Valves Security

We keep your project secure, so you can build and innovate with confidence

[Valves Security @ValvesSec]

Wrapped up the @Panoptic_xyz contest on @code4rena 🏆

We secured 1st place🥇 with 5 valid findings (1 High / 4 Medium), including 1 solo submission.

Really interesting system. Excited to see where Panoptic goes from here. Bright future ahead 🚀

[Valves Security @ValvesSec]

Truly happy to see such kind words coming our way 🫡

[Valves Security @ValvesSec]

We have contributed to Web3 in many ways❗️

Our official engagements are just one part of what we have been doing over the past six months.

- We have reached out to many protocols, identifying vulnerabilities with our AI-powered security tool, without receiving anything in return.

- We have built a training hub for aspiring security researchers who want to learn and improve their skills.

- We have invested real money in the protocols we have secured, including DeFi and liquidity pool projects.

We are here to make Web3 safer, and our contributions go far beyond paid engagements. 🫡

[Valves Security @ValvesSec]

Get the answers to these questions https://t.co/nicHQxiBFb

- Why do we only put proven auditors on your code?
- What does “proven” actually mean?
- What questions should you ask before starting an audit with a security firm?

[Vesko210 @Vesko_210]

Was not too hard. Happy to share this!

The @ValvesSec AI security tooling just got a major update 🫣

[Valves Security @ValvesSec]

We keep your project secure, so you can build and innovate with confidence 🛡️

[Valves Security @ValvesSec]

🥪 The fee payer controlled how cheaply the protocol could sell its own cut.

A liquidity manager compounded the trading fees earned by a user's position. It took a percentage of those fee tokens, sold that cut for USDC to pay the protocol, and reinvested the remaining tokens for the owner.

The owner supplied the slippage tolerance for that fee sale too.

Illustrative numbers for one non-USDC fee token, with no bot fee: 100 earned TOKEN leave 90 for reinvestment after a 10 TOKEN protocol cut. If those 10 TOKEN sell for 80 USDC instead of 100, the owner still gives up 10 TOKEN. The protocol receives 20 USDC less.

⚔️ Attack path:

1. The owner targets a compound where the remaining tokens match the position's required ratio at execution, so reinvestment needs no rebalance swap. They choose a permissive slippage tolerance.
2. Front-run: the owner sells TOKEN into the market used by the fee sale, pushing its price down.
3. Compound: their transaction sells the protocol's fixed token cut at the worsened price. The loose tolerance allows the reduced USDC output, and the remaining tokens proceed to reinvestment without a rebalance swap.
4. Back-run: the owner buys TOKEN back after the compound, seeking to unwind the first trade at a lower price.

💥 Impact:

The protocol receives less USDC from the same fee-token charge. The owner can potentially recover part of that fee through the surrounding trades.

Skipping the rebalance matters: a rebalance swap could also expose the owner's remaining tokens to the manipulated price. Liquidity addition and any dust conversions still occur and affect the economics.

🔎 Root cause:

The fee payer chose the allowed execution loss on the sale funding the protocol's payout. Worse execution reduced that payout without increasing the predetermined fee-token charge.

🛠️ Fix:

Enforce a protocol-set slippage cap on fee conversions while honoring a stricter user tolerance.

[Valves Security @ValvesSec]

For every protocol, we build a custom security team that brings together different strengths: auditors who find uncommon bugs and those who consistently deliver high coverage.

We know that every protocol is different, and we put together the right team for your needs 🤝

[Valves Security @ValvesSec]

For every protocol, we build a custom security team that brings together different strengths: auditors who find uncommon bugs and those who consistently deliver high coverage.

We know that every protocol is different, and we put together the right team for your needs 🤝

[Valves Security @ValvesSec]

@brailmarket @base @oarcoin @Web3Nigeria @Based_Africa How can I contact you?

[Valves Security @ValvesSec]

🥪 The fee payer controlled how cheaply the protocol could sell its own cut.

A liquidity manager compounded the trading fees earned by a user's position. It took a percentage of those fee tokens, sold that cut for USDC to pay the protocol, and reinvested the remaining tokens for the owner.

The owner supplied the slippage tolerance for that fee sale too.

Illustrative numbers for one non-USDC fee token, with no bot fee: 100 earned TOKEN leave 90 for reinvestment after a 10 TOKEN protocol cut. If those 10 TOKEN sell for 80 USDC instead of 100, the owner still gives up 10 TOKEN. The protocol receives 20 USDC less.

⚔️ Attack path:

1. The owner targets a compound where the remaining tokens match the position's required ratio at execution, so reinvestment needs no rebalance swap. They choose a permissive slippage tolerance.
2. Front-run: the owner sells TOKEN into the market used by the fee sale, pushing its price down.
3. Compound: their transaction sells the protocol's fixed token cut at the worsened price. The loose tolerance allows the reduced USDC output, and the remaining tokens proceed to reinvestment without a rebalance swap.
4. Back-run: the owner buys TOKEN back after the compound, seeking to unwind the first trade at a lower price.

💥 Impact:

The protocol receives less USDC from the same fee-token charge. The owner can potentially recover part of that fee through the surrounding trades.

Skipping the rebalance matters: a rebalance swap could also expose the owner's remaining tokens to the manipulated price. Liquidity addition and any dust conversions still occur and affect the economics.

🔎 Root cause:

The fee payer chose the allowed execution loss on the sale funding the protocol's payout. Worse execution reduced that payout without increasing the predetermined fee-token charge.

🛠️ Fix:

Enforce a protocol-set slippage cap on fee conversions while honoring a stricter user tolerance.

[Valves Security @ValvesSec]

We literally invest in the projects that we have secured and believe in. We are part of DeFi, we use DeFi, and we are proud to work alongside the brilliant minds building this space.

We don’t just secure Web3 from the sidelines. We are part of the ecosystem ourselves 🫡

[Valves Security @ValvesSec]

@0xAnmol_ @Vesko_210 🫡

[Valves Security @ValvesSec]

To get a quote and kick off your project’s audit as quickly as possible, you need to have a clearly defined scope and a Github repository ready to share.

We can move fast! You can use that in your advantage 👊

[Vesko210 @Vesko_210]

We at @ValvesSec keep finding basic issues in protocols that have already been audited by firms with thousands of audits behind them.

This isn’t serious...

There are plenty of elite security researchers available now, and AI tools that can cover codebases better than some of these companies do.

Founders are paying for real protection - not just a badge on their website. They deserve better.

Do it right. We can all do better. 🛡️

[Valves Security @ValvesSec]

@BartertownC @TheMasksXYZ @mr430aoncrypto @YaBonksOfficial @MAXFILABS @AskVenice @base Chill out my guy

[Valves Security @ValvesSec]

Before starting an audit with a company of your choice, always ask who will actually be auditing your codebase.

If you’re not immediately impressed, come talk to us 😏

[Valves Security @ValvesSec]

Currently auditing Uniswap V3/V4 with Robinhood integration. Seeing a lot of Uniswap projects lately.

[Valves Security @ValvesSec]

@0xShaedyW That’s true, but you should make sure the Ai puts that knowledge to use. Also you can use that knowledge to find similar issues in new code

[Valves Security @ValvesSec]

@Taperedfail Should it be? 🫣

[Valves Security @ValvesSec]

We ran our solidity Ai audit tool on a past contest.

🚨 It caught 33 of 36 VALID Issues!

- 11 / 13 High-severity issues
- 22 / 23 Medium-severity issues