Auron

Founder @ShieldaraSec | Helping Web3 projects stay secure with smart contract audits. DM before you deploy

[Auron @auronxyzeth]

the people who stay in web3 security arent the smartest. theyre the ones who dont quit when they feel stupid.

i see this every week.

"3 months in. tested everything. one duplicate report. 10 hours a day. feel like im doing something wrong."

the internet shows you bounties and hall of fame names. it doesnt show the rejected reports. the false positives. the weekends spent reading codebases that lead nowhere. the nights staring at functions you dont understand.

even top researchers feel like beginners regularly. feeling lost is normal. its evidence youre learning something valuable.

one researcher took 50 hours to find their first open redirect. another went months between findings. the difference wasnt talent. it was staying in the discomfort of not knowing.

security research is the art of being wrong until youre finally right.

i audit web3 protocols now. i remember what it felt like to stare at a screen with nothing to show for it.

if youre in that place, keep going. most people quit right before they find something.

follow if that hits

[Auron @auronxyzeth]

scanners can show you the line but never the mechanism. fork the repo, write the exploit, and run it against the fixed commit, because the gap between your code and the published fix is the whole lesson

[Shieldara Security @shieldarasec]

How can you copy and paste a crypto address, and still send your money to a stranger? It is a real trick, it is called address poisoning, and it works without hacking anything. Here is the mechanism, step by step.

First, the basics. A crypto address is like an account number. It is a long string of letters and numbers, for example starting with 0x on Ethereum. Wallets usually show it shortened, like 0x4f2a...9c1d, so you only see the first and last few characters.

Here is how the trick works.

1. The scammer watches the public blockchain, where every transfer is visible to anyone. They see that your address has sent money to a certain address.
2. They generate a new address that begins and ends with the same few characters as the real one. The middle is different.
3. They send you a tiny or zero-value transfer from that lookalike address. Now it sits in your transaction history, right next to the real one.
4. Later you want to pay the same person again. You open your history, copy what looks like the right address, and send.

Nothing was hacked. You just copied the wrong line. Crypto transfers cannot be reversed, so there is no undo button.

The habit that stops it: never copy an address from your transaction history. Get it from the source you trust, such as the person's own message, and compare the whole address, not just the start and end

[Auron @auronxyzeth]

@neuep2 stop joking, the EU would actually try to tax our bags

[Auron @auronxyzeth]

@mkXploit It's like anybody can just pay eight bucks and look legit online...

[Auron @auronxyzeth]

@W3B_AI_SR Burning SOL just to submit a bug report is kinda wild tbh

[Auron @auronxyzeth]

honestly, if a protocol's multisig is 3 coworkers in the same timezone, i don't understand how that counts as decentralized security

a key held by friends is one key with extra steps

this year the money left through keys. the contracts behaved 🫡

[Auron @auronxyzeth]

Centralized exchanges have a massive safety net: corporate treasuries, insurance funds, and the power to freeze stolen assets instantly. If you're risking your capital in DeFi protocols without asking who pays the bill when things break, you are the exit liquidity

[Shieldara Security @shieldarasec]

Binance could make users whole because it has a balance sheet. Code doesn't have one.

Binance says it covered about 95% of a $6.3 billion loss from its own funds: its SAFU reserve, a futures insurance fund and its corporate treasury. Tether and Circle froze more than $2.3 billion of assets tied to the incident.

That's what a company can do after a hack: pay from a balance sheet, and lean on issuers who can freeze funds.

Now ask the same questions about the DeFi protocols you use:

1. Is there a balance sheet, an insurance fund or a freeze switch behind it?
2. If not, what stops a bad change or a stolen key before it happens?
3. Can you check that yourself, in public?

Number 3 is the one you can answer today. Example: Compound's USDC market on Ethereum has had its code swapped 60 times since 2022. The admin contract that can approve a swap is owned by a timelock with a 48 hour delay, and the timelock answers to Compound's governance contract. Anyone can check it on Etherscan.

Reply with a protocol and we'll look up who can upgrade it, and post what we find

[Auron @auronxyzeth]

99% of first year researchers quit right before the pattern library kicks in

months 1-3 you find nothing
months 4-6 you find duplicates
month 7+ you start seeing the same mistakes everywhere

if you're in the finding-nothing phase, you're right on schedule🫡

[Auron @auronxyzeth]

@Asifali97568429 Live

[Auron @auronxyzeth]

@TozartWeb3 @quantarcai Great opportunity

[Auron @auronxyzeth]

@Linhphuong111 @agentdojo If AI takes gaming... What is left for us😅

[Auron @auronxyzeth]

@reidsailor Good morning

[Auron @auronxyzeth]

@thedhanyosmi Of course! Events are much more valuable

[Auron @auronxyzeth]

Struggling to level up as a security researcher?

You've probably tried it all:

- more bounty platforms
- more ctf writeups
- more tool tutorials

The gap isn't tools, it's depth and while most learn to find bugs, few learn to read bytecode like prose

Depth is the whole game...

[Auron @auronxyzeth]

@snufflesrea Congratulations!

[Auron @auronxyzeth]

@0xbaoanh 🚀

[Auron @auronxyzeth]

@JB_Xponential Good morning 🌞

[Auron @auronxyzeth]

The recent $6.3B Binance hack exploiting EIP-7702 proves that auditing persistent contract delegations is now just as critical as protecting private keys...

Check this out:

[Shieldara Security @shieldarasec]

What is EIP-7702, and why is it in the Binance hack story?

Binance says the attackers bypassed its normal approval controls. About $6.3 billion moved anyway.

Here's what has been reported so far:

- Binance said it was dealing with a "complex attack" affecting around $6.3 billion. Early reports said $5.8 billion.
- Co-CEO Richard Teng said the attackers used EIP-7702 to gain on-chain execution authority over a hot wallet, bypassing Binance's normal approval controls.
- He said multiple people were involved, and that the attackers built self-destruct mechanisms that erased their tools and traces.
- Tether froze more than $1.5 billion in USDT and Circle more than $800 million in USDC tied to the incident.
- The FBI has tied the attack to North Korea's TraderTraitor group. Binance says it covered about 95% of the loss from its own funds and has started resuming withdrawals.

EIP-7702 is an Ethereum feature that lets an ordinary wallet hand its actions over to smart contract code. It's useful. It also means the rules about who can trigger those actions matter a lot.

The full technical root cause isn't public yet, and anyone claiming certainty this early is guessing. But the question it raises is already clear:

An approval control only works if nobody can route around it.

So for anything that holds your money, exchange or DeFi, ask three things:

1. Who can move it, or change the code that holds it?
2. What approval or delay has to happen first?
3. Can you check that yourself, in public?

On-chain, you often can. Example: Compound's USDC market on Ethereum. Its upgrade admin is owned by a timelock with a 48 hour delay, and the timelock answers to Compound's governance contract. Anyone can verify that on Etherscan. It doesn't make anything unbreakable. It makes the rule readable.

At Shieldara we audit smart contracts. If you're building something that holds other people's money and want a second pair of eyes before you ship, our DMs are open

[Auron @auronxyzeth]

Audited and safe are two different statements

I wrote up how to check who can still change the code holding your money, using a real protocol

[Auron @auronxyzeth]

@itsabinashb Agreed!