hasanza

Blockchain Security Researcher
Fellow @yAcademyDAO
Tweets and opinions are my own.
I (sometimes) write at |

[hasanza @0xProtosec]

Using literals in your smart contracts? Time to go back and take another look 👀.

Introducing my latest publication:

Solidity Quirks: Literals and Mobile Types

Credit goes to @paladin_marco for his tweet highlighting the issue.

https://t.co/iQhfQJ9OzK

[hasanza @0xProtosec]

@ProgrammerSmart @cantinasecurity That's unfair.

[hasanza @0xProtosec]

I believe that the metric hasn't changed. One still has to build non-trivial, interesting things. What's changed is that now you have to be able to explain what you built down to the smallest primitive, because anyone can ship a vibe-coded app.

Also, in the longer term, the slop debt is going to need repayment, and the pool of engineers who can actually reason about systems is shrinking. So yea, keep building, developing deep familiarity with systems, and publishing your learnings.

[hasanza @0xProtosec]

@jeffsecurity Lmaoo "teamz" 😂

[hasanza @0xProtosec]

@Jeyffre @RareCodeAI Working through the rarecode Rust course (50.2% completed) and I have to agree with this. Do the rust course, then rustlings, then go and build sth is what I'd suggest.

[hasanza @0xProtosec]

They never were intelligent to begin with (insert astronaut holding a gun to another astronaut's head meme).

But yea, I agree. Cost is creeping up for these AI companies. Gotta break even some how. As a potential workaround, look into harness engineering. Basically, constraining the model to get the most out of each token.

[hasanza @0xProtosec]

@Jeyffre I believe that this would necessitate getting better at AI harnesses so that we get the most out of the model with the same amount of tokens. In fact, "harness engineering" is sth that is emerging as a lucrative skill set.

[hasanza @0xProtosec]

@danielvf I went with option A. Complex protocols jump through a lot of hoops to keep the contract size in check (diamonds, etc.), potentially increasing vuln. risk. a 10% size reduction means an extra 2.4KB to work with, which is considerable, and (potentially) safer contracts.

[hasanza @0xProtosec]

@real_philogy @ddimitrovv22 Partially agree. In the process of getting better and better at Solidity, devs will gain closer familiarity with EVM. The target machine will stay the same even when Solidity is replaced, so the EVM knowledge will carry over.

[hasanza @0xProtosec]

@ddimitrovv22 Agree. The majority of DeFi TVL is on Ethereum and it's only going to increase (going by the trends + Solidity being easier to get into for web2.0 devs compared to Rust and other web3 languages).

[hasanza @0xProtosec]

@immunefi has to be @Ehsan1579

[hasanza @0xProtosec]

@xKeywordx @PatrickAlphaC Completely agree. The "ship fast" mentality doesn't work with web3.

[hasanza @0xProtosec]

@PatrickAlphaC Arguably, the biggest "tool" attackers have is incentive. They have a lot to gain from successful attacks. Protocols have to make security more attractive for white hats. This space needs more people, more onboarding resources, and more incentive.

[hasanza @0xProtosec]

@Jeyffre Personally, I am very averse to any form of gambling, which predictions markets are. Could there be a way to incentivise "crowd wisdom" without wagers?

[hasanza @0xProtosec]

So @AftermathFi just got exploited for $1.14m.

The vulnerability was apparently in their perps code, which allowed "to set negative builder codes fees". It's worth noting that the project is deployed on Sui and the contract in question appears to be immutable.

The signal is strong. Web3 security is still undervalued as a service. Companies need to opt for audits and public contests, and must treat these as a fixed cost of existing on public blockchains.

[hasanza @0xProtosec]

@Jeyffre Fully agree with the take. It's crazy that these big AI companies are yet to break even, let alone turn a profit. It also remains to be seen how their customers react once the price is jacked up to realistic levels.

[hasanza @0xProtosec]

@hrkrshnn @lonelysloth_sec Hmm, so what should one use if one is serious about AI use/research? Are frontier models available to the general public?

[hasanza @0xProtosec]

@elonmusk How would we deal with the resulting demand-pull inflation?

[hasanza @0xProtosec]

@Jeyffre A security OG once told me to understand a new codebase through the test suite. Look at the unit tests to understand the intended logic and go from there. Of course, this requires the codebase to have a test suite. But the principle stands.

[hasanza @0xProtosec]

So those aspiring to enter web3 sec should instead pivot to building AI products? That would be a sharp pivot. Though such pivots are not something uncommon in this industry.

Also, one can make the case that the more AI is used for security, the weaker the security acumen of SRs becomes, until important knowledge gets forgotten, reliance on AI tools increases, which in turn get worse over time due to their maintainers/developers having impaired understanding (the cycle continues). The fact is that despite the impact created by LLMs, they are probabilistic systems (their outputs are not deterministic) at the end of the day, and remain dependent on their training data.

I think that AI model tuning would be a skill that would need to be learned and honed by domain experts, but domain expertise would continue to be needed, and AI tools would need to be continuously retuned as new vectors emerge. Companies need to continue focusing on producing and sustaining domain experts.