do you understand what just happened to Robinhood..
Someone sent a perfect phishing email - real domain, DKIM pass, SPF pass, DMARC pass and Robinhood's own servers delivered it.
Here's the chain:
→ Gmail treats john.doe@ and johndoe@ as the same inbox
→ Attacker registers a NEW Robinhood account using the dot trick of YOUR email
→ Sets the device name to raw HTML code
→ Robinhood's "unrecognized activity" email renders it unsanitized
The "Review Activity Now" button? Attacker's phishing site.
The email? 100% real.. Sent by Robinhood.. Signed by Robinhood..
Just because it passed every security check doesn't mean it's safe.
After nearly a year of writing and revision, we’re proud to finally present a new book from RareSkills, created in collaboration with @Certora:
Formal Verification with the Certora Prover
Certora makes formal verification accessible—but for newcomers, there’s still a large set of unfamiliar concepts to learn.
Teaching a broad and unfamiliar field comes with pedagogical challenges. Dive into projects too early, and you’re forced to use syntax you don’t yet understand. Delay compelling applications too long, and readers lose interest.
We worked carefully to balance showing “cool examples” without presenting anything that feels magical—i.e., concepts the reader hasn’t yet built a mental framework for.
Our hope is that this work helps formal verification become a more standard part of development and auditing.
Clocking in at well over 60,000 words, this is not a small book. But like any RareSkills publication, it’s information-dense yet approachable, thorough without being academic, and above all, practical and illuminating.
In a space that quickly jumps from one meta to the next, we’re proud to collaborate with a company willing to invest in long-horizon projects that make Web3 safer.
Link in the reply.
1/ 🏆 Check out another one of our amazing Certora Champions!
We’re spotlighting the brilliant researchers who keep DeFi safe.
Introducing @0xA5DF, a Security Researcher at Certora who’s protecting our clients’ code. He has reviewed major players including Eigenlayer, @solana’s stake pool, @jito_labs, @ManifestTrade, and @safe
1/ 🏆 Check out another one of our amazing Certora Champions!
We’re spotlighting the brilliant researchers who keep DeFi safe.
Introducing @0xA5DF, a Security Researcher at Certora who’s protecting our clients’ code. He has reviewed major players including Eigenlayer, @solana’s stake pool, @jito_labs, @ManifestTrade, and @safe
Since Monday’s @Balancer v2 exploit, we’ve worked hand in hand with their team to develop the first root-cause analysis of the issue, identify all affected and potentially vulnerable pools, and determine whether v3 was susceptible to the same attack.
Our analysis breaks down what happened, how v3’s redesign prevents it, and key takeaways for DeFi security.
https://t.co/6h59fJ1Brn
Certora Champions 🦸♂️
Meet Alex, one of the experts behind securing @Balancer, @KaminoFinance, @RaydiumProtocol, @fragmetric, Chainlink, Astaria, and many more.
Happy to secure the 6th place with my team ✌️
We've identified 2 out of the 3 issues that were eligible for the 180K$ pot
Huge thanks to @eulerfinance and @cantinaxyz for hosting this contest
Our team Shield got 6th place in the most awaited
@eulerfinance contest with the biggest pot size ever on
@cantinaxyz⚡️
great work by @0xA5DF & @Udsen3 & a special mention to @0xA5DF for doing most of the heavy lifting and finding some nice bugs, great experience overall
This is why centralization risks should matter
Trusting the governance means trusting another human being to not f*ck up, and as you can see in this case - they sometimes do
WazirX has been hacked for $230 millions
It seems their multisig wallet was upgraded to a malicious implementation which simply lets the attacker pull out all ETH and ERC20 funds from the multisig
First top 3 result @code4rena for our team “Shield” ✨⚔️
big shoutout to these chads @0xA5DF@BowTiedDravee@Udsen3 🫡🫡🫡
amazing experience to audit with them & learn from them & and good learning’s from the @taikoxyz codebase
@arc0nec@fried_rice@paraswap The tx has two calls to `uniswapV3SwapCallback()`, it seems like the first one goes in a path that doesn't verify the caller