count-sum

web3 security researcher |
@GuildAcademy_ alumni |
ex @consensys |
solana early supporter

[count-sum @_count_sum]

@CrucibleCrypto Thanks for the shout out, joining the discord.

[count-sum @_count_sum]

@contractdotdev interested

[count-sum @_count_sum]

@0xAlexSR Let's go! 🔥🔥

[count-sum @_count_sum]

@0xenzo_eth @sherlockdefi Happy Birthday bro! 🎂

[count-sum @_count_sum]

@rektoff_xyz Just applied. Hoping to get selected this time

[count-sum @_count_sum]

@0x3b33 Congrats!! looking forward to read the write up

[count-sum @_count_sum]

@pashov Thank you for the inspiration! 👏

[count-sum @_count_sum]

@trustyournuts Interested. Let's connect!

[count-sum @_count_sum]

I'm back. Been silent for a few months taking care of some personal issues. This time I've started upskilling on AI (still focusing on making web3sec great again lol). What are some cool AI courses/articles you would recommend?

[cmichel @cmichelio]

It's not the end, it's still living on in the LLM data training sets. That's why you see so many zero-address check suggestions and inflated severities. (My feeling is that it has improved with recent models though?)
The very early 2021 days with @0xRajeev @gpersoon @sockdrawermoney were peak fun.

What ruined contests from an SR's POV was:
Fewer real bugs because devs and tooling got a lot better, once foundry came along devs started actually testing their code with high coverage. This led to more (arguably) out-of-scope bug submissions which made the highest-impact move arguing about your own & others' issues. The difference between a high and a medium was not well defined in practice & there were some incompetent judges (sorry). Pool sizes also never kept up with the increase in participants.
In the end, the audit contest payout structure changed so much that many were just pre-deployment bug bounties (different pool size unlocks for H/M).

Ironically, now would be a great time for contests again as everyone is boasting about their AI being the best. Would love to see more real results instead of vagueposting.

[count-sum @_count_sum]

@xyz_remedy @Harvesto12 Amazing visuals! Much appreciated!

[Glider @glider_xyz]

Three new queries approved.

@_count_sum flags unsafe uint256 to int256 casts, enabling silent overflow and sign corruption on large values.

@Harvesto12 flags exploitable setFee functions with no access control or bounds checks, letting anyone manipulate protocol fees.

@Pythoninsa flags incorrect rounding direction in ERC4626 preview functions, allowing users to receive more assets than they should.

Queries below:

[count-sum @_count_sum]

@anchabadze @MonetrixFinance @code4rena Amazing milestone! Congrats 👏

[count-sum @_count_sum]

@contractdotdev Interested! Let's connect.

[count-sum @_count_sum]

@ibrahimatix0x01 @immunefi Congrats! 🙌

[count-sum @_count_sum]

@Pelz_Dev @Dray_mon1 @sherlockdefi Congrats! Nice win 🚀

[count-sum @_count_sum]

@pashov @ValvesSec Thanks for this! 🔥

[HackenProof @HackenProof]

A $2.15M exploit.

A proxy misconfiguration.

One tiny arithmetic mistake that turned 0.001 BNB into millions of tokens.

Our community researcher @_count_sum breaks down the Mobius Token exploit on BSC — step by step 🧵

[count-sum @_count_sum]

@pashov @cvetanovv0 🔥🔥

[count-sum @_count_sum]

My mind feels great after learning something new, almost forgot the feeling. 🧠 🤯