Merulez

🛡️Security Researcher | Co-founder @ValvesSec

[Merulez @Merulez99]

Wrapped it in a valve 🫡

[Valves Security @ValvesSec]

Wrapped up the @Panoptic_xyz contest on @code4rena 🏆

We secured 1st place🥇 with 5 valid findings (1 High / 4 Medium), including 1 solo submission.

Really interesting system. Excited to see where Panoptic goes from here. Bright future ahead 🚀

[Valves Security @ValvesSec]

Truly happy to see such kind words coming our way 🫡

[Merulez @Merulez99]

@0xFlint_ Literally thought of that 😳

[Valves Security @ValvesSec]

We have contributed to Web3 in many ways❗️

Our official engagements are just one part of what we have been doing over the past six months.

- We have reached out to many protocols, identifying vulnerabilities with our AI-powered security tool, without receiving anything in return.

- We have built a training hub for aspiring security researchers who want to learn and improve their skills.

- We have invested real money in the protocols we have secured, including DeFi and liquidity pool projects.

We are here to make Web3 safer, and our contributions go far beyond paid engagements. 🫡

[Vesko210 @Vesko_210]

I can now run my Ai tools on Opus 5.5 without getting flagged for cybersecurity threats or having to route my agents to Sonnet.

And the best part is that I'm now using Mythos 5.1 for all initial validation, and I can tell it’s doing a great job 🔥

[Vesko210 @Vesko_210]

Was not too hard. Happy to share this!

The @ValvesSec AI security tooling just got a major update 🫣

[Valves Security @ValvesSec]

We keep your project secure, so you can build and innovate with confidence 🛡️

[Vesko210 @Vesko_210]

There are all kinds of people

[Vesko210 @Vesko_210]

Hundreds of Web3 projects launch every month. All of them need security, but not all of them want to have it...

Unfortunately, those are often the projects that give the entire crypto industry a bad reputation 😬

[Valves Security @ValvesSec]

For every protocol, we build a custom security team that brings together different strengths: auditors who find uncommon bugs and those who consistently deliver high coverage.

We know that every protocol is different, and we put together the right team for your needs 🤝

[WhiteHatMage @WhiteHatMage]

Quick thoughts on the events I missed over the past two months:

- The XRP bug is a great finding, but the reward was low. But even Ethereum had a $250k max bounty a few months ago, so I wouldn’t criticize Ripple too hard.

- The max cap wasn’t specified in the XRP bounty program, so most hunters didn’t even bother checking it.

- The $50k Vercel bounty is too low. They advertised a $1 million bounty, which is misleading, since there's a $50k max cap. Are they expecting 20 Criticals?

- Other projects continue lowering their bounties or closing programs while hacks increase. I understand that it hurts to pay so many reports, but there’s no coming back from a hack.

- The “Duplicates” problem hasn’t been solved. You can still report a Critical issue, prevent major damage to a project and its users, and they will still try to find a way to pay you nothing while pointing to some non-impactful report as sharing the same root cause. Platforms should address this scam immediately.

- The LLM decompilation movement is pretty cool. It's the end of the era of closed-source code.

- People building security tools that depend on LLM tokens should try to make a profit today, or have a clear plan to sell their company before models get better. There's no long-term plan.

- LLM spam continues to be the main trend for getting bounty rewards. It feels like buying lottery tickets. The more tokens people spend, the more chances they have of landing an actual exploit. Having a unique approach seems to help too. But nobody is performing much better than the model they use, since there's no clear outstanding winner in the leaderboards.

- We’re getting to the end of 2026, and bounty rewards paid haven’t increased 10x with AI. According to Grok, for the top 100 on Immunefi the total earnings were:
* 2026 $16M, 1364 reports
* 2025 $11M, 820 reports
* 2024 $21M, 775 reports
* 2023 $17M , 559 reports
* 2022 $57M, 443 reports

- What happened with Ledger is worrisome. Keep improving your OpSec, whitehats.

Personal thoughts:

We keep seeing more and more bugs in all kind of software. That's not because of superhuman AI capabilities. It's because how bad we've been building software over decades in terms of security.

Nobody cared about exploits because they were difficult for the average hackers. Now everyone has a low-level-IQ tool that can crack neglected code, and we see the results.

We're in a transition phase, where LLMs trained with human bugs are outperforming the average guys. We'll probably get to an era of LLMs-code-first, with LLM bugs that with unprecedented vulnerabilities.

Yes, LLMs are just that bad at coding, and the current models might not be able to see some obvious errors, since they also have "cognition bias".

I see a bright future for bounty hunters, full of vulnerabilities waiting to be found and prevented. We just need to solve the bug-pocalypse first if we don’t want blackhats to win.

[Valves Security @ValvesSec]

🥪 The fee payer controlled how cheaply the protocol could sell its own cut.

A liquidity manager compounded the trading fees earned by a user's position. It took a percentage of those fee tokens, sold that cut for USDC to pay the protocol, and reinvested the remaining tokens for the owner.

The owner supplied the slippage tolerance for that fee sale too.

Illustrative numbers for one non-USDC fee token, with no bot fee: 100 earned TOKEN leave 90 for reinvestment after a 10 TOKEN protocol cut. If those 10 TOKEN sell for 80 USDC instead of 100, the owner still gives up 10 TOKEN. The protocol receives 20 USDC less.

⚔️ Attack path:

1. The owner targets a compound where the remaining tokens match the position's required ratio at execution, so reinvestment needs no rebalance swap. They choose a permissive slippage tolerance.
2. Front-run: the owner sells TOKEN into the market used by the fee sale, pushing its price down.
3. Compound: their transaction sells the protocol's fixed token cut at the worsened price. The loose tolerance allows the reduced USDC output, and the remaining tokens proceed to reinvestment without a rebalance swap.
4. Back-run: the owner buys TOKEN back after the compound, seeking to unwind the first trade at a lower price.

💥 Impact:

The protocol receives less USDC from the same fee-token charge. The owner can potentially recover part of that fee through the surrounding trades.

Skipping the rebalance matters: a rebalance swap could also expose the owner's remaining tokens to the manipulated price. Liquidity addition and any dust conversions still occur and affect the economics.

🔎 Root cause:

The fee payer chose the allowed execution loss on the sale funding the protocol's payout. Worse execution reduced that payout without increasing the predetermined fee-token charge.

🛠️ Fix:

Enforce a protocol-set slippage cap on fee conversions while honoring a stricter user tolerance.

[Merulez @Merulez99]

@adeolRxxxx i have around 5k$ locked in btw xD

[Valves Security @ValvesSec]

We literally invest in the projects that we have secured and believe in. We are part of DeFi, we use DeFi, and we are proud to work alongside the brilliant minds building this space.

We don’t just secure Web3 from the sidelines. We are part of the ecosystem ourselves 🫡

[Valves Security @ValvesSec]

To get a quote and kick off your project’s audit as quickly as possible, you need to have a clearly defined scope and a Github repository ready to share.

We can move fast! You can use that in your advantage 👊

[Merulez @Merulez99]

The next generation of DeFi exploits won’t necessarily start with a vulnerability in a smart contract.

They’ll start with an agent making a perfectly valid transaction for completely the wrong reason.

We’re going to have to rethink what it actually means to secure a protocol.

[Merulez @Merulez99]

Somewhere along the way, audits became more about collecting logos and issuing PDFs than actually securing protocols.

The number of audits you’ve done means nothing if you’re not putting in the work on the next one.

Every protocol deserves your best effort. Every single time.

[Vesko210 @Vesko_210]

We at @ValvesSec keep finding basic issues in protocols that have already been audited by firms with thousands of audits behind them.

This isn’t serious...

There are plenty of elite security researchers available now, and AI tools that can cover codebases better than some of these companies do.

Founders are paying for real protection - not just a badge on their website. They deserve better.

Do it right. We can all do better. 🛡️

[Vesko210 @Vesko_210]

We at @ValvesSec keep finding basic issues in protocols that have already been audited by firms with thousands of audits behind them.

This isn’t serious...

There are plenty of elite security researchers available now, and AI tools that can cover codebases better than some of these companies do.

Founders are paying for real protection - not just a badge on their website. They deserve better.

Do it right. We can all do better. 🛡️

[Valves Security @ValvesSec]

Before starting an audit with a company of your choice, always ask who will actually be auditing your codebase.

If you’re not immediately impressed, come talk to us 😏

[Merulez @Merulez99]

@ret2basic Looks like we’re all getting hooked 😂

[Merulez @Merulez99]

Man i love auditing ✌️🙌

[Valves Security @ValvesSec]

Currently auditing Uniswap V3/V4 with Robinhood integration. Seeing a lot of Uniswap projects lately.