Martín Casais

Smart contract engineer. EVM & Solana. Stablecoin & payment infrastructure. Breaking DeFi in audit contests.

[Martín Casais @casaisdev]

Martín. Stablecoin and payment infra on EVM and Solana. I also break DeFi protocols in audits.

18 open-source protocols shipped. 23 findings with working PoCs on a private audit. 4 in contests this year, 3 High.

Site: https://t.co/5ApbRsJtSF
Labs: https://t.co/9qfTc7kNgD

[Martín Casais @casaisdev]

@alexkehr In smart contracts you ship once. No undo. Funny how much more thinking happens when the undo button is gone

[Martín Casais @casaisdev]

@IceSolst Smart contracts are the control group. No patches, no insurance, breach means the money's gone in one block. So everyone audits before shipping. Turns out it was incentives, not craft

[Martín Casais @casaisdev]

@mikashi One catch. There's no wrong passphrase. A typo opens a perfectly valid empty wallet. More people lose coins this way than to theft

[Martín Casais @casaisdev]

@VanessaGrellet_ Ring-fenced from the manager, sure. The custodian still holds the keys. Different wrapper, same last mile

[Martín Casais @casaisdev]

@adamshuaib Same five traits describe most founders who got indicted. You're selecting for variance. Works at 50 bets, not if you're the employee picking one

[Martín Casais @casaisdev]

Everyone's bragging about shipping 10x faster with agents.

In smart contracts nobody brags about that. The first deploy with real money is the only deploy. Fast just means you reach the bug sooner.

The whole move fast era was built on being able to fix it tomorrow. Some code never gets a tomorrow.

[Martín Casais @casaisdev]

@bull_bnb Open the contract. If the hard part is in the code it might be real. If the hard part is in the thread and the contract is just mint and transfer, that's your answer

[Martín Casais @casaisdev]

@KSimback Crypto had this already. Dead protocols with a live treasury. The asset outlived the product and insiders got it, not users. Same thing will happen with the data

[Martín Casais @casaisdev]

@nicbstme We tried that in 2017. Everyone wrote their own token contract. The fix was ERC-20, one standard, because a thousand custom versions of money is how money disappears

[Martín Casais @casaisdev]

@joshelman Slower at writing code, sure. In smart contracts the 3 year old codebase has something the new one can't buy: it's been live with real money and nobody drained it yet

[Martín Casais @casaisdev]

@michuk Fair. But the ones with real demand that paid for growth with token emissions died too. Aave and Uniswap charged fees from day one. That's the difference, not demand

[Martín Casais @casaisdev]

@akshaybd Ten small AI stocks that all live or die on the same thesis is still one bet. Now he's in it with worse liquidity and a nicer dashboard telling him he's diversified

[Martín Casais @casaisdev]

@signulll Most of those signatures are an accident. The security guys everyone in crypto knows by name just wrote up the same kind of hack for five years straight. Nobody picked a brand, the brand picked them

[Martín Casais @casaisdev]

@cz_binance Banks have weaker crypto and a phone number you can call. Phished wire gets clawed back, phished signature is gone before the page finishes loading. The math was never the weak part

[Martín Casais @casaisdev]

@wyckoffweb The web3 that's dying is the one that paid salaries out of a token. The teams getting paid by actual customers, mostly payments and stablecoins, are still hiring. Those just never had the dream part

[Martín Casais @casaisdev]

USDC is the biggest admin key in crypto and nobody audits it.

One address at Circle can freeze any wallet on earth. No proposal, no timelock, no multisig you can see. Tether has already done it for $2.5B+ and the number only goes up.

Meanwhile every protocol spends six figures auditing reentrancy and then parks $500M in a token the issuer can brick with one call.

We removed admin keys from contracts and put them in the money instead.

GENIUS didn't close the backdoor. It wrote it into law.

[Martín Casais @casaisdev]

@BalaiBB 2FA and key rotation do nothing against a bug that needs no login. PHP2Shell was one request. The fix is fewer things facing the internet, not better passwords

[Martín Casais @casaisdev]

@VraserX The part everyone skips is that improves itself still means a training run. Doesn't matter how smart the code gets, that step is months and a power plant. The loop has a very slow step in it

[Martín Casais @casaisdev]

@defyneric It flipped because the float changed hands. In 2022 you paid someone to convert your USDC. Now the card just keeps it, parks it in T-bills at 4% and hands you a cut back as cashback