Valkyri

Security built from the ground up - infrastructure, on-chain, and every layer in between. DM us to get started!

[Valkyri @ValkyriSecurity]

🧵 Introducing Fullstack Audits
1/
99% of “audits” in web3 only check smart contracts.
But attackers don’t respect boundaries.

And that’s why “audited” projects still get hacked. 👇

[0xaudron @0xaudron]

One of the biggest mistakes smart contract engineers make when building off-chain systems:

ATOMICITY, assuming the EVM's failure model still applies.

While reviewing a Polymarket-based Telegram bot, I uncovered a flaw that enabled dual redemption because of exactly this mistake 🧵:

[Valkyri @ValkyriSecurity]

@n00r_Btc @HackenProof 🫡

[Valkyri @ValkyriSecurity]

There we go, we are listed on @HackenProof blockchain auditors team list. Now you can contact us from there for the audits!

[Valkyri @ValkyriSecurity]

@HackenProof 🫡🤝

[Valkyri @ValkyriSecurity]

@RangaSquared @HackenProof 🫡

[Valkyri @ValkyriSecurity]

@kenzowhitehat @HackenProof 🤝🫡

[Valkyri @ValkyriSecurity]

There we go, we are listed on @HackenProof blockchain auditors team list. Now you can contact us from there for the audits!

[Valkyri @ValkyriSecurity]

@yashar0x Valkyri and ShredSec co-founders killing 🔥

[Valkyri @ValkyriSecurity]

Great job by one of our co-founder 🫡

[Ahsan Khan @hunter0x7]

Critical: Client-Side Encryption Collapse

https://t.co/nbScR5c6hj
↓
some_javascript.js
↓
Line no 80519 → encObj + base64 key
↓
atob(val) → "Encoded_Password"
↓
CryptoJS.AES.decrypt(encObj, passphrase)
↓
55 configuration properties → 107 operational secrets exposed
→ Azure AD client_secret → OAuth client_credentials flow
→ RSA public keys → Forge encrypted /enc/ API requests
→ HMAC key → Backend-accepted payload signing
→ Direct Line token → Production chatbot access
→ Monitoring / RUM keys → Telemetry manipulation
→ Auth0 + reCAPTCHA config → Auth flow manipulation
→ 31+ encrypted authentication endpoints mapped
↓
Use extracted Azure AD credentials
↓
Request token from Microsoft OAuth endpoint (client_credentials)
↓
Receive valid JWT with high-privilege role (e.g., AllAccess)
↓
“Super token” accepted by backend across protected API routes
(No user interaction required, role-based authorization granted)
↓
All sensitive authentication and account endpoints
were wrapped in client-side hybrid encryption
→ Every request payload encrypted in browser
→ AES-256-CBC used for body encryption
→ RSA-OAEP used to wrap per-request AES key
→ Server accepts any request that decrypts successfully
→ Decryption success treated as implicit authorization
↓
Reverse-engineer encryption module (@**6246)
→ Algorithm: AES-256-CBC + RSA-OAEP (SHA-512)
→ Random 32-byte AES key per request
→ IV derived client-side
→ AES key wrapped with embedded RSA public key (promocode_pem)
→ Final format: { "key": base64(RSA_key), "body": hex(AES_ciphertext) }
↓
Hook JSON.stringify + XMLHttpRequest
↓
Capture plaintext BEFORE encryption (credentials, OTPs, tokens)
Capture encrypted wrapper AFTER encryption
Capture correlated server responses
↓
Analyze MFA implementation
↓
IP-based rate limiting only (lockout resets on IP change)
OTP expiration not strictly enforced server-side
Encrypted payload fields trusted after decryption
↓
Mass takeover method
↓
1. Trigger MFA or password reset
2. Rotate IP to bypass rate limiting
3. Reuse or brute-force OTP under weak enforcement
4. Complete password reset flow
5. Authenticate as victim
6. Capture decrypted OTP and auth tokens via runtime hook
7. Reuse valid 2FA tokens for subsequent authenticated requests
↓
Full attack chain achieved:
→ Extract secrets from client bundle
→ Generate high-privilege JWT (“super token”)
→ Read any plaintext request (credentials, PII, tokens)
→ Forge any encrypted request the server will accept
→ Bypass MFA protections via IP rotation
→ Reset victim passwords
→ Decrypt authentication flows in runtime
→ Mass account takeover

[InfectedCrypto @InfectedCrypto]

Great to see web3 teams like @ValkyriSecurity working on protecting infra side. Many projects centralize their on-chain program behind a unique (or few) private keys, thinking this is sufficient. But it is definitely not.

[Blckhv @blckhv]

@0xaudron Impressive. @ValkyriSecurity is the no-brainer when it comes to Web2 security.

[0xaudron @0xaudron]

https://t.co/VmruFJ1Gt0

[Valkyri @ValkyriSecurity]

Just dropped an article covering a security issue which could have let any user post under different user’s blog.

We have now stopped working on SocialFi hacking campaign and managed to find few instances which could have leaked private key through infrastructure takeover and admin takeover based bugs.

Well, all this requires severe attention towards. With security posture like this web3 social will never thrive and recent stats already showed their survival interest.

Thanks for reading 🙏

[0xaudron @0xaudron]

https://t.co/VmruFJ1Gt0

[0xaudron @0xaudron]

Get leading fullstack audits at @ValkyriSecurity , if you want to get end-to-end coverage

[Valkyri @ValkyriSecurity]

🚨Integrating x402 for payments?
Read this, for secure integration👇

https://t.co/hxpxGAz48n

[Valkyri @ValkyriSecurity]

Now you can scan the following repos for malware in supplychain with our tool:
✅Github repo
✅Gitlab repo

https://t.co/HTswGsepcA

[0xaudron @0xaudron]

We just added support for gitlab repositories on our "npm-malware-scanner" tool.

Appreciate LeonelArrua for the pull request.

https://t.co/RkMxwRUYBm

[Valkyri @ValkyriSecurity]

It’s a security win to audit the "fullstack" rather than limiting the review to just "smart contracts."

[0xaudron @0xaudron]

DM for audits if you’re building SocialFi platform. Our team at @ValkyriSecurity will get you covered🤝

[Valkyri @ValkyriSecurity]

🚨Top 10 Ways Soroban Contracts Get Hacked

A practical, real-world breakdown of common vulnerabilities on Soroban contracts with code examples. If you’re building on @StellarOrg or auditing Soroban contracts, this is a must-read. 👇

https://t.co/ntO3E8Y33w

[0xaudron @0xaudron]

Top 10 Ways Soroban Contracts Get Hacked👇:

(if your contract has these patterns, make sure to remediate them as soon as possible)