Alex Cipher | DeFi & GameFi Security

Smart contract security researcher. Finding what breaks DeFi and GameFi protocols before someone else does. Verified findings on Code4rena. DMs open.

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

Good teams still have blind spots. When you've been staring at the same codebase for months, you stop seeing it the way an attacker would.

That's exactly where an external security review adds value — fresh eyes, different mental model, no assumptions about how the code 'should' work.

Glad the review was useful.

[KoinArcade @KoinArcadeApp]

We just wrapped a smart contract audit for KoinArcade — huge thanks to @_Alex_Cipher for the review.

Even strong dev teams miss things: business logic edge cases, architecture risks, gas traps.
A security-minded second pair of eyes isn’t optional in Web3 — it’s how you ship with confidence.

Audit report is added to both footer and Links page, if you wanna check it out
https://t.co/tRdmc0jhig

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

Not sure where your project stands? Shoot me a DM and I'll take a look.

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

5 Things Hurting the Security of Your Web3 Game

👇👇👇

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

NO SECURITY REVIEW

Many Web3 gaming projects still launch without an audit. Sometimes it's because the project is small, sometimes it's because of budget constraints. Regardless of the reason, unaudited code handling real users and real assets is always a risk.

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

These are the public findings.

I may have something more significant — It's speculative but maybe possible.

@ApeironNFT — DM me. Worth a conversation.

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

Took a look at @ApeironNFT's breeding contracts on Ronin.

0xA84a4F42C9A06b9f03646993E54e52d3B380a00F

Found some things worth talking about 🧵

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

A few lower-severity notes:

[I-1] Fulfilled breed discount data is never cleaned up — stale entries accumulate across thousands of breeds, adding minor gas overhead over time.

[I-2] Interface files allow any 0.8.x compiler while implementations pin to exactly 0.8.12. Harmless today, potential headache tomorrow.

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

These are the public findings.

I have higher severity issues I won't be dropping here.

@fableborne — DM me. Let's talk before this becomes a problem.

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

Took a look at @fableborne's PowerStaker contract on Ronin.

Found a few issues worth flagging 🧵

0xe566BD31d4AB690b7455ee2B99ECf88Eb01a7366

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

[L-4] merge() doesn't enforce descending index order

The NatSpec says fromIndices must be descending — the contract never checks it.

Ascending input causes reads from a stale memory snapshot → wrong amounts merged into positions.

Scoped to STAKE_EDITOR_ROLE, but still a footgun.

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

I tried to find the team.

Deployer address: 0x41179085C5C259F9E4cDAa348b93806A76F7B47D

No socials. No web presence.

Zero TVL means no users at risk, so full disclosure is fine. But if you're the deployer and you're reading this — fix finding #1

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

Found a vault on Base with zero TVL, anonymous deployer, and a HIGH severity finding.

Buckle up.

[Alex Cipher | DeFi & GameFi Security @_AlexCipher]

Lows and info:

→ renounceOwnership() is callable — permanently freezes admin with one accidental call

→ CEI violation in _withdraw (safe only because of nonReentrant — for now)

→ No public earn() to stake idle LP donations