Mel

Web3 Security Researcher | Breaking Contracts @ Pashov, Bailsec | Available for hire (DMs open)

[Mel @x0sauce]

@PashovAuditGrp 🫡

[Mel @x0sauce]

Enjoyed auditing a Uniswap V4 integration with @PashovAuditGrp and found a couple of solo critical issues!

The most interesting criticals come from interactions with V4 core logic outside the audit scope.

Building a V4 related protocol? DM me for an audit!

[Pashov Audit Group @PashovAuditGrp]

5 security researchers, 3 full weeks of audit, 66 total vulnerabilities found. Big DeFi codebase with high complexity.

The project did what was the smart thing to do - fixed all severe issues, then booked a follow-up audit.

Learn from the findings👇
https://t.co/GnoJgFgfKj

[Mel @x0sauce]

Stay humble. We are not as good as we think we are most of the time.

[Mel @x0sauce]

Form your own beliefs on whether something is worth it or not. Not from someone on this app telling you that it is not worth it anymore. Theres a lack of nuance on the internet.

[Mel @x0sauce]

Never a fan of all or nothing beliefs.

[Quant @quant_xbt]

9 months ago I would’ve given the same answer everyone in this thread is giving: yes, fundamentals matter, you need to understand code to vibe-code, AI is just a tool, etc.

Today I’m convinced that’s pure cope.

No, it’s not worth learning to code in 2026. Models are the worst they’ll ever be, and they’re already better than most junior devs. Unless you’re getting to senior-level skills in <2 years (you won’t), models are going to improve faster than you can learn.

You’re starting from zero against something that gets exponentially better every few months. Just code with AI however you can, time will make up for the current gaps in your knowledge.

[Mel @x0sauce]

Good read

https://t.co/nmCP4KMFYh

[Mel @x0sauce]

Think and think harder. using your brain is underrated

[Mel @x0sauce]

I get that on X, many narratives are implying that you are either all in 100% on AI or you ngmi.

I always thought that it is a way to grab attention and engagement and in reality actual work is still done via a split between manual and AI workflows.

[Mel @x0sauce]

@windhustler Paranoia that I missed an important bug.

For me, I get paranoid to even miss edge case bugs hiding from certain states the contract has low likelihood to reach. You never know when those turn into actual bugs in production.

[Mel @x0sauce]

I hold the believe that there are always more bugs to be found

[Mel @x0sauce]

Just passed the DAML Fundamentals certification!

Have been spending some time studying @CantonNetwork and DAML developed by @digitalasset. Very interesting design with three levels of permissions (signatory, observer, controller).

Looking forward to contribute to the ecosystem!

[Mel @x0sauce]

Every extra piece of knowledge = 1 new idea for a bug

[Mel @x0sauce]

I hate AI replies and responses with a passion

[Mel @x0sauce]

One of the simpler ways I enjoy using AI is to let it create practical questions to test my knowledge instead of asking it to explain it to me. Works super well for me to retain what I learnt.

[0xnevi @0xnevi]

I just want to give a big shoutout to @x0sauce man, one of my only friends that stuck to security research.

Man has some insane attention to detail and coverage for his audit work (I think @pashov would know 😉).

Amidst all the AI blaber, I am so proud of him man.

[Mel @x0sauce]

Wow AI is good but I am getting nerfed by usage limits 😢

[Mel @x0sauce]

There are always 10x more edge cases and 10x more scenarios to be considered

[Mel @x0sauce]

@rosarioborgesi @Uniswap @CyfrinUpdraft My differing take is its never too early. You can just start :-)

I started learning the V2/V3/V4 codebase without knowing anything going into it ~

[Mel @x0sauce]

Having a lot of fun reading /writing solana code using/in anchor and rust

[Mel @x0sauce]

One day into bounty hunting and the protocol removes their verified contracts and updates them to non verified contracts on chain.

They also have no public github repo ☠️