Blackscale

⚓ solidity super c̶o̶d̶e̶r̶ auditor

[Jeff Security @jeffsecurity]

Reproduce ZKP vulnerabilities. This repo includes 89 vulnerabilities in the following DSLs:

I’d appreciate a retweet, spread the knowledge 🫡

https://t.co/ZpG3py479h

[Klaas @forgebitz]

lots of vibe coders are going to learn the difference between authentication and authorization

it's not a fun thing to learn the hard way

[Hari @hrkrshnn]

PSA: Please don't fork Aave's codebase and launch it on a new chain. You are very likely to get hacked if you do.

It can look very tempting: there's a new chain, and you see that no lending market is available. Fork Aave, onboard all the top assets, set whatever risk parameters you want, launch a governance token, profit $$$.

However, building a lending market is hard. Forking and working with Aave's codebase is even harder if you don't have the right experience. Teams vastly underestimate the complexity of maintaining and securing a lending protocol.

I'm pretty confident there are blackhats specifically targeting Aave forks. Don't get rekt 🫡

[0xSmartContractSamurai ⚔️ @0xSCSamurai]

Web3Sec is tough as FCUK.

Most beginners quit.
90%-99% joining every year, QUIT.

Remind yourself of this fact whenever necessary.
And then, double down and grind on.

Bugs dont find themselves...

This is *not* an April Fool's joke.

👊

[0xbow.io @0xbowio]

gm Ethereum ☀️

It is our great honor to announce the mainnet launch of Privacy Pools!

ETH users can now achieve on-chain privacy, while still dissociating from illicit funds

It is now up to all of us to Make Privacy Normal Again 🫡

More info in this thread 👇

[Luca Beurer-Kellner @lbeurerkellner]

👿 MCP is all fun, until you add this one malicious MCP server and forget about it.

We have discovered a critical flaw in the widely-used Model Context Protocol (MCP) that enables a new form of LLM attack we term 'Tool Poisoning'.

Leaks SSH key, API keys, etc.

Details below 👇

[Hardhat @HardhatHQ]

Hardhat 3 adds stack traces to your Solidity tests experience, and the paths are clickable! ✌️👷

Check out the alpha release https://t.co/TkXQrbvYPs

[Bloqarl | Zealynx @TheBlockChainer]

You don’t need to be a genius to be a great security researcher. You need a sharp eye, relentless curiosity, and the patience to dig deeper than others.

[Martin Marchev @MartinMarchev]

Lots of bugs in smart contracts don’t come from complex math. They come from confusion.

Confusion starts with poor naming.

Clear naming = easier audits, fewer bugs and faster dev speed.

‘Meaningful names’ is the first chapter in Uncle Bob’s classic Clean Code for a reason.

[Georgios Konstantopoulos @gakonst]

I'm looking for an API that I can call `/onramp?address=0x1234&chain=1&applePayPaymentInfo=...`. User Pays Apple Pay, gets paid stablecoin. Headless, no KYC for <$500 lifetime value of the user. Acceptance rate >60-70% (hard with crypto :/). Who's building this?

[Tay 💖 @tayvano_]

🚨 There are some crazy threat actors lurking among us

This guy “Nick” has a year+ persona, is hanging out in the infamous ethsec tg, and has multiple long-running dms open with multiple (legit) security researchers.

If you opened his “PDF” pls turn off your computer NOW.

[tanuki42 @tanuki42_]

Meet Nick Franklin @0xNickLFranklin - Blockchain Security Engineer…. or RGB operative hacking for DPRK? Seemingly this guy has had the entire industry fooled for years.

[0xFrankCastle🦀 @0xcastle_chain]

For those asking which protocol to shadow audit or if they can practice on a previous codebase I’ve audited, you should focus on the highest-quality codebases to understand what secure code looks like. 🫡
Native Rust 🦀:
https://t.co/e6TaMhwZpj
Anchor⚓️:
https://t.co/BPmlJuYHAs

[ₕₐₘₚₜₒₙ @hamptonism]

I’m addicted to learning because the right information can change your life.

[0xaudron @0xaudron]

Auditing Perpetuals ? Checkout this reports
- https://t.co/ykA7mUNMsO
- https://t.co/WdQzC9eMKN
- https://t.co/5hdnGK7i6X
- https://t.co/7Mzcf1aZdX
- https://t.co/FrhSquYD1B

[Jyte_web3 (❖,❖) @JyteTechNft]

If you're a Solidity dev looking to level up
(and not get roasted in audit reports 😅),
take 10 minutes to read through this.

You will be glad you did! 🤝

-- https://t.co/Fptvrldxj5
--@RareSkills_io

[Hardhat @HardhatHQ]

Tests written in Solidity alongside good ol’ Solidity stack traces 👷‍♂️

Check out the Hardhat 3 alpha https://t.co/TkXQrbvYPs

[zack @zack_overflow]

I made a regex visualizer/debugger which lets you visually understand the finite state machine representation of a regular expression

And added gratuitous explosions and particle effects of course

Made with Zig + sokol

[Jeff Security @jeffsecurity]

Cross-chain reentrancy with example: https://t.co/g90JgbYPDc

[FFmpeg @FFmpeg]

FFmpeg makes extensive use of hand-written assembly code for huge (10-50x) speed increases and so we are providing assembly lessons to teach a new generation of assembly language programmers.

Learn more here:
https://t.co/u6MKBb3Xbk