Nethermind Security

Comprehensive security from @Nethermind, from audits to formal verification. Book now:

[Nethermind Security @NethermindSec]

Your team takes the break. We take the audit.

A few slots open July 1 — August 15. Adjusted rates. AuditAgent Pro included so the codebase is ready before we start.

Smart contracts and ZK circuits.

https://t.co/5lkctca8Ia

[Nethermind Security @NethermindSec]

Full talk: https://t.co/TVAvQo2c28

[Nethermind Security @NethermindSec]

A ZK circuit can do exactly what it's supposed to and the system around it still gets drained. The risk lives in what the protocol assumes the proof means. Michael Belegris on the bugs our ZK audit team keeps finding: https://t.co/Z6wY2lE0Dr

[Nethermind Security @NethermindSec]

Your team takes the break. We take the audit.

A few slots open July 1 — August 15. Adjusted rates. AuditAgent Pro included so the codebase is ready before we start.

Smart contracts and ZK circuits.

https://t.co/5lkctca8Ia

[Nethermind Security @NethermindSec]

@Uniswap Full case study: https://t.co/E2QNpgXhze

[Nethermind Security @NethermindSec]

Uniswap ran a free AuditAgent scan, an AgentArena competition on UniswapX, and adopted the AuditAgent Business Plan in three months. Cody Born, Principal Engineer at @Uniswap, on what AuditAgent changed in their development workflow:

[Nethermind Security @NethermindSec]

@0xKalzak Pre-audit tools handle the surface layer. AuditAgent flags common vulnerability patterns and dead code so the audit goes deeper from day one. Included with audit slots between July 1 and August 15. Reduced rates: https://t.co/1eMm08NUeR

[Nethermind Security @NethermindSec]

Auditors aren't QA.

When the first days of an engagement go to integration bugs the team would catch on testnet, that's time off the review. When pass one goes to dead code and common vulnerability patterns, that's time not spent on bugs only auditors can find.

[Nethermind Security @NethermindSec]

Full guide on audit prep from @0xKalzak: https://t.co/P5OcgsAzip

[Nethermind Security @NethermindSec]

@lagoon_finance Sequential audits caught these before production. One audit at one version wouldn't have.

Case study: https://t.co/TYhVb1lT1k

[Nethermind Security @NethermindSec]

Auditing ERC-7540 vaults is different from auditing ERC-4626. Settlement happens in a different block than the request. Bugs in the gap can leave users mispriced, locked out of exits, or settled into the wrong cycle.

Standard audit playbooks miss them.

[Nethermind Security @NethermindSec]

@lagoon_finance The work covered pending-state accounting transitions, NAV update timing during synchronous deposits, and economic edge cases at feature interactions.

The most consequential issues became reachable only when new features layered onto existing ones.

[Nethermind Security @NethermindSec]

@code4rena Bad news for the ecosystem. @code4rena you are OGs and you're where many started their web3 journeys. Competition is what makes us all better - we're sad to see you go.

To all affected builders: https://t.co/FOBC65pfRu

[Nethermind Security @NethermindSec]

Builders selected for the program and working with us get audit and formal verification in one engagement, plus AI tooling to prepare your code for the audit.

https://t.co/dBbEaSA03o

[Nethermind @Nethermind]

The $1M Ethereum Security Subsidy Program funds security reviews for mainnet builders. Nethermind's on the Expert Committee with @ethereumfndn, @chainlink, and Areta. New cohorts monthly.

https://t.co/GQPsthiOD4

[Nethermind Security @NethermindSec]

https://t.co/OqxPG7Bdwc

[Nethermind Security @NethermindSec]

Every pending transaction in the mempool is a statement of intent. Bots read it before it settles and front-run what's worth front-running.

The contract calls 𝘈𝘔𝘔.𝘴𝘸𝘢𝘱(𝘵𝘰𝘬𝘦𝘯𝘐𝘯, 𝘢𝘮𝘰𝘶𝘯𝘵𝘐𝘯, 𝟘). That zero is 100% slippage tolerance. A frontrunner inflates the price, lets the swap settle, sells back at profit. A 10,000 USDC trade returns 1 ETH instead of 5.

𝘳𝘦𝘲𝘶𝘪𝘳𝘦(𝘢𝘤𝘵𝘶𝘢𝘭𝘈𝘮𝘰𝘶𝘯𝘵𝘖𝘶𝘵 >= 𝘮𝘪𝘯𝘈𝘮𝘰𝘶𝘯𝘵𝘖𝘶𝘵) lets the user set their worst acceptable price. If a bot moves the price outside that range, the swap reverts. The attacker burns gas for nothing.

The mempool stays public. Defense lives in the code, or it doesn't exist.

[Nethermind @Nethermind]

Aptos Keyless lets users create a blockchain account using Google or Apple ID. ~1.4M ZK constraints sit between that login and the on-chain account.

We're formally verifying them in CLAP.

[Nethermind Security @NethermindSec]

Full write-up: legal trends, programmable compliance, identity-linked ownership, insolvency risk, regulatory convergence. https://t.co/u25roJRKPS

[Nethermind Security @NethermindSec]

Tokenised assets fall into three legal categories.

Informational — records a fact about an offchain asset
Certificatory — digital receipt against a custodian
Dispositive — transfer of the token IS transfer of legal title

Most tokenised assets today are certificatory.

[Nethermind Security @NethermindSec]

Lagoon's vault architecture went through five sequential audits as new features changed accounting assumptions between pending and settled assets.

https://t.co/8Ud7igphGi