Arnie

Smart Contract Security Researcher

[Arnie @ArnieSec]

10 months ago I decided to learn smart contract security with 0 prior programming or security knowledge, now I am placing top 5 on audit contests.

For anyone who is not satisfied with their current situation, you can completely change your life in less than 10 months.

[Arnie @ArnieSec]

Being on the Code4rena leaderboard was, at one point, one of my biggest goals.

Today, I am no longer the person who once needed that goal to prove himself. I have become more of a researcher than I ever needed to be to reach it.

But the desire to reach those goals kept me going for months. It gave me purpose.

In the end, I never got into Spearbit, I never placed top 5 on the Code4rena leaderboard, I never found 5 uniques in an audit contest, and I never grew my audit company.

But I am grateful for Code4rena, because at one time, it was my dream to be the victor of the arena. At one time, all I wanted was to work in Spearbit. All I wanted was to find 5 uniques and grow my audit company.

The main desire, the desire that gave birth to those goals, was never truly any of the things listed above. The true desire was to become an exceptional security researcher. The goals I made for myself were a way for the world to see it, to know what I could do.

Today, I believe I have achieved it. None of this would have been possible without Code4rena, without that arena in the distance giving me a glimpse of what might be possible if I continued my work.

Farewell, C4.

[Arnie @ArnieSec]

Security goals for the next 6 months:

- get into @SpearbitDAO
- top 5 90 day leaderboard @code4rena
- 5 uniques
- grow my security company

[Arnie @ArnieSec]

What about the consequence of this? If, according to my philosophy, language and thought do not directly cause action, but thoughts narrate action, then what implications does this have for large language models, which are trained on action narration instead of the pure processing and calculations actually done by the thinking brain?

It seems that an LLM does not think like a human, at least not when I say “think” in the deeper sense. When I say thinking, I do not only mean the conscious, verbal, narrated kind of thinking. I mean the non conscious kind: the hidden calculations done by the body and brain before language appears. The human being is not merely producing sentences. The human being is calculating energy, fatigue, threat, reward, desire, memory, bodily state, pain, social pressure, attention, and action readiness. Then, after this deeper processing has already shaped what actions feel possible or impossible, language appears as narration.

So there seem to be two different kinds of thinking here.

The first is non conscious thinking, or preverbal calculation. This is the deeper layer. It is not experienced as sentences. It is the body and brain silently calculating: Do I have energy? Is this worth doing? Am I safe? Is this rewarding? Can I continue? Should I stop? Is this too much? This is the kind of thinking that changes depending on sleep, diet, recovery, stimulation, stress, and vitality. It is the substrate that makes action easier or harder before the mind explains anything in words.

The second is conscious thinking, or narrated thought. This is the verbal layer. It is the thought that appears in consciousness after the deeper state has already shaped the direction of action. It says things like, “I should continue,” “I want to quit,” “I feel motivated,” “this is pointless,” or “I can do this.” But according to my view, these thoughts are not always the original cause. They are often the narration of a deeper action state.

This creates an important consequence for LLMs.

LLMs are trained mostly on the second kind of thinking, conscious narration. They are trained on the words humans produce after the deeper processing has already happened. They are trained on explanations, reflections, arguments, plans, stories, confessions, theories, and rationalizations. But they are not trained directly on the first kind of thinking, the non conscious embodied calculation that produced those thoughts in the first place.

In this sense, LLMs are trained on the afterimage of cognition, not cognition in its full living form. They learn the narration layer of human thought, not the organismic layer that made the narration necessary. They can imitate the way human thought sounds once it becomes language, but they do not possess the same hidden action system underneath.

A human might say, “I quit because I lacked motivation.” But the real cause may have been poor sleep, bad diet, overstimulation, low recovery, stress, or a body state that made continuation feel impossible. The sentence is only the conscious explanation of a deeper process. An LLM can learn that sentence pattern and reproduce it convincingly, but it does not have direct access to the underlying bodily calculation that made the sentence true.

This means an LLM can be very good at narrative cognition but still lack embodied action cognition.

It can explain discipline without needing discipline. It can describe resistance without feeling resistance. It can talk about fatigue without being tired. It can give a plan without having to execute the plan. It can narrate the logic of transformation without undergoing transformation.

That is a major shortfall.

The LLM is not thinking like a human underneath and then speaking. It is closer to starting from language and reconstructing the appearance of thought from the narration humans leave behind. Humans move from body state to action readiness to language. LLMs move from language patterns to simulated reasoning to more language.

So the gap is this:

Human thinking:
non conscious embodied calculation → action readiness → conscious narration

LLM “thinking”:
language data → pattern completion/simulated reasoning → conscious style narration

This does not mean LLMs are useless or fake. Human language still contains compressed traces of deeper cognition. If language is the smoke, then the LLM studies the smoke very deeply and can infer many patterns about the fire. But it does not have the fire in the same way. It is trained on what humans say about action, not on the full hidden machinery that makes humans act.

So, if my philosophy is right, then the shortfall of LLMs is that they are trained on the type of thinking that is conscious, verbal, and narrated, while missing the type of thinking that is unconscious, embodied, and action producing. They can simulate the reflective mind, but not fully replicate the deeper organism that the reflective mind is narrating.

In its strongest form,

LLMs do not learn human thinking directly. They learn the linguistic residue of human thinking.

Or even more simply,

The human speaks from the body into language. The LLM starts from language and tries to reconstruct the body that was never there.

[Arnie @ArnieSec]

It seems to me that thoughts are a reflection and narration of the state my body is in, and not necessarily the causing force of action. For example, I have fewer thoughts of quitting and better adherence to starting or continuing a task when I have slept well, eaten well, and not subjected myself to brain rot. My thoughts then seem to be good, and I feel less mental friction.

The dilemma, or the question, is this, I would not have such thoughts if my preceding actions were not what they were. In this sense, my thoughts are, in part, a narration of my action state. They appear alongside the condition I have already created through sleep, food, recovery, discipline, or overstimulation(or the avoidance of it). When the state is better, the thoughts are better. When the state is worse, the thoughts become more resistant.

If this is not believable, then what is the explanation for why thoughts and resistances change so much depending on diet, rest, recovery, and vitality? Are we really to say that these things simply create better thoughts, and then those better thoughts create better action? To me, it seems more plausible that these priors create better action readiness first, and that the mind then supplies the accompanying narration of such action.

So when I think, "I should continue", or "this is not that bad", it may not be that the thought itself is the first cause. It may be that my body is already in a state where continuing is more possible, and the thought is the conscious narration of that possibility. Likewise, when I think, "I should quit," or "this is too hard", that may not be a pure rational conclusion. It may be the narration of a worse bodily state, a state created by poor sleep, poor food, overstimulation, or low recovery.

In this sense, thoughts may not be the sovereign origin of action. They may be the language that appears after the body has already made certain actions easier or harder. Better priors create better action, and better action is then accompanied by better thoughts. The thought feels like the cause because it is conscious, but it may actually be the visible narration of a deeper state.

This brings into question the "self", we are this narration, the feeling of "I" or "me" is the narration in our heads. Considering that this narration and concept "I", more namely, our thoughts, do not create action, but actually narrate it. What we view us "I" is not the force responsible for our actions, but just an illusion created by our brain.

[Arnie @ArnieSec]

It seems to me that thoughts are a reflection and narration of the state my body is in, and not necessarily the causing force of action. For example, I have fewer thoughts of quitting and better adherence to starting or continuing a task when I have slept well, eaten well, and not subjected myself to brain rot. My thoughts then seem to be good, and I feel less mental friction.

The dilemma, or the question, is this, I would not have such thoughts if my preceding actions were not what they were. In this sense, my thoughts are, in part, a narration of my action state. They appear alongside the condition I have already created through sleep, food, recovery, discipline, or overstimulation(or the avoidance of it). When the state is better, the thoughts are better. When the state is worse, the thoughts become more resistant.

If this is not believable, then what is the explanation for why thoughts and resistances change so much depending on diet, rest, recovery, and vitality? Are we really to say that these things simply create better thoughts, and then those better thoughts create better action? To me, it seems more plausible that these priors create better action readiness first, and that the mind then supplies the accompanying narration of such action.

So when I think, "I should continue", or "this is not that bad", it may not be that the thought itself is the first cause. It may be that my body is already in a state where continuing is more possible, and the thought is the conscious narration of that possibility. Likewise, when I think, "I should quit," or "this is too hard", that may not be a pure rational conclusion. It may be the narration of a worse bodily state, a state created by poor sleep, poor food, overstimulation, or low recovery.

In this sense, thoughts may not be the sovereign origin of action. They may be the language that appears after the body has already made certain actions easier or harder. Better priors create better action, and better action is then accompanied by better thoughts. The thought feels like the cause because it is conscious, but it may actually be the visible narration of a deeper state.

This brings into question the "self", we are this narration, the feeling of "I" or "me" is the narration in our heads. Considering that this narration and concept "I", more namely, our thoughts, do not create action, but actually narrate it. What we view us "I" is not the force responsible for our actions, but just an illusion created by our brain.

[Arnie @ArnieSec]

@TopengaNFT please share your results with me if you do! Currently working on this on my free time so im limited on how much i can test and improve it.

[Arnie @ArnieSec]

https://t.co/S8jmcHmgq8

[Arnie @ArnieSec]

https://t.co/SmI8s8Gcyn

[Arnie @ArnieSec]

ROAD TO LSR: Week 6

As you may or may have noticed, this posts is the first in about 2 weeks. The reason for this was that i started to notice decreased work motivation from daily posts as i'd sometimes continue on X ,for sometimes long durations, even after i had made my post. I decided to take a small break from posting to recalibrate and come back disciplined.

However, the work stayed consistent. The past 2 weeks saw me finishing 2 audits. For each day of the week i also continued studying math and ai.

On my time away, i decided this series works best on bi-weekly or monthly scheduling as thats when milestones or achievements are likely to happen. My goal is to provide good insight or a fresh perspective while also providing informational content on here. Simple daily updates are not my style!

[Arnie @ArnieSec]

The arrogance I’m seeing on here is concerning. People are so excited to not pay for security.

You always pay for security, the question is whether you pay before or after deployment.

[Arnie @ArnieSec]

@0xSlowbug Marketers without actual skill is noise not signal. Anyone skilled/ experienced can easily distinguish them or they will stop getting jobs due to bad performance.

There is no alternative besides maybe bounties now.

[Arnie @ArnieSec]

Audit contests dying doesn’t mean new researchers won’t get onboarded.
It changes the selection pressure.

Contests were a clean signal amplifier, a structured scoreboard.
A technically strong individual could win once and instantly gain attention, status, and credibility.
One leaderboard result = hundreds of eyes.

That era is fading.

There’s no longer a public scoreboard doing the signaling for you.
Now you have to manufacture your own proof of skill.

The next wave of researchers won’t just be technical.
They’ll be self directed, disciplined, and capable of building their own visibility.

If you can’t create signal, the market won’t see you, no matter how skilled you are.

[Arnie @ArnieSec]

One thing I’ve noticed after 3 years of being a security researcher is how much the skill transfers into almost everything else.

Math feels more intuitive and easier to understand than it used to, and I was always good at it. The difference now is structural. I don’t approach problems the same way.

What changed isn’t just knowledge. My brain literally adapted.

Spending thousands of hours reasoning about attack surfaces, invariants, state transitions, and edge cases rewired how I process complexity. Neural pathways strengthened around abstraction, error detection, and multi layer simulation. Debugging contracts became debugging systems. Debugging systems became debugging life.

My thinking, and even what interests me, has shifted.

Learning security research pulled me toward understanding deeper systems.
How does the brain actually work?
Where are its vulnerabilities?
What are its cognitive exploits?
How can i use this to my advantage?

I started viewing biases like bugs, identity like architecture, philosophy like a framework for behavior under constraints.

The same skills used to find protocol weaknesses now help me analyze my own reactions, redesign habits, and respond more intentionally in high pressure situations.

This wasn’t a mindset shift, it was neuroplasticity.
The brain adapts to the problems it repeatedly solves. And security research trains you to think in systems, adversarially, and structurally. After enough time, that stops being something you do, It becomes how you think.

[Arnie @ArnieSec]

For a long time, contests sat at the top as the primary metric for gauging a researcher’s skill when deciding who to hire.

But contests are actually a poor predictor of ability for a large subset of security researchers.

Their structure favors a specific motivational profile, high tolerance for uncertainty, competitive reward chasing, and sustained effort under probabilistic payoff.

For many neurodivergent researchers, especially those with ADHD, this format is misaligned. Contests offer no guaranteed reward, no clear obligation, and no social accountability. If you don’t succeed, the only person affected is you. There’s no client waiting. No team relying on you. No defined finish line beyond “maybe you win.”

That incentive structure doesn’t measure depth of reasoning, systems thinking, or long horizon protocol modeling. It measures performance under competitive uncertainty.

I noticed this in myself. Contests never held my attention for long. I could tolerate very short ones, but the open ended, winner takes most format didn’t engage me. That didn’t reflect a lack of skill, it reflected a mismatch in motivational architecture.

The researchers who excel in structured audits, where there is responsibility, guaranteed reward, and real impact, are not always the same ones who dominate contest leaderboards.

If hiring decisions rely too heavily on contests, we risk selecting for a narrow cognitive profile and overlooking deeply capable researchers whose strengths show up in different environments.

[Arnie @ArnieSec]

ROAD TO LSR: Week 4

Again, the same objectives this week. I am reverting the format to 1 large single post on this per week as I don’t want to spam the feed with these posts too much.

I have been using AI and integrating heavily, I will make some posts about my process this week, that may be helpful for others who have not yet started integrating or are confused on how to start.

Objectives:
- audit work (>= 4 hours daily)
- AI study (>= 1 hour daily)
- Math study (>= 1 hour daily)

[Arnie @ArnieSec]

ROAD TO LSR: Week 3 Update

This week i continued an audit which is nearly complete, and also finished a diff audit. For the diff audit, i found 4/5 H/M issues found in total, with 3 unique. This means that without my work, the report would have been missing 3 important issues.

INSIGHT: When reviewing changes made to a codebase you recently audited, do not just review the changes. Going through the codebase even just once may yield new issues you have not thought of, or didn't have enough time to find in the first pass. It is impossible to find everything in an audit 100% of the time since an audit is time boxed, but the risk of missing something goes down drastically if you review again days later when you have had time to process the logic.

Objectives and week 4 post tomorrow.

[Arnie @ArnieSec]

If its not out of reach, then what is the point of all the AI products that firms are selling?

The next major upgrade to a frontier model would make them all obsolete, since me typing "find all draining bugs" would provide the same result as all the firms AI products.

If you think this is incorrect, this assumes that humans are adding something to the loop that the "superhuman" AI could not figure out or reason of. And if this is true then AI security is not superhuman.

[Hari @hrkrshnn]

@lonelysloth_sec Given a program: can an unprivileged actor steal money?

Why is that out of the reach of an AI if the same AI has superhuman ability to do math?

[Arnie @ArnieSec]

The most profound realization that changed my life was this:

You can just do things.

You can just start. You can just decide. You can wake up tomorrow and begin moving in a completely different direction. Most people live as if there’s some invisible authority that has to approve their ambition, as if mastery requires permission, It doesnt.

When I say believe, I don’t mean motivational quote belief. I mean the deep internal shift where you truly understand that almost everything you admire in other people was learned, built, and practiced.

There isn’t some hidden gate keeping you out, there’s only time, effort, and the willingness to try.

Once that clicks the world feels different. You stop asking “can I” and start asking “how long will it take”.

[Arnie @ArnieSec]

Many researchers, including myself, who discovered Ethereum and truly understood smart contracts had the same reaction. We felt that this was the most important thing we could possibly work on.

The realization that code could secure and move real value without intermediaries. Many knew instantly, this wasn’t a phase, It was their future.

[Arnie @ArnieSec]

Whether or not AI replaces auditors doesn’t matter. The truth is, AI is already augmenting auditors.

That’s why I see learning AI deeply as crucial for staying competent in security research going forward. You either adapt or fall behind. Someone who has a deep understanding of both security and AI will be in great demand.

If you’re serious about adapting, this is a solid place to start!
https://t.co/pEC4ccpIhF

[Arnie @ArnieSec]

@dayOneStudent Check my other reply to the tweet

[Arnie @ArnieSec]

ROAD TO LSR: Week 3

This week will be exactly the same as basically every past week. Mainly doing private audits and 1 hour of AI and math learning each daily. The first few weeks of this series may be uneventful, but thats the key to success. Boring repetitive work compounds over time.

Objectives:
- audit work (>= 4 hours daily)
- AI study (>= 1 hour daily)
- Math study (>= 1 hour daily)

[Arnie @ArnieSec]

@ParthMandale i am doing 1 hour of math academy, and andrew ng course for now. Math will probably be on math academy until i finish all foundations and math for machine learning etc. For ai i am following this, but wil also expand to other stuff i find interesting.
https://t.co/u0IpPo34MX