cheng

web3 SR

[cheng @0x0xCheng]

Staying persistent and focused on making DeFi safer.
Grateful to @code4rena, @cantinasecurity, @philbugcatcher, @PatrickAlphaC 💪

[blue @bluewmist]

Someone said this to me & it hit me hard:

"If you knew how difficult and long it took some people to recover their peace of mind and happiness, you'll understand why they shut all doors at any potential negativity and also why they can be so selective about who they allow in their lives."

[Mitchell Amador @MitchellAmador]

https://t.co/rsFl9p3ntY

[cheng @0x0xCheng]

@0xaudron 😂😂😂

[cheng @0x0xCheng]

@sherlockdefi @metricxyz LFG!

[十一地主 @11dizhu]

昨天睡得早，今天早上五点半就醒了，也是睡饱了，感觉很不错，想着等会去看会儿书。妈妈给我买了水饺，说早上可以煮着吃，我前段时间学会了煮水饺，经过多次尝试，已经很会了。

不知道怎么的，比特币昨晚又大跌，收到一些人的留言，其中一个炫耀自己开空赚钱的，说自己看消息面结合布林线，k线，macd那些指数去做的；有人说自己熬夜看盘，我不知道战绩如何。

我看着别人在挣扎和努力，在熬夜和紧张兮兮，我觉得自己比他们幸福多了，因为昨晚我睡饱了，因为冰箱里有水饺，我身在局中，又跳了出来。当然我也在乎价格波动，在乎马斯克到底有没有砸盘，可是说到底，在乎这些，我能得到什么呢？

夏天的傍晚，云有一百种美法，看云的时候，我就得到了云的美。可是看盘的时候，我能获得什么呢？我一身疲惫，还一无所获，像是被魔鬼拿走了生命。可是看云的时候，我就得到了踏实的幸福。

我说过，自己的身体里没有“梦想、愿景和叙事”，没有“宏大的东西”，我有的是树叶、花和石头，它们和云一样，都是微小且具体的。我以前追逐梦想，和那些熬夜看盘的人是一样一样的，“年华虚度，空有一身疲倦”。可是当我拥抱具体的小事的时候，我就真的得到了。可能有人要问，那你也要生存的呀，总不能天天在自己的世界里不出来吧？我探出头去，看看价格，可我抓不住它们，于是我只能捡起石头，搭建自己的世界。

昨晚，我睡的很好，刚刚吃完了饺子。厨房很干净，冰箱里有冰淇淋，我看着书，抵御千变万化。

[cheng @0x0xCheng]

@11dizhu 写的真好

[A3R4H4M @abrahamonchain]

The Reality of Becoming a Top 1% Security Researcher

Most people think it's about intelligence.

It's not.

It's about surviving years of confusion, rejection, self doubt, and failure long enough to become dangerous.

Here's what nobody tells you

Let's dive in

➪ The internet only shows the wins.

You see:

➣ Accepted bug bounties

➣ Audit reports

➣ Conference talks

➣ Hall of Fame achievements

➣ Research publications

You don't see:

➣ 100+ rejected findings

➣ Failed exploit attempts

➣ Weeks spent understanding one vulnerability

➣ Thousands of lines of code read for nothing

Success is visible.

The struggle isn't.

➪ Security research will make you feel stupid.

A lot.

You'll open a protocol and understand absolutely nothing.

You'll read a Solidity function 20 times.

You'll stare at an exploit writeup for hours.

And you'll wonder if everyone else is smarter than you.

They're not.

They've just been confused longer.

➪ One lesson I learned:

Feeling lost is not a sign you're failing.

It's usually a sign you're learning.

The best researchers aren't the ones who avoid confusion.

They're the ones who stay with it long enough for understanding to emerge.

➪ Nobody talks about the 3 AM reality.

The monitor glow.

The cold coffee.

The failed PoC.

The endless transaction traces.

The attack path that doesn't work.

Then doesn't work again.

Then finally works.

The world sees the report.

You experience the thousand failures before it.

➪ Security research is mostly being wrong repeatedly until you're finally right.

That's the job.

Not glamour.

Not recognition.

Investigation.

➪ Most people don't fail because they lack talent.

They fail because they quit too early.

The learning curve is brutal.

Progress feels invisible.

Validation is rare.

Rewards are delayed.

So people leave.

The few who stay become dangerous.

➪ Consistency beats talent more often than people want to admit.

Read code every day.

Study exploits every week.

Write research publicly.

Repeat.

Small efforts compound.

➪ The most underrated security skill isn't intelligence.

It's curiosity.

Elite researchers ask questions longer than everyone else.

Why is this here?

Why is this unchecked?

Why did this exploit work?

Why did nobody notice?

Curiosity uncovers vulnerabilities.

➪ Most vulnerabilities hide inside assumptions.

Attackers know this.

Researchers should too.

➪ Another uncomfortable truth:

Security research is mostly pattern recognition.

The best auditors don't magically spot bugs.

They've simply studied enough failures to recognize familiar attack surfaces.

Experience is pattern recognition in disguise.

➪ Want to improve faster?

Study:

➣ Historical hacks

➣ Audit reports

➣ Post mortems

➣ Exploit writeups

➣ Attacker behavior

Every exploit teaches a lesson.

Every lesson becomes intuition.

➪ Let's talk about the emotional cost.

Nobody warns you about this part.

Security can be lonely.

You miss events.

You skip outings.

You spend weekends reading code.

Sometimes you become obsessed.

And sometimes that obsession is exhausting.

➪ Then imposter syndrome arrives.

You compare yourself to famous auditors.

Respected researchers.

Top bug bounty hunters.

You feel behind.

Here's the truth:

Even experts feel this way.

They just keep moving anyway.

➪ Top 1% doesn't mean:

➣ Knowing everything

➣ Finding every bug

➣ Never making mistakes

➣ Being a genius

Top 1% means:

➣ Showing up consistently

➣ Learning relentlessly

➣ Staying curious

➣ Refusing to quit

➪ If I could give one piece of advice to aspiring blockchain security researchers:

Stop chasing shortcuts.

Read code.

Study exploits.

Think like attackers.

Build things.

Break things.

Write about what you learn.

Depth beats hype.

Every time.

➪ One day people will see your audit reports, findings, and achievements.

They'll assume you were naturally gifted.

They won't see:

➣ The confusion

➣ The failures

➣ The rejected reports

➣ The late nights

➣ The moments you almost quit

But that's the reality of becoming a top 1% security researcher.

Not brilliance.

Persistence.

➪ The researchers who change the industry are rarely the smartest people in the room.

They're the ones who refused to leave the room.

If you're building a career in Smart Contract Security, Blockchain Security, or Web3 Security:

Keep going.

Your future expertise is being built in today's confusion.

Repost if you're on the journey.

[pashov @pashov]

Your focus and attention = your highest valued resources to give. Be careful what you give them to. Consume content, books, talks only from people who actually know, not from parrots.

Produce for hours, daily. Write, create, make decisions, take responsibility. Focus correctly🫡

[Fabrizio Romano @FabrizioRomano]

Cristiano Ronaldo, adding one more to his major trophies cabinet. 🏆🇵🇹

🏆🏆🏆🏆🏆 Champions League
🏆🏆🏆🏆 FIFA Club World Cup
🏆🏆🏆 Premier League
🏆🏆 UEFA Nations League
🏆🏆 La Liga
🏆🏆 Serie A
🏆🏆 Copa del Rey
🏆🏆 League Cup
🏆🏆 Spanish Super Cup
🏆🏆 Italian Super Cup
🏆🏆 UEFA Super Cup
🏆 Coppa Italia
🏆 Portugal Super Cup
🏆 FA Cup
🏆 Community Shield
🏆 UEFA Euros
🆕🏆 Saudi Pro League

[Dear Son. @DearS_o_n]

3. Do not date while you're broke, in terrible shape or your life chaotic. First get your life in order.

[Patrick Collins @PatrickAlphaC]

The trick is staying primed to recognize them when they show up.

Here are X lessons from this year that 21-year-old Patrick needed to hear.

1. 99% of the time, if something seems too good to be true, it is.

[SHERLOCK @sherlockdefi]

Code4rena helped define an important era of Web3 security.

They helped prove that open competition could find bugs traditional audits missed, that independent researchers could become one of the best sources of security talent, and that great audit talent can come from anywhere.

Respect to the C4 team and everyone who helped build that community.

Sherlock will keep pushing competitive security into its next era.

[Code4rena @code4rena]

An important update from the C4 team. 🧵

[Bitturing @Bitturing]

男人在默默成长的迹象，还没有人知道：

1. 他停止向所有人解释他的计划

[ddimitrov22 @ddimitrovv22]

"Contests are dead, there are no opportunities for new SRs" 🤡

The dead contests:
- $250 k pool that is already unlocked
- $1 M conditional but more likely to be unlocked
- $135 k pot that will most likely be unlocked
- another $100+ k in rewards

[Silvermist @0xSilvermist]

A few months ago, I was the one watching from the outside, thinking, "Everyone's winning, I'm still fighting." Now I'm the one with the win.

People see a five-figure win, and that's all they see - the win. But nobody sees what it actually costs.

For me, this win is:
- 2+ years in the space
- Multiple times, I almost gave up
- Countless moments where I had no idea how to keep going
- The thought "this isn't for me" on repeat

And honestly? I'm grateful for the almost. That word is everything.

A friend used to tell me: "You keep saying you're giving up. This is the third time I'm hearing it, but I don't care how many times you say it, I only care that I hear it, never see it."

And yet, I don't know exactly what kept me going. Probably stubbornness.

If you're somewhere in that spiral right now, thinking the same things I was thinking - keep going. Your win is waiting for you.

[cheng @0x0xCheng]

@anchabadze keep going,Success is inevitable!

[cheng @0x0xCheng]

@sherlockdefi LFG!

[Michael Saylor @saylor]

HODL