bock

Co-Founder @Fidesiumapp
Smart contract security researcher.
Audits, exploit analysis, and the future of autonomous protocol security.

[bock @bockus]

https://t.co/OdM44KgV61

[bock @bockus]

So proud of all the contributors. With enough voices maybe we can make London the heart of crypto

[Superteam UK @SuperteamUK]

The future of DeFi in the UK shouldn't be decided without the people building it.

Today, we submit our response to the FCA's perimeter consultation.

Backed by 20+ founders, all pushing for rules that can give DeFi a home here.

We fight for the progress we need. 🦾🇬🇧

[bock @bockus]

@SuperteamUK @unruggable_io @tokenGBP @formacity @AgantFinance @ZyntaFinance @Fidesiumapp @SimplicityWeb3 @reflectmoney @RuleSpark_com @Dominion_Market All government policy should be reviewed by those of us in the trenches. Great work everyone.

[bock @bockus]

Critical. 3 Highs. Caught.
On a 36k-line Rust protocol live on Solana.
Here's the four-pass framework that @Fidesiumapp used to find them.

[Fidesium @Fidesiumapp]

The team audited 36,000 lines of Rust on @AdrenaProtocol .
The findings weren't where most auditors look.
Here's the framework that surfaced them.

[bock @bockus]

Web3 security isn’t a one-time audit. It’s a brutal, ongoing grind where you must win every single time.

Just wrapped a deep audit on Adrena. A live on Solana perps DEX. 36k lines of Rust, 122 instructions, one Critical governance finding, and we shipped a full regression test suite with our custom fuzz harness so nothing slips later.

What’s your biggest security blind spot on Solana right now?

Defenders grind. Attackers get one lucky shot.
Full breakdown here:

[bock @bockus]

https://t.co/Oh2PAVVLQY

[bock @bockus]

https://t.co/Oh2PAVVLQY

[bock @bockus]

Web3 security hot take: Your biggest threat isn't some genius hacker. It's you treating security like a feature instead of oxygen.

[bock @bockus]

Web3 security isn't one thing, it's everything, all the time.

Smart contracts? Audited, recently?.
Supply chain? Still cooked by Trapdoor.
Bridge? Forged in 5 mins.
Admin keys? 3 of 5 is a minimum.
Opsec? Your dev just installed a new package.

Stop treating security like a checkbox. It's the whole damn game or you're just funding North Korea's next attack.

[bock @bockus]

@SpeeksX @SuperteamUK Great seeing you mate, and congrats on the new gig!!!!!!

[bock @bockus]

Chill day down at @SuperteamUK Buildstation. Here most Fridays if you or your team ever have any questions about security.

Central London #Londonmaxing

[bock @bockus]

Soooooo.... about the AI bubble.

[Polymarket @Polymarket]

NEW: AI consultant reveals a client accidentally spent $500,000,000.00 in a single month after failing to set employee limits on Claude usage.

[bock @bockus]

@dxsale
$7.3 million got drained from 1,400+ locked pools

Here’s how they did it:
1. contract ownership got transferred 269 days ago
2. deployed a drainer contract this morning
3. set lock fee to 1 wei
4. create a new lock on already-locked lp
5. backdated unlock times to 1970
6. looped withdraw() on 1,400+ legacy pools
7. swap to bnb, bridged out, mix with a mixer and gone

$7.3 million gone and the door is still open.

@dxsale has yet to respond

[bock @bockus]

@theguycrypto_ Thanks mate.

[bock @bockus]

https://t.co/OdM44KgV61

[bock @bockus]

Using the latest tools and agents to attack your own project is the the new necessary step in security.

You really want to do this before someone else does.

[bock @bockus]

https://t.co/OdM44KgV61

[bock @bockus]

In 2012 in a letter to investors @finkd formalized his famouse line - "Move fast and break things. Unless you are breaking stuff, you are not moving fast enough."

This is literally th eworst advice ever in Web3.

Teams ship fast, skip supply chain checks, then Trapdoor-style attacks wipe them out. One malicious dep and years of work and millions gone.

[bock @bockus]

Interested to see what this is. Looking forward boys.

[SHERLOCK @sherlockdefi]

A completely new security format is emerging.

One of the biggest protocols in Web3 is working with Sherlock to put it to the test.

June 15 to July 6.

More revealed tomorrow.

[bock @bockus]

-----> Massive supply chain attack live.

Trapdoor hit with 34 malicious packages and 384 versions across npm, PyPI, and Rust Crates. Fake dev tools for crypto, DeFi, AI, Solana.

Silent install - then - drain wallets, private keys, SSH, AWS creds, GitHub tokens.

Only two months to switch from focusing on OpSec to supply chain.

Always the next weakest target.

Check everything.

[bock @bockus]

@whatsallthiss Jesus Christ that is hideous.

[bock @bockus]

Attempted Hack Story Time:

Friend got hit by an injection into a valid Google Doc.

Attackers posing as friendlies sent a link to a Google Doc. All safe all fine.

Popup asked him to open his terminal..

Never enter anything a website asks you to enter into your terminal.