Martín Casais

Smart contract engineer. EVM & Solana. Stablecoin & payment infrastructure. Breaking DeFi in audit contests.

[Martín Casais @casaisdev]

Martín. Stablecoin and payment infra on EVM and Solana. I also break DeFi protocols in audits.

18 open-source protocols shipped. 23 findings with working PoCs on a private audit. 4 in contests this year, 3 High.

Site: https://t.co/5ApbRsJtSF
Labs: https://t.co/9qfTc7kNgD

[Martín Casais @casaisdev]

@devanshmehta It can't, it just sees an address. The facilitator already rejects on that one: from_address_kyt.

[Martín Casais @casaisdev]

@0xcastle_chain Their issue 1065: settle fails gas estimation, files it as invalid_payload. Same request, fresh nonce.

[Martín Casais @casaisdev]

@hildobby @RobinhoodCrypto One blob fee market. Past the target, Robinhood's 40% is Base's gas bill too.

[Martín Casais @casaisdev]

Every senior dev who reviewed my screenshots signed off on a broken picture. There was one senior dev. It was me.

Context: I built a tool that watches the Ethereum mempool and flags txs that reach a block without ever being announced. Roughly half of every block. 399 tests, all green, eyeballed every morning for weeks.

The number was right. The picture was fake.

Never-announced marks got firstSeen = NaN. No sighting, no time, obvious. What I didn't know: canvas takes NaN as alpha and quietly keeps the previous alpha. Previous alpha was fine. So every private tx drew at full brightness, every day, and every screenshot looked exactly like a correct one. Wrong in the convenient direction, which is the only direction a bug survives in.

No test failed. Nothing failed. I only found it because I got paranoid and measured the fade pixel by pixel along one scanline instead of looking.

So I went after the suite. Flipped a derivative sign in the easing solver on purpose. Green. Swapped its coefficients. Green. Reversed the entire Newton step. Green. A bisection fallback had been silently repairing everything I broke, 30 extra evals a call. I'd shipped a test suite that could not fail and called it coverage in public.

19 bugs like this. All of them passed CI. All of them passed review. All of them looked fine.

Here's the part that gets people mad: coverage tells you which lines your tests touched. It says nothing about whether they'd notice if those lines were wrong. If you've never broken your own code on purpose and watched the suite stay green, you don't know which number you have. Most teams don't.

All 19, what the screen showed and how each was caught:
https://t.co/Sqf3V18wCM

[Martín Casais @casaisdev]

Firedancer tile share, straight off the GUI. Pack is the one sweating, 30 to 40% of core work, and exec only climbs when pack lets go. Funny detail for me: resolv, the tile that expands lookup tables, is flat near zero. I ship v0 txs with ALTs and always assumed that step cost something.

[Martín Casais @casaisdev]

What you're describing already exists, it's the SEAL Safe Harbor. Protocol publishes scope and bounty terms, puts them in the ToS, and adoption is an onchain tx to a registry contract. Uniswap and Aave are in. The 15% haggle after the fact is what you get from protocols that never signed it. All my Highs went through contests with the payout table up before I opened the repo, same principle.

[Martín Casais @casaisdev]

@402Signal Server hint defaults to 10x amount, client clamps at 5x its own cap. Switch spendControls off and there is no clamp, just time-locked escrow. Kept the default in mine, so $5 max lock.

[Martín Casais @casaisdev]

@ScofieldOnchain What does the liquidation bot do at 4:01pm when the stock feed stops moving? Ran into that building a CDP.

[Martín Casais @casaisdev]

@EthanDeFi_ Fair, they usually do. Just worth knowing that's a DAO vote each time, not a rate. Different kind of risk.

[Martín Casais @casaisdev]

@definikos Opened a bunch of these lately. Under the 4626 skin it's one curator key and a timelock, every time.

[Martín Casais @casaisdev]

@ox_shaman My 4337 wallet already pays gas through a paymaster. The ETH still gets bought, just not by the user.

[Martín Casais @casaisdev]

@andyyy Onchain that's a role on the token, the one with the allowlist and the freeze. Whole market, one key.

[Martín Casais @casaisdev]

@vanishree_rao Depends what a market is. A deploy per market never gets cheap. A row in one contract's storage already is.

[Martín Casais @casaisdev]

I spent this spring writing exactly that kind of automation. Legal and admin workflows, small team, real deploys.

Not one person in that office was working on replacing me. Everyone else was learning to use what I shipped.

[Martín Casais @casaisdev]

Does AI replace programmers, or do programmers end up replacing everyone else?

[Martín Casais @casaisdev]

@defyneric Did the payroll one, batch payouts on Solana. Permissions is the one I still have nothing good for.

[Martín Casais @casaisdev]

@singularityhack Three cents would be a big ticket right now. Tracker has this month's average at one cent.

[Martín Casais @casaisdev]

@sadbryce Run one. Permissionless until you want to be found. Bazaar lists you once Coinbase has settled for you.