JJS

Web3 Security | TAM @Certora | @CyfrinUpdraft Alumni

[JJS @JJS_OnChain]

@p_tsanev Hahahaha what the hell

[JJS @JJS_OnChain]

@chrisdior777 😎😎

[Mooly Sagiv @SagivMooly]

Manuel's tweet sparked a lot of conversation, but the full picture is more nuanced.

DeFi security has matured significantly:
- AI + Formal verification, combined with manual audits
- Better protocol architecture
- Automated monitoring

And many more protection layers…

We're fighting fire with fire. The same AI capabilities attackers use are increasingly being deployed by security researchers and whitehats to strengthen protocols.

[JJS @JJS_OnChain]

@0xAriessa_ For different use cases but yes Sui has drawn the Bitcoin UTXO model too!

[JJS @JJS_OnChain]

Fun fact about the Canton model is that state is never modified. Unlike EVM or Solana where state is stored and can be modified; on Canton this never happens.

Here is an example:
EVM: Alice sends Bob 10 tokens → Alice's balance: -10, Bob's balance: +10. The state was mutated.
Canton: Alice sends Bob 10 tokens → Alice's contract (10 tokens) is archived. A new contract is created for Bob (10 tokens). Nothing was modified. A new fact was written.

[Canton Foundation @CantonFdn]

The Protocol Development Fund in action.

@Certora is building an open-source static analysis tool for Daml, bringing automated, verifiable security assurance to institutions and builders deploying on @CantonNetwork.

This is what the Fund was designed for: 5% of all Canton Coin emissions directed toward public goods that strengthen the ecosystem's core infrastructure.

[JJS @JJS_OnChain]

It’s been a while since I posted about Sui. They always keep improving it seems…

[Sui @SuiNetwork]

Now live and fully rolled out on mainnet: Stablecoin transfers on Sui are free.

No $SUI, no problem.

Just send.

[JJS @JJS_OnChain]

@tpiliposian Crazy times are ahead!

[JJS @JJS_OnChain]

Super excited about this!

[Certora @Certora]

Certora has been awarded a grant from the @CantonNetwork Development Fund.

We're building an open-source static analysis tool for Daml, bringing the same rigorous, automated analysis we've built for DeFi to institutions building on the Canton Network.

More details 🧵

[JJS @JJS_OnChain]

@0xaudron Nice ser! Great to see more talent like yourself doing new and exciting things!

[JJS @JJS_OnChain]

I think the notion of doing security as a checkbox is an issue. Thinking that doing an audit means you’re safe is no longer valid. BBPs are great because it means continuous security but just not guaranteed as you don’t actually know if people are looking at your code or not.

So integrating security at any point and on as many layers as possible (smart contracts, opsec, monitoring etc)

[Royco @roycoprotocol]

Why did Royco get multiple audits and formal verification?

We sat down with @teryanarmenn from @Certora to break it down. Certora completed a comprehensive audit and formal verification engagement on Royco Dawn, further fortifying its security stack.

Watch it now.

[Pat @patdotxyz]

ohhhhhh its happening chat its happening 🔥

[JJS @JJS_OnChain]

@CantonNetwork new docs look good! https://t.co/2XWvUxBGY8

[JJS @JJS_OnChain]

@Raph_Bloch The event was great! Thanks for having me and looking forward to the next!

[vitalik.eth @VitalikButerin]

Many people have claimed that with AI-assisted bug finding, secure code (and hence trustless anything) will be impossible.

I have a much more optimistic take, and AI-assisted formal verification is a major part of the reason why:

https://t.co/0ceMBZ6uqj

[Cork Protocol @Corkprotocol]

How would the KelpDAO x Aave incident operated in a market integrated with Cork's risk infrastructure?

Example: aETH was assumed fully liquid, but the exploit made it illiquid. A live Cork aETH pool would have let holders pay a premium upfront to guarantee exit liquidity at NAV, with that guarantee locked in a smart contract.

Priced vs. unpriced risk

[JJS @JJS_OnChain]

7/ Then why BFT / Super Validators?

Because even if the synchroniser cannot read the transaction, it still controls important public facts:

1. What got sequenced?
2. In what order?
3. Before what deadline?
4. Was the final result commit or abort?

Those facts need decentralised trust.

[JJS @JJS_OnChain]

You have heard that @CantonNetwork allows its users to have privacy. But it does not use ZK, FHE or any other fancy shmancy heavy computation cryptography primitives.

But How? Lets take a look 🧵

[JJS @JJS_OnChain]

6/ This is the key mental shift:

Canton is not hiding a public blockchain transaction with advanced cryptography.

It is avoiding the need to publish the transaction in the first place.

Privacy comes from selective disclosure plus a shared synchronisation layer.