𝐀𝐛𝐛𝐚.𝐞𝐭𝐡

Web3 enthusiast & Solidity dev crafting secure smart contracts. Solidity & Security Journey | @CyfrinUpdraft alumni

[𝐀𝐛𝐛𝐚.𝐞𝐭𝐡 @abbaeth_]

🧵 I just finished a full smart contract security audit from scratch, on a Custom VestingVault contract.
Found 2 High bugs and 1 Medium. All confirmed with Foundry PoCs.
Here's what I learned 👇

[SHERLOCK @sherlockdefi]

New bug bounty live on Sherlock!

From @InverseFinance, the @MonolithMarket Stablecoin Factory bug bounty is now live, with rewards up to $20k. If you're a researcher who hunts stablecoin protocols, this is one to look at.

Full scope and submission details: https://t.co/Gl5bSffTvx

[Arsen @arsen_bt]

6 AMM exploit writeups that teach real security.

○ Kyberswap
🔗 https://t.co/RWvPhiBjs4

○ Raydium
🔗 https://t.co/GMihyGRgXZ

○ Balancer
🔗 https://t.co/D1Xfxpn7a1

○ Yearn Pools
🔗 https://t.co/gkzWspkKJq

○ dHedge Bounty
🔗 https://t.co/IpQlBgSnN1

[Arsen @arsen_bt]

5 things the research phase actually means.

After you understand every line, research starts.

• List invariants the code MUST hold
• List assumptions the dev made
• Compare dev intent to actual behavior
• Read how other protocols do the same thing
• Read integration docs/code very deep

Googling "common bugs" isn't research.

That's low-hanging fruit hunting.

[Pyro @0x3b33]

First leaver wins 🧵

[Arsen @arsen_bt]

4 newsletters I never miss in Web3 security.

■ Defendor
🔗 https://t.co/L1zk9IDyKU

■ Blockthreat
🔗 https://t.co/QOQSMMGv6n

■ One Bug Per Day
🔗 https://t.co/3CEOoasjHe

■ Rekt news
🔗 https://t.co/HVCCE4s2mS

[0xApple @0xapple_]

one thing most auditors learn the hard way 🔐

💡 shadow audits

I used to skip them because I thought reading reports was the same thing, it's not even close

🧠 reading = passive, your brain tricks you into thinking you get it
🔍 auditing first = you find out exactly what you don't see

6 @code4rena contests to try this on right now:

🔹 Sturdy — https://t.co/1aShjqHwtN
🔹 Wenwin — https://t.co/kMml84FgT2
🔹 veRWA — https://t.co/7CewAvaYbi
🔹 Lambo — https://t.co/6mtEdSNAyN
🔹 Canto Identity — https://t.co/bjR9ZbLVdH
🔹 Canto Liquidity — https://t.co/iw0L18tmZ1

reports teach findings, shadow audits teach thinking ⚔️

[Arsen @arsen_bt]

3 questions to map money flow in any protocol.

• Where does money enter? (deposit, stake, lock)
• Where does money exit? (withdraw, redeem, liquidate)
• How does it move between?

Stop listing functions. Track the money.

[Dacian @DevDacian]

Q) How do you find bugs using AI both manually and automated?

Prior to AI finding bugs was about asking the code a lot of "what if" questions then answering them yourself plus also knowing what to look for (code smells, important protocol properties, heuristics etc while having an attacker mindset).

This is still the same with AI - AI just makes it faster and more efficient to answer many of these questions.

So when using it manually, basically just ask it lots of questions, the more focused the better. Eg pick a part of the codebase and ask it lots of "what if" scenario questions like "what if this happens", "could this happen" etc.

Focus on something important and try to think of all the ways it could break, then ask the AI a lot of specific questions about it, run through many different scenarios using the AI, explore the possibilities together.

When it comes to building automated AI vulnerability finders that is a different ball-game; now you'll need to engineer efficient multi-stage workflows that should model a realistic audit process. You'll need to:

1⃣ teach AIs how to think, what to look for, the questions it should be asking. This is the most important thing as if you get this right it can find bugs in all future unseen codebases since it isn't pattern matching.

You need to understand the mental processes an elite hacker would go through to find different types of bugs, then teach that to an AI.

2⃣ create an efficient workflow that models how an elite hacker would conduct a real audit while also leveraging the distributed power and scale of AI

3⃣ ensure the workload and required knowledge is efficiently distributed among a team of agents, such that each agent has a specific focus to avoid context bloat (remember point I made about how when using AI manually, it works much better if you ask specific questions regarding certain components - same principle applies here)

4⃣ implement various workflows to deduplicate, merge, validate the potential findings, as well as provide every agent with the context and input it needs to do its job while avoiding providing it with a bunch of unnecessary information that bloats its context

5⃣ have an efficient process for continual improvement such that the AI can continue to improve itself to find an ever-increasing diverse range of bugs, ideally with minimal human input

[0xApple @0xapple_]

😭 auditing for weeks and finding zero bugs?
it's not bad luck, you just haven't trained on the right codebases

💡 the fix: shadow audits

audit a closed contest yourself → then read the report → see what you missed

but pick the RIGHT ones. small nSLOC, diverse bug types, don't start with 5k line monsters 💀

here are 5 @sherlockdefi contests perfect for this (2 days each max):

🔹 Surge — https://t.co/MRYPjj25bB
🔹 Telcoin — https://t.co/R8pAc5ns02
🔹 Olympus — https://t.co/sA5BDqZZos
🔹 Cooler — https://t.co/8ZaXmPx7rV
🔹 Crestal — https://t.co/ttLh8uuJp3

the fun part? check the results after

see what you could've earned if you'd submitted makes it feel real 💰

that gap between your findings and the winners = exactly where to improve 🧵

[Immunefi @immunefi]

Product update: Account verification on Immunefi

We've expanded how security researchers can verify their accounts on Immunefi, so the system works for everyone, not just those with NFC-enabled passports/IDs.

Why this matters:

Spam accounts and fake reports have become a real problem across the industry. They waste protocol resources, slow down triage, and ultimately hurt the legitimate security researchers doing serious work.

To address this, we introduced a proof of humanity system with ZKPassport, a Sybil-resistant approach that keeps identity self-sovereign and privacy-preserving, without storing sensitive documents.

But ZKPassport doesn't work for everyone. Not all researchers have passports or ID cards with NFC chips, and the app itself has had bugs. Some researchers were locked out as a result. That was our mistake, and we've been working to fix it.

Three ways you can now verify:

Security researchers now have three options:

1. ZKPassport: works for researchers with an NFC-enabled passport or ID card.

2. Human Passport (new, primary method): verification based on a Unique Humanity Score built from your web3 activity, social accounts, and identity-tied credentials. Hit the threshold, and you're verified.

3. Pay to verify (experimental): currently rolled out to ~10% of users. If the first two methods don't work, researchers can pay a fee to prove they're human.

The goal is simple: every security researcher should have a fair shot at hunting bounties on Immunefi. If you were locked out before, give it another try, and let us know if you hit any issues.

To learn more about Human Passport, check out the Help Center article:

https://t.co/v9cl6qK2Mh

[ddimitrov22 @ddimitrovv22]

Auditing tip for every beginner to intermediate security researchers:

Always set specific goals for every auditing block.

For example:

> understand the protocol on a high level
> deep dive only in the liquidation mechanism
> check all external calls for reentrancy

[Guild Academy @GuildAcademy_]

Ethereum needs more security engineers.

Attackers are scaling faster than defenders, and the pipeline of qualified researchers is too small.

Guild Academy is building that pipeline — 5 cohorts in.

We're in @thedaofund 500 ETH Ethereum Security round on @Giveth, and it uses Quadratic Funding.

That means $1 from 100 donors > $100 from 1 donor. Your small donation unlocks much more from the matching pool.

If our work matters to you, even $1 helps.👇
🔗 https://t.co/NnYhz98uZz

[Pandit | Ξ🦇🔊 @panditdhamdhere]

I love this!

https://t.co/IieTlvB4ju

[pashov @pashov]

🚨🤯Someone built an AI tool that one-shots the threat model & invariants of your Solidity codebase. Companies used to charge >$20k for this.

It's called X-ray, free and fully open-source. My security team will be using this. Check it out below👇
https://t.co/gh1wC1Bap3

[Valves Security @ValvesSec]

🚨Free for anyone who wants to get better at Web3 security!!!

Most researchers struggle with:
• Too much passive reading
• Not enough real-world attacker pattern recognition

That’s exactly what we’re fixing with the Valves Security Training Hub. 📚

Instead of just theory, you will train on how attackers actually think, so you can spot vulnerabilities faster and with confidence.

If you’re serious about improving, this is for you.

Start training 👇
https://t.co/dKrd5PMtFj

[Dhaval Makwana @heyDhavall]

Instead of watching Netflix tonight, watch this 2-hour Stanford lecture.

You’ll learn more about how ChatGPT, Claude, and other LLMs are built than most people at top AI companies learn in years.

[Evan Luthra @EvanLuthra]

Anthropic pays engineers $750,000+ a year to understand how LLMs work.

Stanford just put a 2 hour lecture that covers 80% of it for FREE.

Bookmark this. Give it 2 hours today.

It might be the highest ROI thing you do this month:

[Immunefi @immunefi]

New project just launched their bug bounty on Immunefi, with rewards of up to $100,000.

@tropykus is a decentralized lending protocol built on Rootstock (RSK), a Bitcoin sidechain compatible with the Ethereum Virtual Machine (EVM).

Time to get hunting.

https://t.co/jJdFTjdY5m

[Pyro @0x3b33]

If I was starting auditing right now here are the things I would do:

[Smacaud @Smacaud1]

Congratulations on your failure, most people don’t even try.

The more you lose, the more you win.