OmerG

Blockchain Security | Prev @OpenZeppelin,@TenderlyApp | Keeping it low key on X

[OmerG @Om3rGr]

@irondevx @TenderlyApp 3*Yes!
https://t.co/EJIq7EzzvM

[OmerG @Om3rGr]

@martriay Hey @martriay, how have you been? It's been a while... You are welcome to visit the amazing @TenderlyApp office. They will give you a warm welcome!

[OmerG @Om3rGr]

@0xidanlevin I'll hook you up with few folks from the OpenZeppelin that attend EthDenver

[OmerG @Om3rGr]

We were busy this year! Summarising 2023. Here's for a great 2024!

[OpenZeppelin @OpenZeppelin]

Since 2016, OpenZeppelin has been passionately dedicated to creating a secure, open, and decentralized financial world.

In 2023, our achievements surpassed our own expectations.

Here is a summary of everything we did this year to secure open finance :

𝐎𝐩𝐞𝐧𝐙𝐞𝐩𝐩𝐞𝐥𝐢𝐧 𝐂𝐨𝐧𝐭𝐫𝐚𝐜𝐭𝐬 𝐋𝐢𝐛𝐫𝐚𝐫𝐲

- We launched Contract 5.0 with enhanced code, modernized access management, and stronger security with expanded fuzzing and formal verification.

- A newly formed team achieved the first milestone in building @Polkadot Parachain templates (a generic runtime MVP).

- We created the Foundry upgradeability plugin and enhanced the one for @HardhatHQ

- We migrated the OpenZeppelin library for @Starknet fully from @CairoLang 0 to 2.3, released 2 new versions, the Wizard for Cairo, and a fully revamped docsite.

-We revamped the Contracts Wizard with AI, allowing the creation of smart contracts with natural language.

𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬

- We conducted 111 audits resolving 2,084 issues (including 184 high+ risk); and expanded audit capabilities to @rustlang , @CairoLang , and @golang .

- We retained 100% of our comprehensive security partnership clients, demonstrating our high-value delivery and tangible contribution to their success. These include @compoundfinance, @TheSandboxGame, @umaprotocol, @the_matter_labs , @OriginProtocol, @graphprotocol , @VenusProtocol , @avax and @paritytech .

- We Implemented a mission-critical, novel Incident Response offering with our comprehensive security partners, including simulations with the SEAL team.

- To launch our ZKP practice, we formed a world-class team of renewed academic cryptographers and security researchers to advise, assess, and audit ZKP systems including @LineaBuild , @Scroll_ZKP, and @zksync. The team improved designs and uncovered significant critical issues.

- Expanding Ethereum to institutions: We delivered proofs of concepts and confidential security reviews for traditional finance and government institutions.

-To support our auditors with the best tools, we formed a fully focused internal tooling team which ended up creating Contract Inspector, the best solidity code analysis tool in existence. This tool has been incredibly effective, detecting over 5x as many issues as at the start of the year (currently more than 130 detectors), while also halving the false positive rate to less than 14%. This success is largely attributed to our in-house AST. Code Inspector was so useful for our auditors that we ended up including it inside the Defender Security Platform to be used by developers directly.

- We published research and educational content including our Cryptography 101 video series, security insights on @Uniswap X, a write-up on a novel ZK-Snark vulnerability, and much more.

𝐓𝐡𝐞 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐏𝐥𝐚𝐭𝐟𝐨𝐫𝐦

- The Defender 2.0 Update features automated code analysis in each PR, efficient audit workflow, automated security for deployments/upgrades, advanced incident response tools, and support for over 20 networks.

- Defender had a huge impact on the ecosystem, used by 15,000 different protocols. Code Inspector identified 106,272 issues across 11,893 runs by 384 different protocols; Defender facilitated over 1.27 million automated transactions by 4,000+ relayers; and triggered 6000 monitors resulting in 113+ million alerts.

𝐂𝐨𝐧𝐭𝐫𝐢𝐛𝐮𝐭𝐢𝐨𝐧𝐬 𝐭𝐨 @FortaNetwork

- We implemented delegated staking, introduced fees for bot subscribers, added sharding and scalability enhancements, incorporated AI/ML features, and advanced research in SGX support and L1/L2 security modifications.

𝐓𝐚𝐥𝐞𝐧𝐭

- Congratulations to over 30 top-tier security engineers, developers, and academic cryptographers, who passed our incredibly selective and rigorous interview process. They are the best of the best. We’re looking forward to growing the team in 2024.

We publicly thank all our people, security clients, Defender customers as well as the entire web3 community to whom we dedicate all our efforts.

We look forward to an outstanding 2024.
The OpenZeppelin team

[OmerG @Om3rGr]

@AvishayOvadia https://t.co/Suk96AkTcO

[OpenZeppelin @OpenZeppelin]

Become a Blockchain Security Researcher 🕵🏽‍♀️

Join OpenZeppelin’s fourth cohort of the Fellowship program. Start your path to full-time code cracking for the largest protocols in crypto.

Application period is open for a limited time!

📅 Deadline: July 26
👇

[Forta 🏰 @FortaNetwork]

FORT Airdrop: It’s Time to Protect Web3 🔒

The FORT Airdrop rewards early community members and seeds the broader Web3 security community with FORT tokens so they can begin building on the Forta Network

Check eligibility here ➡️ https://t.co/y7KPzojTC2

[OmerG @Om3rGr]

Detailed explanation of how the recent @NBAxNFT hack went down. @OpenZeppelin is here to support you in writing safe code and to protect your digital assets.

[OpenZeppelin @OpenZeppelin]

The @NBAxNFT suffered from security exploits during their NFT drop, losing nearly 18,000 NFTs in an hour.

Was this exploit preventable with improved security measures and proper coding? We believe so.

A deep-dive into the code in the thread below​👇

[OpenZeppelin @OpenZeppelin]

Rugpull vulnerability patched in @ConvexFinance’s live contracts. $15 billion in TVL secured.

Summary in thread below. See blog for technical details.👇
https://t.co/dAkUom9qX1