3DOↃ Security

Cyber entomologist | warden, judge, Zenith @code4rena | FV ambassador @Certora

[3DOↃ Security @3DOCsec]

@muellerberndt OpenAI very much agrees with you @muellerberndt

https://t.co/U19C2oyGdx

[karma @0xkarmacoma]

wrapped up an amazing run at @a16z with the all-star research and eng team.

I am excited to share that I am starting a new chapter today in engineering acceleration at @OpenAI. Let's go!

[3DOↃ Security @3DOCsec]

@eloufirjawad You are absolutely right.

Let’s also not forget our brain, otherwise it’s shoveling low cost poop for someone else’s brain’s forced consumption

[3DOↃ Security @3DOCsec]

LLMs are bringing security research to the next level.

Yesterday, they made up non-existing bugs.

Today, they make up non-existing code, and report bugs on it.

Tomorrow, they'll reply to this post saying how game-changing their model is over the ones I'm talking about

[3DOↃ Security @3DOCsec]

@muellerberndt @cantinaxyz A tough one, respect!

[guhu @Guhu95]

You can measure how vulnerable the code is after a contest. This can help:
- Projects and users to estimate hack risk
- Bug hunters to scope targets
- Ecosystem to track what works best
- Platforms to manage reputation risk

TL;DR: More solo findings -> more hidden bugs.

This works for most formats: flat pot, conditionals, invitationals, reserved auditors. As long as duplicates are allowed.

### Recent examples:

- Cork exploit: last private contest had 4 solo mediums (out of 4 total mediums). "Chao 1 bias-corrected" estimates 6 unfound bugs. Jackknife 8 more bugs.

- BeraBorrow's Recon's recent post about a critical: private contest had 8 solo mediums (out of 15 mediums), 6 doubletons (doubletons = found by two auditors). Chao 1: 4.5 more bugs, Jackknife: 9 more bugs.

### The science of capture-recapture

There are many disciplines that use this approach: software engineering, quality control, biology & ecology, epidemiology, criminology, linguistics.

Similarly, there are many estimator formulas: Lincoln-Petersen, Chapman, Schnabel, Schumacher–Eschmeyer, Jolly–Seber, Chao 1 & 2, ACE, ICE, Jackknife 1 & 2, Bootstrap, Zelterman, Good–Turing, etc. Will post some links below.

Two simple examples are Jackknife 1 & 2, Chao 1 & 2 which roughly say :

- Jackknife 2 (second-order, simplified): `unfound = 2 * uniques - doubletons`. Jackknife is more popular in software-inspection studies.

- Chao 1: `unfound = (uniques^2) / (2 * doubletons)`. (A slightly different version for no doubletons)

Specifics don't matter really - pick your favorite from the long list. What's important is they all say: more unique findings -> more hidden bugs.

### Intuitions

Math is not always intuitive, so here are some intuitions.

1. Parallel worlds: If a bug is unique to one finder, there’s a parallel world where it stayed hidden because he got sick, or was booked on an audit, or just missed it. Maybe you're in that parallel world. In contrast, if there are many duplicates - in most worlds the same bugs are found.

2. Serial auditing: If you imagine auditors working in sequence, the contest is just a stopping point for the sequence. The contest with uniques stopped when new bugs were still being found, so more like these remain. In contrast, the contest with only duplicates stopped after finding most bugs of similar rarity.

### What can we do?!

1. Measure: what platforms, pot sizes, contest formats give the best coverage?
2. Educate clients on the more secure formats with data.
3. If you're a project, check if your contest was weak.

### No solo findings = code is safe? No.

It's possible whole classes of niche bugs (e.g. cryptography) or higher complexity bugs were not found because pot was too low. That's always a risk.

This rule doesn't tell as what's safe, but it tells us what's LIKELY still vulnerable.

---------

See next tweet for links and statistical nitpicking

[3DOↃ Security @3DOCsec]

@jack__sanford @0xcastle_chain some replies here won't age well. mine included 👴

[Code4rena @code4rena]

Code4rena will run audit contests for free, as public goods.

100% of funds from sponsors will go directly to auditors and judges. We won't take any cut.

Why?

1. Competitions are commodities.
They're CRUD apps. Why should builders pay premium for a website just to submit bugs? Especially smaller teams without VC funding.

2. Everyone deserves competitions.
We tell all our clients to get a competition after their audit. That's because competitions simulate real world conditions, where there's thousands of eyes on a protocol. We want to make competitions as affordable as possible so everyone can get one.

3. It benefits our wardens.
In 2021, we invented the competition format. We're still the platform with the largest auditor pool (10,000+ registered). Not only should builders have access to the best security talent, we believe auditors should have opportunities to work with great projects. Opening up our platform benefits our wardens.

How will you afford this?
Zellic is a profitable business. We make money doing traditional private audits through Zellic and Zenith. This benefits us because: (1) our clients are more secure after they run contests, and (2) Code4rena is a talent pipeline for Zenith.

Will you stop maintaining the platform?
Of course not. Since we acquired Code4rena, we've shipped several features and have several more already underway. C4 has a dedicated dev team that we're fully committed to.

Besides, many of our clients at Zellic use C4. We're incentivized to make sure the platform works well. It's just that now we're allowing everyone to benefit from our investments in Code4rena.

In conclusion:
Run a contest on Code4rena! We won't take a cut, your prizes will go directly to wardens and judges.

For full details, check out our blog post here: https://t.co/IaqxFLZ7rq

[3DOↃ Security @3DOCsec]

Straight to bookmarks 💯

[Zellic @zellic_io]

We retrieved every contract on Ethereum.

Along the way, we found the exact date when 16,000 unique contracts were deployed (the most in one day), the EOA with the most deployed contracts (2.9M), and much more.

This is how we did it.🧵

(Spoiler: It’s 69,788,231 contracts!)

[3DOↃ Security @3DOCsec]

@GalloDaSballo if foundry is where you need it, you could just use this guy -> https://t.co/Fv49Oj46vt

[bountyhunt3rz podcast @bountyhunt3rz]

BOUNTYHUNT3RZ Episode 12: w/
@tpiliposian
@0xriptide

Bringing out the AUDITOOOR

We discuss how auditors and bounty hunters differ, @hexens audit model, what the @certora prover actually does, what devs should do prior to deploying, RED FLAGS to look for when looking at a project to bounty hunt on, why everyone misses bugs, getting your money's worth as a protocol dev with audits and contests, and much, much, more ...

podcast, discord, substack -> https://t.co/rhuP3TD0An

[3DOↃ Security @3DOCsec]

@danielvf this TG channel can reliably tell you when you should panic or can rush to the new emojis https://t.co/Z1V7GeMwqP

[souilos @theSouilos]

👀

Hacker mindset but white hat, passionate, dedicated, attention to detail, you wanna work with us?

➡️📩@PabloSabbatella @opsek_io

[3DOↃ Security @3DOCsec]

@Stacks if this is not a severe security issue for you guys, I literally don’t know what would.

For the record: are you guys really swiping it under the carpet? Why?

[100proof.org @1_00_proof]

Last year, @neumoXX and I (hunting as Pai Mei & Gandalf) discovered and disclosed a very plausible phishing attack on the most common NFT contract in the @Stacks ecosystem.

At its heart, it's due to the way authentication is commonly implemented in Clarity contracts.

But it turns out the authentication method is known and accepted by the Stacks ecosystem, even though it's been debated for many years.

We aren't convinced that it's safe enough.

So we've written a blog post about it with the sincere hope that it sparks wider discussion. It's time the debate moved beyond GitHub Issues and gets much more exposure.

https://t.co/xG9HJkMc4A

[3DOↃ Security @3DOCsec]

@0xGreed_ Ouch that is less fun. But the bright side is that it could become a nice gag for a new date 😅

[neumo @neumoXX]

Kicked from Immunefi for not paying? Hold my beer.

[3DOↃ Security @3DOCsec]

@bernd_eth @code4rena 🐐

[3DOↃ Security @3DOCsec]

The best time to start writing searchable notes about design and gotchas of the protocols I work on was a couple of years ago. The second best time is now

🎧@bountyhunt3rz

[Certora @Certora]

Certora is now open source!

What’s your excuse now for not securing your protocol, anon?

[3DOↃ Security @3DOCsec]

Lesson #2: developers fix the bugs they see, so those left for SRs to find are those they don't see - our job is to clear blind spots, not inheriting them

[3DOↃ Security @3DOCsec]

Alpha for SRs

Last week I asked about a function during a kick-off code walkthrough call.

Got replied it was standard and not problematic, so I decided to ramp up with knowledge of the codebase by trying to understand why exactly it's this way

1/3

[3DOↃ Security @3DOCsec]

Well, it turned out to be an H finding just minutes into the audit.

Lesson #1: the one and only reason to abandon a lead is "to know why it's not a problem"

2/3