Mladenov

security researcher

[Mladenov @0xmladenov]

Protocol founders are losing trust in audits not because security doesn’t matter, but because the market is getting flooded with AI slop audits: autogenerated bug lists, tons of false positives, and little to no proof-of-exploit or system-level reasoning.

It makes money short-term, but it’s killing trust in audits long-term.

A good audit isn’t asking your LLM “find all bugs.” It’s threat modeling, invariants, concrete exploit paths, and fixes that actually reduce risk. Quality wins long-term, but we need to say it out loud.

[Mladenov @0xmladenov]

Spent the last few days vibe coding and it made one thing crystal clear: it’s way too easy to blur the line between speed and compromise.

One autopilot “enter, enter” session and your AI workflow can end up reading:

- .env (API keys, RPC creds)
- private repos
- signing / wallet tooling

This isn’t “AI writes bad code”, it’s a new exfil + supply-chain surface created by unscoped access and blind approvals.

Treat your LLM like an untrusted dependency: sandbox it, least-privilege everything, rotate creds, and review diffs like your funds depend on it.

Stay safe. 🛡️

[Mladenov @0xmladenov]

What happened to the Pay Per Vulnerability model? Does anyone still use it?

People say audits are too expensive, but how many teams actually want to pay per vulnerability found?

If it’s such a fair model, why isn’t it common?

Is the issue the pricing model, the risk, or how the industry values security work?

[Mladenov @0xmladenov]

Saying “find the bugs” to your LLM doesn’t make you an auditor.

That’s like microwaving a frozen pizza and calling yourself a professional chef.

Real security is slow, skeptical, and a little paranoid: reading code like an attacker, questioning every assumption, and breaking things until they confess.

Nice sounding output != real assurance.

[Mladenov @0xmladenov]

Recently, bug bounty reviewers reading another AI slop like…

[Mladenov @0xmladenov]

@xenowits The reality is you can get cheaper audits. You don’t have to go with tier 1 companies. There are great auditors at smaller firms too. Founders just need to trust smaller firms more.

[Mladenov @0xmladenov]

If you’re a protocol founder and treat audits like just a checkbox, sooner or later you’ll get an on-chain audit.

[Mladenov @0xmladenov]

If you don’t find bugs most of the time in a contest, don’t leave.
Many critical issues are found in the last days of the audit, once you already have a solid understanding of the protocol.

[Mladenov @0xmladenov]

@ShieldifyMartin I feel like security still isn’t treated as a priority by most protocol teams. It’s more of a checkbox than a real commitment. Hope this changes soon.

[Mladenov @0xmladenov]

@developerjordy 💪🫡

[Mladenov @0xmladenov]

@0xhgrano Mistake #3 is the most common and is made by many auditors, especially when the contest includes a first blood reward.

[Mladenov @0xmladenov]

If a piece of code is hard to understand, don’t skip it. This is where most people give up and where the most unique issues are found in contests.

[Mladenov @0xmladenov]

@0xhgrano @megapot @code4rena Congrats!

[Mladenov @0xmladenov]

Excellent resource for bug bounty hunters - real-world Immunefi writeups and findings.

https://t.co/RI14Hm3zHn

[Mladenov @0xmladenov]

AI can speed up Web3 security research, but the real edge comes from your own thinking. Unique vulnerabilities don’t show up unless you look for them. AI helps, your mind finds.

[Mladenov @0xmladenov]

Fix reviews need the same attention as the audit itself. Don’t let assumptions or the next task distract you because blind spots can slip in. Stay sharp and treat every fix like a fresh audit.

[Mladenov @0xmladenov]

@Slavcheww AI audits are affordable, but I believe developers and founders can run AI audits themselves.

[Mladenov @0xmladenov]

Kind reminder: If you are a Web3 developer, be careful how you store private keys and what npm packages you download. Supply-chain risks and key leaks are still among the most common security pitfalls in the space.

[Mladenov @0xmladenov]

This is another example of why securing the initialize function is essential. Deployment steps are often marked out of scope in audits with the assumption they'll be handled later, and too often they're not.
Strong code isn’t enough. The deployment process is just as critical.

[UPD.IO | Universal Private Dollar @UPD_io]

🚨 URGENT SECURITY ALERT: USPD PROTOCOL EXPLOIT 🚨

1/ We have confirmed a critical exploit of the USPD protocol resulting in unauthorized minting and liquidity draining.

Please DO NOT buy USPD. Revoke all approvals immediately.

[SafetyBytes @safetybytes]

🔍 Audit Report Released

The audit report for @UniVoucher_com has been released!

The SafetyBytes team conducted a detailed review of one of their core smart contracts to ensure robust security and reliable performance.

📄 Read the full report: https://t.co/g8hEDmaBMU

Together, we’re making Web3 safer for everyone. ⚡