cholakov

Expert Security Strategist @PashovAuditGrp

[cholakov @cholakovv]

🚀 This month I got 3 bug bounties paid out and built an open-source Claude Code skill along the way.

Finding the bug is the hard part, but what really determines the outcome is how well you demonstrate its impact.

That's where the PoC matters most: if it's not a mainnet-fork end-to-end test on real deployed contracts at the current mainnet state, it doesn't really prove impact.

I iterated a lot before figuring out what actually works. Now it's a skill anyone can install.

Free & fully open source 👇
https://t.co/NOest7Wlrf

[0xfirefist @0xFireFist]

Security should be accessible to every team.

The repo below has:

→ An AI security auditor

→ A smart contract fuzzer

→ A codebase scanner for threat models, invariants, entry points, and more

Free and open source. What are you waiting for?👨‍🏭

https://t.co/We8X9B5OZg

[Pyro @0x3b33]

The best AI audit tools I've used 🧵

> All free
> All on GitHub
All built by actual auditors
(4 of them Bulgarian, we are so back)

Save this one 👇

1⃣ Pashov skills by @pashovkrum

Fast, cheap and efficient. 2 skills:

📌solidity-auditor - security feedback on your changes in under 5 min
📌x-ray - pre-audit scan that builds a threat model, invariants and entry points

https://t.co/ApP5GbKx40

2⃣ Claudit by @MartinMarchev

Find bugs on solodit without the manual searching.

It's an MCP that plugs Solodit's 20,000+ findings straight into Claude. You describe the bug you are looking for and it pulls the exact reports.

https://t.co/KE21OJyuWO

3⃣ Plamen by @p_tsanev

Costs a lot, but it's really good.A fully autonomous audit agent that runs 20-100 agents and only reports bugs with a verified PoC.

A thorough run is $30-100+ but it fuzzes invariants and has a judge to kills false positives.

Supports EVM, Solana, Move and L1s
https://t.co/kQg1abB1MR

4⃣ foundry-poc-mainnet-fork by @cholakovvv

Turns your finding into a submission-ready Foundry PoC on a mainnet fork.

Real deployed addresses, no mocks, no https://t.co/82cw9FTuyC cheats.

https://t.co/wiop8Ymfmv

5⃣ sc-auditor by @archethect

Map, Hunt, Attack. 6 specialized agents hunt in parallel (reentrancy, accounting, oracle, economic...) then every finding goes through a Devil's Advocate that tries to kill it.

https://t.co/2zCjAiLdeZ

6⃣ Nemesis by @0xiehnnkta

2 agents in a loop: a Feynman auditor that questions WHY every line exists, and a state auditor that hunts for coupled state that updates on one side only.

Each pass feeds the next until nothing new surfaces.

This is the closest to how a human actually audits.

https://t.co/cpuTn9vAal

---

That's the stack.

Missing an invariants tool tho... if you know a good one drop it below 👇

[cholakov @cholakovv]

@VittoStack hey Vitto, would love to join

[cholakov @cholakovv]

@VittoStack can you add me?🫡

[cholakov @cholakovv]

@shealtielanzz hey @shealtielanzz , can you check DM?

[cholakov @cholakovv]

@kenzowhitehat @ShredSecurity that’s some great news!! I sent you a DM

[cholakov @cholakovv]

@asen_sec @xyz_remedy 🔥🔥🔥

[cholakov @cholakovv]

Another confirmed finding on @xyz_remedy . Stack keeps growing🚀
https://t.co/VFzvcslKv1

[cholakov @cholakovv]

AI is quickly becoming essential for serious Web3 security work.

Most teams are still relying on generic LLM scans that produce more noise than signal.

@MartinMarchev maintains a clean, focused list of the tools, frameworks, and techniques that actually deliver results in this space.

Worth checking if you want to crush it on your next audit👇

[cholakov @cholakovv]

@pashov Haha, the boss being the boss

[cholakov @cholakovv]

AI is quickly becoming essential for serious Web3 security work.

Most teams are still relying on generic LLM scans that produce more noise than signal.

@MartinMarchev maintains a clean, focused list of the tools, frameworks, and techniques that actually deliver results in this space.

Worth checking if you want to crush it on your next audit👇

[cholakov @cholakovv]

https://t.co/HuhXV8OlPb

[cholakov @cholakovv]

@pashov 👀

[cholakov @cholakovv]

@lonelysloth_sec @pashov Haha, fair. To be clear though, x-ray isn't a bug-finder, it maps the codebase: invariants, threat model, architecture. Just less time burned on the kickoff phase.

[cholakov @cholakovv]

@pashov @0xFireFist Absolutely, @0xFireFist is a beast🔥

[cholakov @cholakovv]

Used @pashov's x-ray skill on day 1 of an audit (~8K nSLOC) and it saved me a solid half-day.

The kickoff work I usually do by hand on day one:

- Threat model
- Architecture diagram
- Subsystem breakdown
- Invariant catalog

x-ray produced all of it in one run, with derivations for each inferred invariant. That last part is what I'll keep coming back to. It surfaces invariants the protocol assumes but doesn't actually enforce in code, with citations to where each one breaks.

Hit a couple of tooling glitches on macOS (BSD vs GNU grep flag in enumerate.[sh], forge coverage didn't finish in time) but nothing breaking.

Will be running it on every audit going forward. Nice work @0xfirefist.

[cholakov @cholakovv]

@0xFireFist @pashov 🔥

[cholakov @cholakovv]

https://t.co/KIEvF6KwMB