c3phas

Security Researcher

[c3phas @c3ph_]

@ShieldifySec @Crushxyz 🔥

[c3phas @c3ph_]

@0xSmartContract @code4rena it was a great ride

[c3phas @c3ph_]

@0xcastle_chain 0xFrankCastle

[TrustSec @TrustSecAudits]

‼️ MAJOR ANNOUNCEMENT

TLDR:

- Trust Security is now TrustSec. New name, new logo, new website.
- We’re setting industry standards on how security teams communicate their work. Our entire portfolio is now on open display - every audit, bounty, contest win. Full transparency, zero gatekeeping.
- Going further, we present every competitor audit ran in parallel to us, on same commit. No cherry picking. It’s a pure measure of skill, and the results are conclusive.
- Same team, same standard, same depth. The quality never changed. Now the visibility catches up. Everything's in place to hit entirely new ceilings.

Full breakdown below ⤵️

[PraneshASP @0xasp_]

Announcing the Solidity Testing Handbook ✨

Fully free, one-stop resource for Solidity developers and security researchers.

Resources are currently scattered across blogs, docs, and forums. I found it difficult to keep track of everything in one place.

This handbook aggregates all testing patterns from basic unit tests to advanced mutation tests into a single, well-organized guide for quick reference.

It’s built from my own learnings and best practices observed in popular codebases.

https://t.co/02LS4uLFUM

[c3phas @c3ph_]

@0xriptide Not same guy, Nagli is a very good web2 hacker(million $ + earned)

[c3phas @c3ph_]

@arsen_bt Defendor

[VulSight @VulsightSec]

https://t.co/13fO4xVpzJ

[c3phas @c3ph_]

@shealtielanzz @sigp_io @andyfeili @kirkthebaird Congrats mate

[c3phas @c3ph_]

We are cooking

[HackenProof @HackenProof]

🏆 HackenProof Weekly Leaderboard

1️⃣ @alexbabits
2️⃣ @c3ph_
3️⃣ @j4ycked

Congrats and thanks for your contributions — the leaderboard is yours this week!

P.S. Special shoutout to @alexbabits — holding strong on the leaderboard week after week 🔥👏

[misbahu @bichistriver]

most people don’t fail to learn web 3 security. They fail to decide.

1) dude, make working 2-4 hours rational, not romantic.

Love of the stuff gets you started; logic keeps you in the game. Pick one thing, (e.g Solana and Rust, solidity + EVM) and one outcome (find 1 real bug in a public repo). stop everything else. I did that 1 year ago.

2) failing is part of our job.
“No idea” “no time” “No money” “No mentor,” “No confidence.” cool. AnticiPate it, plan around it, keep moving.

3) kill the five excuses
Time: You don’t need more hours; you need fewer distractions. Do 60 minutes/day, timer on, phone in another room. grow from there.

money: Free repos, free write-ups, free CTFs exist. Pay later if you want speed; start now regardless. Check Solodit, Rareskills, Cyfrin Updraft.... etc

Fit: “I’m not technical enough.” You will be technical, bro, after 20 focused sessions. Not before. dig deep first.

Authority: Stop asking the timeline for permission. Ask for feedback after you ship a PoC.

Avoidance: “I’ll think about it.” No. Decide: 30-day sprint, or don’t do it at all.

4) learn like a small boy
every bug starts as a dumb question: “What happens if this state flips between calls?” Keep asking until the code taps out.

5) record everything.
screen-record audits. Hot streaks have patterns (where you paused, what you probed). Rewatch your hot tape. iterate. May be write in a book or a journal on the wall.

6) build the trust bridge (with yourself)
Do you believe this process will make you better?

Do you trust your plan enough to execute it for 30 days?
Do you believe it will work for you, not just for “smart people”?
If any answer is “no,” fix that first; tools won’t save your doubt

why do you want to be a security researcher? will you make more money to buy your mum her house? do you want to marry? do you want to own your car? whatever..

7. direction > perfection.
Your first wins are tiny: a failing test, a weird invariant, a reproducible edge case. stack them. Directionally right beats eternally waiting for “the perfect course.”

8) New identity, new priorities.
You’re the kind of person who reads code daily, writes tests, and proves claims. Spend time/money accordingly. If it doesn’t move you toward “find 1 bug,” cut it.

9) Mini-playbook (30 days):

Days 1-3, Environment + repo anatomy. Read one protocol end-to-end; map state variabless & trust boundaries.

Days 4-10: Attack surface: auth, price oracles, reentrancy, rounding, share accounting, upgrade hooks. Write one failing test per vector.

Days 11-20: Deep study 1 module. threat-model it. Try to break invariants. Document every failed attempt (gold for future you).

Days 21-27: Pick one credible vulnerability pattern; hunt it across two more repos.

Days 28–30: Package findings: minimal PoC, impact, fix suggestion, reproducibility. Publish or submit where appropriate.

10) Commit line (copy-paste this somewhere visible):

“Indecision is a decision. I’m choosing progress for 30 days. One hour. Every day. No Excuses.”

Just do the work and post your learnings. If it helps, you’ll know, because your code will start bleeding less. If you have any question my dm is open.

[SHERLOCK @sherlockdefi]

🏆 @neutrl Audit Contest Results 🏆

Congrats to:

$118,000 rewards ➡️ $16.4M+ paid out in rewards.

[HackenProof @HackenProof]

The @OpenEden_X crowdsourced audit is complete!

✅ 186 reports submitted
✅ 6 valid findings accepted
✅ $5,000 in rewards allocated

Congratulations to all researchers — and special kudos to top hackers like @0xTonraq and @nem0thefinder.

[c3phas @c3ph_]

@shealtielanzz @sigp_io @andyfeili Congratulations mate

[c3phas @c3ph_]

@shafu0x Does building my life count

[c3phas @c3ph_]

@BowTiedDravee @nisedo_ @WhiteHatMage Rest assured I read them even if no one else does :)

[c3phas @c3ph_]

@shealtielanzz @0xMackenzieM @lonelysloth_sec Now you get it

[c3phas @c3ph_]

@0xOwenThurm @GuardianAudits dm'ed

[gkrastenov @gkrastenov]

🧵For 2 years (2023-2025), @ether_fi conducted 18 audits

More than 25+ High vulnerabilities were found.

Here is a short, simple explanation of the 16 most important findings.

🔖Bookmark this thread or read it now👇

[c3phas @c3ph_]

@MVadivalan More learning happens on that application part