keser

bc exp | @openzeppelin, @strixeye, iel, @tuberlin

[OpenZeppelin @OpenZeppelin]

Today we are announcing that S&P Global has entered an agreement to acquire OpenZeppelin.

Onchain finance is growing from an emerging market into core financial infrastructure, and the standards and rails our team and community built are becoming the rails of global finance. OpenZeppelin smart contracts facilitated over $37 trillion in value transferred, with the vast majority of the largest DeFi protocols, blockchain networks, stablecoins and tokenized funds relying on them.

With S&P Global, we expect to accelerate the impact of onchain finance, backed by more than a century of trust in global markets, benchmarks, and risk frameworks.

To our clients and to all the users of OpenZeppelin open source tools:
• OpenZeppelin Contracts and all our open source applications and tools remain open source, free, and publicly maintained on GitHub. Building open source standards stays a core priority.
• Audits, engineering work, and ecosystem programs continue with the same team, brand, quality, and customer experience, with what will be the added benefit of S&P Global's research capacity, market data, and institutional reach.

For the last decade, OpenZeppelin has set the security standard for onchain finance. Today begins a new chapter for that mission, together with one of the most trusted names in global markets.

Read the full announcement: https://t.co/lxBUWkWVUK

[Forta 🏰 @FortaNetwork]

Forta Firewall 🤝 @plumenetwork

On Day 1 of Plume mainnet, we’re proud to protect protocols with real-time, AI-powered transaction screening, stopping malicious activity before it hits the chain.

Built for a permissionless and composable RWAfi future. The future is secure 🪶

👉 https://t.co/W4Z97P52gh

[keser @aliomerkeser]

@plumenetwork My condolences to all his loved ones. May he rest in peace

[Gelato @gelatonetwork]

New Marketplace Partner: @FortaNetwork Firewall

A powerful rollup security & compliance primitive is now live on Gelato rollups.

Unlike tools that react after an exploit, Forta uses AI to screen and block malicious transactions in real-time at the sequencer level.

[Forta 🏰 @FortaNetwork]

Scaling Ethereum isn't just about throughput—it's about security too 🔐

Forta + @Conduitxyz ensure rollups can scale safely, with Forta Firewall stopping exploits before they execute.

Security at the RPC level, zero dev effort needed.

[OpenZeppelin @OpenZeppelin]

At OpenZeppelin, we’re on a mission to protect the open economy.

2024 proved the huge impact of our open-source efforts—over $10.5 trillion in value was transferred securely using OpenZeppelin Contracts.

Check the highlights on how we are moving the industry forward ⬇️

[Forta 🏰 @FortaNetwork]

Forta Firewall is Live: Ushering in a New Era of Onchain Security 🛡️

Firewall blocks malicious transactions before they happen, offering real-time screening for rollups and protocols to catch threats and compliance risks

Instead of just detecting threats, Firewall prevents them

[Forta 🏰 @FortaNetwork]

Forta is cooking 🧑‍🍳

Check out Forta's proposal on the @EthMagicians forum to see what the future of threat prevention might look like 👀

https://t.co/jXxwYmKvTy

[OpenZeppelin @OpenZeppelin]

🚨 SECURITY ALERT🚨

The @compoundfinance Twitter account appears to have been compromised and has been posting malicious airdrop links.

Do not interact with any links posted by the compound labs account or respond to any DMs until further notice.

[OpenZeppelin @OpenZeppelin]

Since 2016, OpenZeppelin has been passionately dedicated to creating a secure, open, and decentralized financial world.

In 2023, our achievements surpassed our own expectations.

Here is a summary of everything we did this year to secure open finance :

𝐎𝐩𝐞𝐧𝐙𝐞𝐩𝐩𝐞𝐥𝐢𝐧 𝐂𝐨𝐧𝐭𝐫𝐚𝐜𝐭𝐬 𝐋𝐢𝐛𝐫𝐚𝐫𝐲

- We launched Contract 5.0 with enhanced code, modernized access management, and stronger security with expanded fuzzing and formal verification.

- A newly formed team achieved the first milestone in building @Polkadot Parachain templates (a generic runtime MVP).

- We created the Foundry upgradeability plugin and enhanced the one for @HardhatHQ

- We migrated the OpenZeppelin library for @Starknet fully from @CairoLang 0 to 2.3, released 2 new versions, the Wizard for Cairo, and a fully revamped docsite.

-We revamped the Contracts Wizard with AI, allowing the creation of smart contracts with natural language.

𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬

- We conducted 111 audits resolving 2,084 issues (including 184 high+ risk); and expanded audit capabilities to @rustlang , @CairoLang , and @golang .

- We retained 100% of our comprehensive security partnership clients, demonstrating our high-value delivery and tangible contribution to their success. These include @compoundfinance, @TheSandboxGame, @umaprotocol, @the_matter_labs , @OriginProtocol, @graphprotocol , @VenusProtocol , @avax and @paritytech .

- We Implemented a mission-critical, novel Incident Response offering with our comprehensive security partners, including simulations with the SEAL team.

- To launch our ZKP practice, we formed a world-class team of renewed academic cryptographers and security researchers to advise, assess, and audit ZKP systems including @LineaBuild , @Scroll_ZKP, and @zksync. The team improved designs and uncovered significant critical issues.

- Expanding Ethereum to institutions: We delivered proofs of concepts and confidential security reviews for traditional finance and government institutions.

-To support our auditors with the best tools, we formed a fully focused internal tooling team which ended up creating Contract Inspector, the best solidity code analysis tool in existence. This tool has been incredibly effective, detecting over 5x as many issues as at the start of the year (currently more than 130 detectors), while also halving the false positive rate to less than 14%. This success is largely attributed to our in-house AST. Code Inspector was so useful for our auditors that we ended up including it inside the Defender Security Platform to be used by developers directly.

- We published research and educational content including our Cryptography 101 video series, security insights on @Uniswap X, a write-up on a novel ZK-Snark vulnerability, and much more.

𝐓𝐡𝐞 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐏𝐥𝐚𝐭𝐟𝐨𝐫𝐦

- The Defender 2.0 Update features automated code analysis in each PR, efficient audit workflow, automated security for deployments/upgrades, advanced incident response tools, and support for over 20 networks.

- Defender had a huge impact on the ecosystem, used by 15,000 different protocols. Code Inspector identified 106,272 issues across 11,893 runs by 384 different protocols; Defender facilitated over 1.27 million automated transactions by 4,000+ relayers; and triggered 6000 monitors resulting in 113+ million alerts.

𝐂𝐨𝐧𝐭𝐫𝐢𝐛𝐮𝐭𝐢𝐨𝐧𝐬 𝐭𝐨 @FortaNetwork

- We implemented delegated staking, introduced fees for bot subscribers, added sharding and scalability enhancements, incorporated AI/ML features, and advanced research in SGX support and L1/L2 security modifications.

𝐓𝐚𝐥𝐞𝐧𝐭

- Congratulations to over 30 top-tier security engineers, developers, and academic cryptographers, who passed our incredibly selective and rigorous interview process. They are the best of the best. We’re looking forward to growing the team in 2024.

We publicly thank all our people, security clients, Defender customers as well as the entire web3 community to whom we dedicate all our efforts.

We look forward to an outstanding 2024.
The OpenZeppelin team

[OpenZeppelin @OpenZeppelin]

🚨 Important Security Alert to the Community 🚨

We are publicly disclosing a critical vulnerability arising from a problematic integration of the standard ERC-2771 and self delegatecall with user input data, including but not limited to multicall. This issue poses a significant risk of address spoofing attacks for projects combining these patterns.

This issue is caused by a problematic integration pattern, and is not particular to the implementations contained in the OpenZeppelin Contracts library.

Nonetheless, our team has been diligently working together with the whitehat community to identify and notify potentially vulnerable projects. We are committed to keeping the ecosystem safe and informed.

For an in-depth analysis and actionable steps to secure your contracts, please read our comprehensive public disclosure on our blog.

🔗https://t.co/hwp1HIh0EA

[ernestognw.eth @ernestognw]

@OpenZeppelin contracts is free for everyone and it’s deep in our values to keep it like that.

However, funding for audits, research and engineering is not. If you’ve ever used our contracts, please consider contributing to our Gitcoin application 🫶🏻

https://t.co/Tkw21rMyGy

[Christian Seifert @cseifert]

Thanks for sharing your experience, and glad Forta had you covered. Download the Forta Snap at https://t.co/PzFtvQk9HG.

[Forta 🏰 @FortaNetwork]

Are you a Go engineer looking to contribute to the forefront of Web3 security?

The @OpenZeppelin team is hiring a dedicated software engineer to work on the Forta Network 🤖💼

https://t.co/deZwTWD7lp

[keser @aliomerkeser]

attention -- anyone interested in building a super fun bc monitoring/thread intelligence network? we're hiring new engineers 👇
https://t.co/4EmThwaT4r

[Tom Moylan @moylato]

VIENNA: Beer Party is polling at 12%.

Policies include:
🍺 A beer fountain for Vienna
🍺 New 50% tax on Radlers and "other atrocities"
🍺 Monthly barrel of beer to Austrian households (50L per adult, 20L per child)
🍺 Radler buyback programme, exchanging Radlers for real beer

[Forta 🏰 @FortaNetwork]

Evasion Techniques are a scammer’s game, but Forta Network researcher @4pe0x is flipping the script! 📜

Discover how attackers’ deception tactics can become part of a defender’s toolkit in Forta’s latest blog 👇

https://t.co/lztroNPwTb

[Forta 🏰 @FortaNetwork]

Breaking: Yesterday @VitalikButerin's account was hacked, exposing millions of people to a phishing URL 🎣

Forta's Scam Detector flagged the attacker EOA as soon as they claimed their first victim ⏩

🤖 https://t.co/Ng5OduJtxz

[OpenZeppelin @OpenZeppelin]

Secure Code: new module on Defender 2.0 for smart contract security on every @GitHub pull request

Automatic code analysis for vulnerabilities, gas cost, improvements, and test runs – all integrated into your development workflow

Let’s see how it works 🧵👇

[Safe.eth @safe]

Congrats @OpenZeppelin on Defender 2.0! 🥳

Using the new Deploy module, you can now approve upgrade proposals directly from a @safe account.

Audit results and detailed upgrade info are also shared with Safe signers before transaction execution, ensuring security with speed.

🔽