0xSlowbug 🥷

Finding vulnerabilities before attackers do | Smart Contract Security Researcher | ex @QuillAudits_AI | Solidity | Go | Move

[0xSlowbug 🥷 @0xSlowbug]

End of a chapter.

My time at QuillAudits has come to an end.

Grateful for the experience. I learned a lot and worked with an amazing team.

During this time, I:
- Completed over 14+ audits, uncovering multiple H/M/L issues
- Contributed to Quillshield AI. My work was crucial for the modification of V2 and laid the foundation for V3
- Found key edge cases across several products released at the time eg. Wachai, TokenSense, Quillcheck etc

[0xSlowbug 🥷 @0xSlowbug]

@Hoesenbug @ThePioneer2339 Here

[0xSlowbug 🥷 @0xSlowbug]

Been having a lot of questions about road map and how to learn web3 security.

On this thread I’ll be sharing every resource I have used. I’ll simplify it so you’d work with it in steps.

Follow the roadmap sequentially don’t skip any course!

#1

[0xSlowbug 🥷 @0xSlowbug]

@ThePioneer2339 Great roadmap

The findings will flow sir🫡

[0xSlowbug 🥷 @0xSlowbug]

@0x15_eth Seen some audit reports and it’s crazy

[0xSlowbug 🥷 @0xSlowbug]

@0x15_eth @Zcash @ipwning @ZcashCommGrants Hugeeee

Congratulations bro

[0xSlowbug 🥷 @0xSlowbug]

@Chimajax A lot of DLT contracts are written in go.

[0xSlowbug 🥷 @0xSlowbug]

@AmanKakar12 Thank you

[0xSlowbug 🥷 @0xSlowbug]

It's been a hell of a year.
Took sometime off hunting to learn various languages go, move and c++.

Studied DLT systems, crosschain bridges etc.
Restarting hunting with these arsenals.

Seen a lot of success stories... Its time to make mine
Will update here in 3 months

[0xSlowbug 🥷 @0xSlowbug]

@lhoussainePh Had a bad time with rust when I started auditing newly

Will learn it on the job

[0xSlowbug 🥷 @0xSlowbug]

@Testimony_kid Same here

[0xSlowbug 🥷 @0xSlowbug]

@0xclementine01

[0xSlowbug 🥷 @0xSlowbug]

@TheWeb3Mechanic I dey follow your footsteps

[0xSlowbug 🥷 @0xSlowbug]

@beatsieboyz - Basically articles
- Docs of the protocol
- Analyzed the commit before audits
- Studied the reports

For those that have been hacked. Studied the hacks and reproduce locally

[0xSlowbug 🥷 @0xSlowbug]

@0xpinkman Yeah
Will do

Need results from BB for this first then I begin

[0xSlowbug 🥷 @0xSlowbug]

@asen_sec Very good run

[0xSlowbug 🥷 @0xSlowbug]

@Cayden_Liao @immunefi You’re on fire 🔥

[0xSlowbug 🥷 @0xSlowbug]

@xBugSlayer @Nethermind @HackenProof Congratulations

[Sock @sockdrawermoney]

Or that contests remain the most effective form of audit when it comes to finding more bugs faster per dollar than any other method.

@zellic_io should open source the @code4rena platform and operational manual so projects or foundations or VCs or @ethereum or @_SEAL_Org can run these as I always felt they were: public goods. cc @samczsun

[0xSlowbug 🥷 @0xSlowbug]

Lots of bridge hacks happening.

If you own a bridge it’s time to re-audit those contracts properly again.

This is beyond asking audit firms to check if the bug in hacked contract A is in your own code.

[0xSlowbug 🥷 @0xSlowbug]

@0xShaedyW Hmmm

Complained about AI slop and spam

To become a top spammer

Irony of life

[0xSlowbug 🥷 @0xSlowbug]

@0xCharlesWang @sockdrawermoney @zellic_io @code4rena @ethereum @_SEAL_Org Love firms that do this

Run a contest on some of your audited contracts and be shocked on the number of issues that would be found.

Take into consideration that contest bug severity is way different from private audits