paulbramas.eth

Head of Ecosystem at @KYVEnetwork don't trust, verify & validate.

ex-@BinanceAngels

[paulbramas.eth @BramasPaul]

DeFi in 2026 isn't about luck anymore; it's about Risk-Adjusted Alpha.

I've mapped out the entire landscape. Dive into my latest blueprint featuring 100+ protocols👇

https://t.co/ED2jI9FlCu

The "Red Friday" crash was a wake-up call. We’ve moved from degenerate farming to the Agentic Economy, where high APYs must coexist with institutional-grade security.

If you aren't using a professional stack, you're either the exit liquidity or the next one that will be exploited.

[paulbramas.eth @BramasPaul]

https://t.co/AGxKXQwi7M

[paulbramas.eth @BramasPaul]

Part of the solution, if not the solution! Is implementing policies, timelocks, guards, token approvals, smart contract approvals, and transfer approvals. But this shouldn't rely on off-chain dependencies; it needs to be fully on-chain with sovereign deployment on the end-user side.

Why? To achieve maximum security. What if an employee at your service provider turns out to be a malicious actor? What if your data, or your strategies, get leaked or sold before deployment? And still the front-end is centralized so can simply be hacked. 💁‍♂️

Relying on APIs simply shifts the attack vector. API calls are not a secure way to handle on-chain interactions: the fewer off-chain components you have, the higher your on-chain security is. In fact, an API attack recently hit @swissborg's provider @Kiln_finance, resulting in a loss of over $40M:

Few builders are building fully on-chain lit products such as @z0r0zzz with the first decentralized exchange that runs 100% on chain

@heckerhut building Freedom a browser that makes it effortless to explore and deploy to the decentralized web without gateways.

MPCs aren't the answer to this either, and don't just take my word for it

[paulbramas.eth @BramasPaul]

Every two days, a hack happens in the Web3 space via UI spoofing, governance attacks, admin access, or compromised keys, @okcontract has built a map indexing all of them: https://t.co/6wUkm0UR8k from incidents, their paths, to the risk vectors that haven't led to attacks yet.

You can follow accounts like @CertiKAlert, @PeckShieldAlert, @glider_xyz, @DefimonAlerts to stay up to date. But what's missing is a map to visualize the patterns behind these attacks.

A common thread is that attack vectors are no longer at the smart contract level, they’ve moved a step above.

As @VitalikButerin said in his keynote at @EthCC 2025: your door is made of solid steel, but your walls are weak. You can have an amazingly formally verified contract, hire 10 auditors from 9 continents, and get formal verification from the remaining 5 continents... but the front end everyone uses can still be compromised by hacking the server. Basically, your front end is a house made of straw.

These types of attacks have happened more often than we think in recent years to @maplefinance, @Compound_xyz, @CoWSwap, @safe, @Polymarket, @BadgerDAO, and many others, totaling over $1.5B USD.

[paulbramas.eth @BramasPaul]

Wasn't there any issues with Zodiac Roles like two months ago?

https://t.co/J9LqOxXYtB

Also you can check this article about @safe policy engine where they explain what are some limitations of @zodiaceco (I don't agree tho with everything that is said in this article) https://t.co/IkCvo7CVtT

Mine isn't aware of all of this but apparently yours neither ;)

[Zodiac @zodiaceco]

Today we're publishing a full post-mortem of the security incident that affected the Zodiac Roles Modifier v2.1.0 and Delay Modifier v1.1.0 on June 1.

Here's what happened, how we responded, and what's changed.

The root cause: our modules' ERC-1271 contract-signature check accepted a signature based only on the returned magic value, without verifying the call itself had succeeded. A failed check could be made to look valid, bypassing module authentication.

It was only exploitable in one narrow configuration: a Safe using the CompatibilityFallbackHandler assigned to an affected module. EOA role members and setups without an affected module were never at risk.

On detection we privately contacted affected users, shipped a self-service checker and remediation app, disclosed publicly on June 2, and ran whitehat recovery. More than 99% of at-risk value was secured; confirmed realized loss outside Gnosis Pay was ~$4,500.

Today: contracts patched and independently audited, all Zodiac apps updated, service fully restored.

Full post-mortem: https://t.co/os5KlorMZu
Security reports: [email protected]

Thank you to the users, integrators, Gnosis, Safe, SEAL 911, and the independent researchers who helped us identify, contain, and remediate this issue.

[paulbramas.eth @BramasPaul]

@deepcryptodive @RockawayX @HypernativeLabs You have the same thing with @FordefiHQ but that just move the attack vector till people relay on off-chains for circuit breakers. Policies yes, but please on chain.

[paulbramas.eth @BramasPaul]

@DBCrypt0 It's not ... @hbbiok who is the former Chief Innovation Officer of Wallix (a web2 cybersecurity Euronext listed company) has built a map through his project @okcontract where he have indexed most risks vectors and attacks. Worth taking a look https://t.co/v3jbaJDqFJ

[paulbramas.eth @BramasPaul]

@0liver_G_ @exvulsec @ArrakisFinance Look at the number of vectors attack possibles ... https://t.co/v3jbaJDqFJ

[paulbramas.eth @BramasPaul]

@zklim5389 Off chain time locks are just moving the vector attack to another layer of the stack

[paulbramas.eth @BramasPaul]

@testmachine_ai For those who want to have more nightmares tonight you can check the map built by @okcontract they have put a lot of attacks that have happened + lot of risks vectors that haven't lead to attacks but could https://t.co/v3jbaJDqFJ

[paulbramas.eth @BramasPaul]

@ernestognw Don't want to make you even more tired but the team of @okcontract has built a map where you can see lot of attacks that have happened but also the risks that haven't been used for attacks https://t.co/v3jbaJDqFJ ...

[paulbramas.eth @BramasPaul]

There is so many extra layers to this, there is also the way curators deploy the strategies, the products they are using to put guardrails, roles, tokens autorisations, timelocks etc (all of them are using centralize providers for now) The UI they are using to interact with the protocols, @okcontract has mapped a tool where you can see all attacks vector + risks, worth imo taking a look and they are building a real cool product with self sovereignty at core. https://t.co/apRD4txfg6

[paulbramas.eth @BramasPaul]

@coinbureau @okcontract team has built a map that puts most of the attacks that have happened and most of the attack vectors its gonna be open source https://t.co/li3bVf4hRi.

[paulbramas.eth @BramasPaul]

@PeckShieldAlert @TheSandboxGame Almost not a day without a hack, @okcontract
team has built a map that puts most of the attacks that have happened and most of the attack vectors its gonna be open source https://t.co/v3jbaJDqFJ.

[paulbramas.eth @BramasPaul]

@catmcgee There is only true privacy product @DarkFiSquad

[paulbramas.eth @BramasPaul]

@WuBlockchain @okcontract team has built a map that puts most of the attacks that have happened and most of the attack vectors its gonna be open source https://t.co/v3jbaJDqFJ.

[paulbramas.eth @BramasPaul]

@LilianAliaga_

[paulbramas.eth @BramasPaul]

@TedPillows I have suffered more than 3 months can we still go up?

[paulbramas.eth @BramasPaul]

@oot2k1 Very good read @okcontract team has built a map that puts most of the attacks that have happened and most of the attack vectors its gonna be open source https://t.co/v3jbaJDqFJ I think it could be interesting for you.

[paulbramas.eth @BramasPaul]

@OW3NBTC You should add my DMs to your list 🤓👀

[paulbramas.eth @BramasPaul]

@sui414 Have you check those website ?

https://t.co/I6x6mmdLBA
https://t.co/NFmEo3Zgjy

https://t.co/zVJztBGJp7

Imo get deploying is the best