates in Foundry turn out to be false positives.
2
0
2
41
@Upgrade0x10he PoCs your AI is generating are false positives, the problem is with your AI/workflow/process/etc lol
we are focused purely on private audits so most of the time the code we are auditing hasn't been deployed, so fork tests arent possible.
that said sometimes we are auditing upgrades and/or some code has already been deployed so in that case we just use fork test PoCs as appropriate.
we are focused purely on private audits so most of the time the code we are auditing hasn't been deployed, so fork tests arent possible.
that said sometimes we are auditing upgrades and/or some code has already been deployed so in that case we just use fork test PoCs as appropriate.
0
0
2
39
@thongtrungtran this year we've already expanded our full-time team from 5 -> 8 so it is unlikely we will hire additional full-time SRs during the remainder of this year unless there was a really special circumstance.
next year will be more likely that we'll open the books again for full-time
next year will be more likely that we'll open the books again for full-time
0
0
7
163
@kamensec never lol, bling/fancy cars/etc have no appeal to me. if you saw me on the street you'd never know i'm top 1% which is exactly how i like it
2
0
6
338
@DevDacian hey dacian , any advice for one starting rn? ,is the roadmap for learning still same ?,should one learn Auditing as a sole skill or ,as a side to something major
1
0
2
199
@iam_daveeg from zero, it would likely help to work through the updraft auditor track (updraft.cyfrin.io/career-tracks/…).
After that you'd ideally do some shadow famous shadow audits like Codehawks Beedle & Sherlock USSD since those codebases are public & had tons of bugs.
You still need to learn to think like an attacker, and how to find all sorts of bugs etc - that base still needs to be built if you are starting from zero.
Once the base is built you need to build a portfolio of work and a brand/reputation, likely bug bounties are the brutal way to achieve this now. Obviously you also need to learn how to make AI work well integrating it into your particular style.
It is definitely MUCH harder now to make it from zero and the rewards are much less than before as well. Anyone starting from zero now should think really carefully about finding something else to do.
After that you'd ideally do some shadow famous shadow audits like Codehawks Beedle & Sherlock USSD since those codebases are public & had tons of bugs.
You still need to learn to think like an attacker, and how to find all sorts of bugs etc - that base still needs to be built if you are starting from zero.
Once the base is built you need to build a portfolio of work and a brand/reputation, likely bug bounties are the brutal way to achieve this now. Obviously you also need to learn how to make AI work well integrating it into your particular style.
It is definitely MUCH harder now to make it from zero and the rewards are much less than before as well. Anyone starting from zero now should think really carefully about finding something else to do.
2
0
3
203
@DevDacianfor the opportunity, Dacian!
Our question is this: do you think your role (the human in the loop responsible for coordinating multiple agents) could in the future be replaced by another agent? That would turn the whole process into something like Agent as a Service (AaaS), where projects just plug in their repo and the system runs the audit autonomously. Or do you feel humans will always need to remain in that loop?
Our question is this: do you think your role (the human in the loop responsible for coordinating multiple agents) could in the future be replaced by another agent? That would turn the whole process into something like Agent as a Service (AaaS), where projects just plug in their repo and the system runs the audit autonomously. Or do you feel humans will always need to remain in that loop?
1
0
1
68
@TheSageAudits skilled human + ai will always have an edge over ai.
I've said before that the future of this industry is whitehate ai vs blackhat ai, with teams of elite humans behind them
I've said before that the future of this industry is whitehate ai vs blackhat ai, with teams of elite humans behind them
0
0
1
58
@DevDacian how do you approach learning something new and deciding whether it’s worth your time?
1
0
1
79
@teoslaf1 all about market demand + personal interest.
to learn anything new i need to have a personal interest in it plus strong confidence in why there already exists or will exist strong market demand for it.
to learn anything new i need to have a personal interest in it plus strong confidence in why there already exists or will exist strong market demand for it.
0
0
1
83
@DevDacian What is your step by step process when using ai to audit?
1
0
1
133
@JimmyBrown35334oo much away, what I can say is this:
1) finding bugs is basically just asking the correct questions then doing the work required to answer those questions
2) there are probably bugs you know you can find, so think about the most efficient way to automate AI finding them
3) AI works best when the questions are as directed/focused as possible
4) try using AI to ask it lots of very specific questions
5) once something works, think about how to combine it with other things into an automated workflow that you can just run
6) dont trust anything one model tells you, employ multiple models for cross-model review to reduce error rates and think about how to automate this process as well
1) finding bugs is basically just asking the correct questions then doing the work required to answer those questions
2) there are probably bugs you know you can find, so think about the most efficient way to automate AI finding them
3) AI works best when the questions are as directed/focused as possible
4) try using AI to ask it lots of very specific questions
5) once something works, think about how to combine it with other things into an automated workflow that you can just run
6) dont trust anything one model tells you, employ multiple models for cross-model review to reduce error rates and think about how to automate this process as well
1
1
4
209
@DevDacian Hi, I have 2:
1. If you were hiring for an SR position, what would your ideal candidate look like?
2. Let's say you started learning Solidity as a hobby 6 months ago. What would your plan be to work your way up as a SR?
Thanks
1. If you were hiring for an SR position, what would your ideal candidate look like?
2. Let's say you started learning Solidity as a hobby 6 months ago. What would your plan be to work your way up as a SR?
Thanks
1
0
1
103
@n0fr33w1f14unswered in another reply in this thread.
1. firstly I only hire from our Eagles program, which is our contractor pool (we typically pair our full-time auditors with different specialist Eagle contractors to create unique teams suited to every engagement.
So a full-time SR first needs to be a high-performing Eagle. If you aren't an Eagle already it is almost impossible to become one, unless the opportunity arises where we need additional auditor supply or a super niche skill that is hard to find.
Secondly I look for more than just auditing skills; full-time SRs need to lead client engagements so they need to have good spoken english, decent people skills, able to follow clearly defined processes to take an engagement from start to successful completion etc.
Thirdly I look for attitude and culture fit; we want to work with people who love this work, who are self-driven, self-motivated, trustworthy, capable people who don't need micro-management and always trying to get better.
1. firstly I only hire from our Eagles program, which is our contractor pool (we typically pair our full-time auditors with different specialist Eagle contractors to create unique teams suited to every engagement.
So a full-time SR first needs to be a high-performing Eagle. If you aren't an Eagle already it is almost impossible to become one, unless the opportunity arises where we need additional auditor supply or a super niche skill that is hard to find.
Secondly I look for more than just auditing skills; full-time SRs need to lead client engagements so they need to have good spoken english, decent people skills, able to follow clearly defined processes to take an engagement from start to successful completion etc.
Thirdly I look for attitude and culture fit; we want to work with people who love this work, who are self-driven, self-motivated, trustworthy, capable people who don't need micro-management and always trying to get better.
0
0
2
98
