Block Sec Arena

Web3 Security Infrastructure: Education, Tooling & Bounty Ecosystem

[Block Sec Arena @BlockSec_Arena]

@alphai_onchain 👍

[Alph AI @alphai_onchain]

https://t.co/sXb9uHFuBr JUST GOT A NEW LOOK.

But this isn't just a UI refresh. 🪄

We're building Alph around one idea:

TRADE WHAT'S NEXT.

Discover new markets.
Track what's moving.
Trade across chains and venues.
All in one terminal.

Lower fees. Day-one coverage. Smarter discovery.

Welcome to the new Alph. 👀

→ https://t.co/0ZUz9zkhws

[Astra ✦ @AstraliquidX]

Arc is live. Still no USDC for gas? We’ve got you. 🔵

We’re topping up 400 wallets so you can start exploring Arc mainnet.

Want in? Reply with:
💧 Your EVM wallet address
🤝 Tag your onchain buddy
👍 Follow @AstraliquidX and retweet

400 winners · 0.5-10 USDC each

No wallet connection. No claim fee. USDC goes directly to your wallet on Arc.

Ready to make your first move? 👇

#Arc #USDC #Astra

[Block Sec Arena @BlockSec_Arena]

@alphai_onchain 💪💪

[Alph AI @alphai_onchain]

Robinhood Chain might be taking a nap. 😴

https://t.co/E9zyDCwbX8? Still awake. Still hunting alpha.
#robinhood

[Block Sec Arena @BlockSec_Arena]

September at BSA.💪

We’re spending this month on practical security tooling, stronger hands-on environments for researchers and developers, and closer analysis of the failures showing up in production.

Security work gets better when research, testing and real-world incidents stay connected. That’s where our attention is going.

More from us this month

[Block Sec Arena @BlockSec_Arena]

Friday check-in from BSA.

Some of you are auditing code. Some are replaying old exploits. Some are 20 tabs deep because one weird storage slot refuses to make sense.

Whatever rabbit hole you’re in, hope you find something interesting before the weekend wins.

gm security people.
#BSA

[SlowMist @SlowMist_Team]

🚨 Beware of Solidity Pro: A Targeted Poisoning Attack on #Web3 Developers

SlowMist Security Team has identified malicious activity in Solidity Pro, a #VSCode extension targeting #Solidity/Web3 developers.

Historical versions under two publisher identities, helper-beeps and web3devtoolsx, were found to contain credential harvesting, remote payload execution, and remote VSIX update capabilities.

Interestingly, these malicious capabilities disappeared from subsequent versions, while malicious source code and traces of the previous publisher remained in the repository. We traced the version history, publisher migration, and build artifacts, highlighting a key detection blind spot:

Current-version-only detection may cause extensions with a malicious history to appear clean or low-risk again.

This case highlights why #ExtensionSecurity should go beyond a single file or version, incorporating version history, publisher changes, build provenance, and remote control planes.

Read the full analysis 👇
https://t.co/griUF4de3n

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert 🚨

MistEye has detected a large-scale npm supply chain compromise impacting the Keyv/Cacheable ecosystem. Attackers published over 2,000 malicious package versions across the affected ecosystem, including [email protected]. Keyv, a widely used key-value storage abstraction with adapters for Redis, SQLite, PostgreSQL, MongoDB, and other backends, has roughly 127 million weekly downloads, leading to significant downstream supply chain exposure.

The attackers' tradecraft closely mirrors techniques previously observed in the Shai-Hulud npm worm campaign, pointing to a highly automated and scalable supply chain attack. Potential attacker actions include credential theft, environment variable exfiltration, CI/CD secret compromise, remote payload delivery, and lateral propagation through compromised development environments.

Security teams should immediately identify and remove affected package versions, upgrade to verified safe releases, review dependency lockfiles and build logs, monitor for suspicious outbound connections, rotate exposed credentials, and rebuild impacted environments from trusted sources if compromise is suspected.

You can also visit https://t.co/ft6lerTOb0 to check for free whether the npm packages, pip packages, domains, or IPs you use are safe.

As always, stay vigilant!

https://t.co/jxvBdwuT0x

[Block Sec Arena @BlockSec_Arena]

$210M lost to major crypto hacks in July alone.
The interesting part isn’t just the number.

Attack surfaces are expanding beyond smart contracts — infrastructure, credentials, dependencies and users are increasingly part of the target.

Web3 security is becoming a systems problem.

[Block Sec Arena @BlockSec_Arena]

BSA Security Drill
A smart contract uses `tx.origin` to authorize withdrawals.

What’s the real risk?

A. Gas manipulation
B. Authorization bypass
C. Oracle manipulation
D. No major issue

Drop your answer below. We’ll break it down next.

[Block Sec Arena @BlockSec_Arena]

Historical exploits are some of the best security classrooms.

Rebuild the attack. Understand the failure. Test whether AI can find what humans once missed.

This is how security knowledge compounds.

[CertiK @CertiK]

https://t.co/yITaQhJpsB

[Block Sec Arena @BlockSec_Arena]

Security check of the day:

What happens when your oracle is delayed, manipulated, or returns an unexpected value?

Smart contracts should never assume external data is always correct. Validate inputs, define fallback behavior, and test the conditions the happy path never sees.

Reliable systems begin by questioning their assumptions.

#BlockSecArena #Web3Security

[Block Sec Arena @BlockSec_Arena]

GM, security builders.

Every exploit begins with an assumption someone forgot to test.

Question the logic. Test the edge cases. Find the weakness before it reaches production.

#BlockSecArena #Web3Security

[Block Sec Arena @BlockSec_Arena]

Every expert starts as a learner.

Great researchers begin with curiosity, learning, and the desire to understand how things work.Through practice, experience, and community, knowledge becomes real contribution.

BSA creates a place where learners grow into contributors.

#BSA

[Block Sec Arena @BlockSec_Arena]

This is what a working bounty ecosystem looks like.
Not noise. Not theory. Real submissions, valid findings, and fixes shipped before they become headlines.

[Immunefi @immunefi]

It's been a year since Plume made the boldest(and wisest) security move a protocol can make:
They handed their entire codebase to hundreds of hackers and said: break it.

$200,000 on the table.
5,708 lines of Solidity.
Four weeks of open season.

The result?

952 submissions.
365 valid vulnerabilities found, reported, and fixed.
Every single one caught by a whitehat instead of exploited by an attacker.

365 real bugs surfaced in one scope.
That is what happens when you stop hoping your code is clean and start stress-testing it at scale.

A 2–5 person private audit cannot match this.

[Block Sec Arena @BlockSec_Arena]

Security is easier to understand when it is traced, not memorized.

Every exploit leaves a path: the assumption that failed, the permission that was abused, the signal that was missed, and the response that came too late.
Training should turn these paths into practice.

Trace before loss. Train before launch. Secure with context.
#BSA

[Block Sec Arena @BlockSec_Arena]

Security failures rarely stay within one layer.

When validator keys can authorize bridge activity, key management becomes part of protocol security. Security training has to cover the full system: contracts, infrastructure, permissions, and key management.

[BlockSec Phalcon @Phalcon_xyz]

.@AFX_XYZ was reportedly exploited for ~24.15M USDC. While the root cause is still under investigation by the team, our on-chain analysis suggests malicious use of authorized validator keys, as the attacker-provided signatures appear to satisfy the bridge’s 5-of-7 validator quorum.

The active validator set had a total power of 10,000, while the five submitted validator signatures accounted for 7,142 power, exceeding the required >2/3 threshold.

This suggests the bridge’s signature verification logic was not bypassed. Whether the keys were externally compromised or used through other means cannot be determined from on-chain evidence alone.

[Block Sec Arena @BlockSec_Arena]

A missing permission check can put an entire protocol at risk.

Access control vulnerabilities often come from small mistakes: an exposed admin function, an incorrect role assignment, or a missing ownership check.

Before reviewing complex logic, verify one simple question:

Who is allowed to call this function?

#Web3Security #SmartContractSecurity

[Block Sec Arena @BlockSec_Arena]

🛡 Security starts before the audit.

It begins with understanding how attacks work, testing systems in practice, and identifying vulnerabilities before they become real losses.

Block Sec Arena brings education, security tooling, and bounty-driven participation into one Web3 security ecosystem.

Learn. Test. Secure.

#BlockSecArena