Pinned Tweet
gm!
time spent online is the time you LOST offline
so make sure you get outside, enjoy nature, eat some yummy food and have a fantastic time with your friends/family this weekend! :))
time spent online is the time you LOST offline
so make sure you get outside, enjoy nature, eat some yummy food and have a fantastic time with your friends/family this weekend! :))
2
1
10
992
Raiders retweeted
Happy to share, Cyfrin has wrapped our audit of @notesystems’ front-end, the app for their autocallable barrier notes on tokenized US equities.
Read the full report 👇
github.com/Cyfrin/cyfrin-…
Read the full report 👇
github.com/Cyfrin/cyfrin-…
Our frontend audit with @cyfrin is complete.
No critical or high findings, and all 7 medium findings resolved.
Report: gitlab.com/notesystems/no…
Our backend audit is in progress. Across 75 smart contracts, no high or critical issues found.
Mainnet is getting closer.
8
17
64
2,282
Raiders retweeted
3yr speedrun auditor -> executive, ask me anything
October 2022 - started learning solidity as a hobby
March 2023 - focusing on security & began writing my "Deep Dive" series
October 2023 - blessed to join @cyfrin as a full-time smart contract security researcher!
🚀A lot can change in a year if you put your mind to it🚀
16
2
69
4,084
genuine question for anyone running AI in their audit flow: how do you find the blindspots in the AI itself?
you only ever get to review what it reports back but whatever it didn't flag just passes through quietly & not many are checking that part.
that's usually what ends up live g then it's an incident instead of an audit finding.
you only ever get to review what it reports back but whatever it didn't flag just passes through quietly & not many are checking that part.
that's usually what ends up live g then it's an incident instead of an audit finding.
0
0
1
169
Raiders retweeted
I've pushed significant updates to coldclone, a very useful tool for sanitizing foreign repos before engaging with them.
If you're an auditor doing a lot of quoting or a dev downloading new repos to use, running this first is a no-brainer github.com/devdacian/cold…
If you're an auditor doing a lot of quoting or a dev downloading new repos to use, running this first is a no-brainer github.com/devdacian/cold…
6
6
66
3,769
Raiders retweeted
Happy to announce I've accepted an executive position @cyfrin, formally joining the leadership team as Head of Security Research.
We're working harder than ever to keep our clients safe while scaling our private audit business to handle epic demand.
🙏 Blessed 🙏
We're working harder than ever to keep our clients safe while scaling our private audit business to handle epic demand.
🙏 Blessed 🙏
79
9
352
7,295
lol, dot.com redirects to @grok bot now - absolute banger move by @elonmusk 🍿🍿
for the time being, let's move to Claude/Cursor until the dust settles and we get a clearer picture of the actual usability/reliability of everything they launched today?
for the time being, let's move to Claude/Cursor until the dust settles and we get a clearer picture of the actual usability/reliability of everything they launched today?
Announcing dots. Dots work 24/7 for you, learn from your feedback, have their own computer, browser and can be connected to over 4k apps in our ecosystem.
They’re powered by Astra our best model yet. Included in your Pro plan, without drawing down on any of your usage. You can even call a dot while it’s working.
We’re getting you started with your primary dot today and soon you’ll be able to create entire teams of them.
1
1
4
773
it seems like people aren't doing re-audits after big upgrades or waiting 3 to 6 months after going live as much as they could be.
finding a bug early is always cheaper than dealing with an exploit later on
^_-
finding a bug early is always cheaper than dealing with an exploit later on
^_-
1
2
6
545
so many security incidents happening - it's difficult to keep up with everything + the following updates
someone needs to pull the lever and seriously rate limiting attackers in the decentral region ;(
someone needs to pull the lever and seriously rate limiting attackers in the decentral region ;(
0
1
5
246
Are there any interesting public threat intelligence feeds you know of that provide amazingly fast web3 security/hack related intel/alerts and are useful? I'm thinking of integrating one on Digibastion.com/threat-intel so anyone can get a better picture for free and also set up email/Telegram alerts for them.
3
2
6
326
a minter key idle since March 2023 woke up last Saturday and minted 408 million NTX.
twenty-nine minutes earlier, another key drained ~8.7M FET from a related protocol & had the same wallet. Fetchai and NuNet became the victim - roughly $2M lost that night.
this year, stolen keys have overtaken contract bugs as the main source of DeFi losses.
audits still find issues within the code itself, but they aren't equipped to detect a dead key coming back online.
this is an area where the project needs to implement risk assessment and proactive monitoring.
so, let's split the signing process and cap the minting. we also need to implement real-time alerts for supply changes and privileged signers - that constitutes the remaining security stack we need to develop.
twenty-nine minutes earlier, another key drained ~8.7M FET from a related protocol & had the same wallet. Fetchai and NuNet became the victim - roughly $2M lost that night.
this year, stolen keys have overtaken contract bugs as the main source of DeFi losses.
audits still find issues within the code itself, but they aren't equipped to detect a dead key coming back online.
this is an area where the project needs to implement risk assessment and proactive monitoring.
so, let's split the signing process and cap the minting. we also need to implement real-time alerts for supply changes and privileged signers - that constitutes the remaining security stack we need to develop.
1
2
4
262
S&P just bought @OpenZeppelin last week.
a 165-year-old ratings firm is now treating smart contract risk like credit risk.
that’s the signal ^^
a 165-year-old ratings firm is now treating smart contract risk like credit risk.
that’s the signal ^^
0
3
10
591
Raiders retweeted
During this year's bear market @cyfrin grew our full-time SR team from 5->8 and revenue by 30%+ compared to last year.
Engaging 20+ auditors most weeks combining full-time & Eagles, we'll likely need to hire more full-time SRs next year.
Private audit business is BOOMING 🚀
Engaging 20+ auditors most weeks combining full-time & Eagles, we'll likely need to hire more full-time SRs next year.
Private audit business is BOOMING 🚀
5
5
94
2,411
The DAO is back with 2nd round to fund amazing EthSecurity ideas.
if you're keen on helping make Ethereum more secure and have some cool ideas, go ahead and submit your idea as an RFP!
it's a great chance to directly contribute :>
if you're keen on helping make Ethereum more secure and have some cool ideas, go ahead and submit your idea as an RFP!
it's a great chance to directly contribute :>
Onchain security is everyone’s problem and nobody’s job.
ETHSecurity Initiatives is how we are changing that.
Propose the work. Fund the work. Build the work.
initiatives.thedao.fund
0
2
3
226
Raiders retweeted
Welcome @cyfrin to the SEAL Certifications program! They’re now undergoing accreditation and taking on certification engagements.
Details on SEAL Certifications:
securityalliance.org/our-work/certi…
Details on SEAL Certifications:
securityalliance.org/our-work/certi…
0
6
38
3,022
for crypto projects, SEAL certification and SOC 2 aren't OPTIONALanymore.
they're how you prove your system is actually secure and transparent before asking people to put money into it.
if project skip this, then you're asking users to trust you on vibes, so do it right and you've built the trust layer mass adoption actually needs
LFGGGgg
they're how you prove your system is actually secure and transparent before asking people to put money into it.
if project skip this, then you're asking users to trust you on vibes, so do it right and you've built the trust layer mass adoption actually needs
LFGGGgg
0
0
2
195
love it - this is actually how exchange security should work
extra auth only on high-risk actions. session scoped so you can sign but not export & expires on its own.
most exchanges still give full access after one login which is bad
i'd recommend project ship this else NGMI
extra auth only on high-risk actions. session scoped so you can sign but not export & expires on its own.
most exchanges still give full access after one login which is bad
i'd recommend project ship this else NGMI
Introducing Multi-Factor Authentication and Scoped Sessions!
Programmable, per-action security controls for any Turnkey wallet.
0
0
4
382