0xA5DF

Senior Security Researcher @Certora,
Judge & Scout @code4rena

[BuBBliK @k1rallik]

do you understand what just happened to Robinhood..

Someone sent a perfect phishing email - real domain, DKIM pass, SPF pass, DMARC pass and Robinhood's own servers delivered it.

Here's the chain:

→ Gmail treats john.doe@ and johndoe@ as the same inbox
→ Attacker registers a NEW Robinhood account using the dot trick of YOUR email
→ Sets the device name to raw HTML code
→ Robinhood's "unrecognized activity" email renders it unsanitized

The "Review Activity Now" button? Attacker's phishing site.

The email? 100% real.. Sent by Robinhood.. Signed by Robinhood..

Just because it passed every security check doesn't mean it's safe.

[0xA5DF @0xA5DF]

We're looking for a SOC Analyst at @Certora

One of the requirements is the ability to say "Kim Jong Un is a fat ugly pig"

https://t.co/zuSmTcE9dJ

[0xA5DF @0xA5DF]

@BowTiedDravee Very true, AI is good with details, it's still struggling with reasoning
Be the reasoning needed in the loop to stay relevant

[RareSkills @RareSkills_io]

After nearly a year of writing and revision, we’re proud to finally present a new book from RareSkills, created in collaboration with @Certora:

Formal Verification with the Certora Prover

Certora makes formal verification accessible—but for newcomers, there’s still a large set of unfamiliar concepts to learn.

Teaching a broad and unfamiliar field comes with pedagogical challenges. Dive into projects too early, and you’re forced to use syntax you don’t yet understand. Delay compelling applications too long, and readers lose interest.

We worked carefully to balance showing “cool examples” without presenting anything that feels magical—i.e., concepts the reader hasn’t yet built a mental framework for.

Our hope is that this work helps formal verification become a more standard part of development and auditing.

Clocking in at well over 60,000 words, this is not a small book. But like any RareSkills publication, it’s information-dense yet approachable, thorough without being academic, and above all, practical and illuminating.

In a space that quickly jumps from one meta to the next, we’re proud to collaborate with a company willing to invest in long-horizon projects that make Web3 safer.

Link in the reply.

[0xA5DF @0xA5DF]

I'm happy to be part of this amazing company!

[Certora @Certora]

1/ 🏆 Check out another one of our amazing Certora Champions!

We’re spotlighting the brilliant researchers who keep DeFi safe.

Introducing @0xA5DF, a Security Researcher at Certora who’s protecting our clients’ code. He has reviewed major players including Eigenlayer, @solana’s stake pool, @jito_labs, @ManifestTrade, and @safe

[Certora @Certora]

1/ 🏆 Check out another one of our amazing Certora Champions!

We’re spotlighting the brilliant researchers who keep DeFi safe.

Introducing @0xA5DF, a Security Researcher at Certora who’s protecting our clients’ code. He has reviewed major players including Eigenlayer, @solana’s stake pool, @jito_labs, @ManifestTrade, and @safe

[Itamar Golan 🤓 @ItakGol]

What it's like to watch AI fix a bug

[Certora @Certora]

Since Monday’s @Balancer v2 exploit, we’ve worked hand in hand with their team to develop the first root-cause analysis of the issue, identify all affected and potentially vulnerable pools, and determine whether v3 was susceptible to the same attack.

Our analysis breaks down what happened, how v3’s redesign prevents it, and key takeaways for DeFi security.

https://t.co/6h59fJ1Brn

[Certora @Certora]

Certora Champions 🦸‍♂️

Meet Alex, one of the experts behind securing @Balancer, @KaminoFinance, @RaydiumProtocol, @fragmetric, Chainlink, Astaria, and many more.

[0xA5DF @0xA5DF]

@0xFlint_ I believe vibe coding would break this rule
Perfect grammar but not bug free

[Defi Security Summit @summit_defi]

New city. New vibe. Same mission: securing the future of Web3.

📍 Buenos Aires
📅 Nov 17–19

Save the date for DeFi Security Summit 2025!

[Certora @Certora]

Certora is now open source!

What’s your excuse now for not securing your protocol, anon?

[0xA5DF @0xA5DF]

The constant struggle

[0xA5DF @0xA5DF]

Happy to secure the 6th place with my team ✌️

We've identified 2 out of the 3 issues that were eligible for the 180K$ pot

Huge thanks to @eulerfinance and @cantinaxyz for hosting this contest

[viraz @Viraz04]

Our team Shield got 6th place in the most awaited
@eulerfinance contest with the biggest pot size ever on
@cantinaxyz⚡️

great work by @0xA5DF & @Udsen3 & a special mention to @0xA5DF for doing most of the heavy lifting and finding some nice bugs, great experience overall

[0xA5DF @0xA5DF]

This is why centralization risks should matter
Trusting the governance means trusting another human being to not f*ck up, and as you can see in this case - they sometimes do

[Akshay Srivastav @akshaysrivastv]

WazirX has been hacked for $230 millions

It seems their multisig wallet was upgraded to a malicious implementation which simply lets the attacker pull out all ETH and ERC20 funds from the multisig

[0xA5DF @0xA5DF]

@milotruck

[viraz @Viraz04]

First top 3 result @code4rena for our team “Shield” ✨⚔️

big shoutout to these chads @0xA5DF @BowTiedDravee @Udsen3 🫡🫡🫡

amazing experience to audit with them & learn from them & and good learning’s from the @taikoxyz codebase

[0xA5DF @0xA5DF]

@arc0nec @fried_rice @paraswap The tx has two calls to `uniswapV3SwapCallback()`, it seems like the first one goes in a path that doesn't verify the caller

[0xA5DF @0xA5DF]

@fried_rice @paraswap Yeah, they didn't verify the caller is a Uniswap V3 pool, so the attacker just called it directly
https://t.co/fQV0HG3NPU

[0xA5DF @0xA5DF]

@juancito Are all L2s implementing that as well, or are some of them still letting us have some fun?