Pinned Tweet
Started working on github.com/joswha/Secure-…. It's reflected on the gitbook page: vladtoie.gitbook.io/secure-coding/ #appsecurtity #blueteam #securecoding
5
21
60
vlad retweeted
Very cool experiment! And it is fun that it is in a similar area to BLAKE3-Servil, which @LinkedEric and I talked about on a panel at Zcash Zcon 7 in Cancún a couple of days ago!
We verified the end-to-end execution of an x86 statically linked glibc binary, compiled from the following source code.
This is a simple program that reads a name into an allocated buffer, and prints out at the end whether an admin flag is set.
From the code it seems clear this admin variable is never modified, and the read() call limits user input to the size of the malloc’d buffer, preventing any overflows.
But what does this look like at the machine code level?
4
5
25
3,774
check this out brah
x86 formal verification is coming!
The (first?) published machine-checked proof of a security property for the end-to-end execution of a Linux process running an x86 binary statically linked against glibc.
And we believe it scales!
A joint research project with @zellic_io 🧵👇
1
0
5
173
vlad retweeted
A malicious dApp shows a harmless call.
You click Sign.
It adds a second transaction, and the wallet signs both.
Your account is now empty.
V12 found this and four more Ambire Wallet bugs, including one that lets a malicious subdomain sign into a dApp as you.
Here’s how:
You click Sign.
It adds a second transaction, and the wallet signs both.
Your account is now empty.
V12 found this and four more Ambire Wallet bugs, including one that lets a malicious subdomain sign into a dApp as you.
Here’s how:
4
3
28
3,696
google just released a surprisingly cool “async” agentic tool; seems like a particularly good way of dynamically finding & testing edge cases in the recent changes u made to the codebase jules.google
1
0
5
239
honored to be part of the v12 team 🫡 more coming soon
Bad auditors miss obvious bugs. We built an AI tool that finds them.
Introducing V12: the only autonomous Solidity auditor that actually finds Highs and Criticals.
We'll be releasing it for free.
V12 finds Crits in Zellic audits, High/Mediums in Cantina, and a bug in Pendle.
0
0
8
499
vlad retweeted
Code4rena will run audit contests for free, as public goods.
100% of funds from sponsors will go directly to auditors and judges. We won't take any cut.
Why?
1. Competitions are commodities.
They're CRUD apps. Why should builders pay premium for a website just to submit bugs? s without VC funding.
2. Everyone deserves competitions.
We tell all our clients to get a competition after their audit. That's because competitions simulate real world conditions, where there's thousands of eyes on a protocol. We want to make competitions as affordable as possible so everyone can get one.
3. It benefits our wardens.
In 2021, we invented the competition format. We're still the platform with the largest auditor pool (10,000+ registered). Not only should builders have access to the best security talent, we believe auditors should have opportunities to work with great projects. Opening up our platform benefits our wardens.
How will you afford this?
Zellic is a profitable business. We make money doing traditional private audits through Zellic and Zenith. This benefits us because: (1) our clients are more secure after they run contests, and (2) Code4rena is a talent pipeline for Zenith.
Will you stop maintaining the platform?
Of course not. Since we acquired Code4rena, we've shipped several features and have several more already underway. C4 has a dedicated dev team that we're fully committed to.
Besides, many of our clients at Zellic use C4. We're incentivized to make sure the platform works well. It's just that now we're allowing everyone to benefit from our investments in Code4rena.
In conclusion:
Run a contest on Code4rena! We won't take a cut, your prizes will go directly to wardens and judges.
For full details, check out our blog post here: zellic.io/blog/code4rena…
100% of funds from sponsors will go directly to auditors and judges. We won't take any cut.
Why?
1. Competitions are commodities.
They're CRUD apps. Why should builders pay premium for a website just to submit bugs? s without VC funding.
2. Everyone deserves competitions.
We tell all our clients to get a competition after their audit. That's because competitions simulate real world conditions, where there's thousands of eyes on a protocol. We want to make competitions as affordable as possible so everyone can get one.
3. It benefits our wardens.
In 2021, we invented the competition format. We're still the platform with the largest auditor pool (10,000+ registered). Not only should builders have access to the best security talent, we believe auditors should have opportunities to work with great projects. Opening up our platform benefits our wardens.
How will you afford this?
Zellic is a profitable business. We make money doing traditional private audits through Zellic and Zenith. This benefits us because: (1) our clients are more secure after they run contests, and (2) Code4rena is a talent pipeline for Zenith.
Will you stop maintaining the platform?
Of course not. Since we acquired Code4rena, we've shipped several features and have several more already underway. C4 has a dedicated dev team that we're fully committed to.
Besides, many of our clients at Zellic use C4. We're incentivized to make sure the platform works well. It's just that now we're allowing everyone to benefit from our investments in Code4rena.
In conclusion:
Run a contest on Code4rena! We won't take a cut, your prizes will go directly to wardens and judges.
For full details, check out our blog post here: zellic.io/blog/code4rena…
98
121
758
209,182
vlad retweeted
we've been
thinking about this since a long time
talking around it since ~ a year
planning it in the past few months
now actively working to make it happen!
here we go
📢ETHCluj Conference
🗓️June 26-28, 2025
📍@ Technical University of Cluj-Napoca Hub
🔗ethcluj.org
thinking about this since a long time
talking around it since ~ a year
planning it in the past few months
now actively working to make it happen!
here we go
📢ETHCluj Conference
🗓️June 26-28, 2025
📍@ Technical University of Cluj-Napoca Hub
🔗ethcluj.org
14
8
54
11,203
Very practical learning tool
Say hello to Optimal Think, a structured approach to extracting maximum value from any situation.
cristivlad.substack.com/p/say-hello-to…
0
0
1
250
Got fed up with keeping audit notes all over the place and decided to build Noteour: the light-weight VSCode extension for collecting notes during code reviews. 🧵
1
1
4
1,576
The extension is still under development, however a beta version is available on the Visual Studio Marketplace:
marketplace.visualstudio.com/items?itemName…
marketplace.visualstudio.com/items?itemName…
1
0
0
162