cvh

build, secure & automate workflows | Security @0xPolygonLabs | Re/Tweets are my own | 🇦🇷

[cvh @cvhessert]

Security shouldn't be hard nor expensive, you just need to know what's important...

Hopefully this helps prevent future loses in this ecosystem in some way...

https://t.co/eL2WlgkUkS

[Sandeep | CEO, Polygon Foundation (※,※) @sandeepnailwal]

Everyday things about money that nobody can actually explain to you:

- why a cross border payment takes 3 days when the email confirming it lands in 3 seconds
- why sending money to your home country costs you 6%
- why a transfer you send on saturday doesnt move till monday
- why you need permission to move money thats already yours

we just grew thinking thats just how money works. its not, its just old plumbing thats finally being replaced by stablecoins

[cvh @cvhessert]

@QED_Audit Well said!
https://t.co/7rVerNGnsK

[cvh @cvhessert]

A “whitehat” who turns blackhat because the bounty wasn’t big enough was never a whitehat to begin with

Real whitehats are driven by ethics and a sense of integrity

[cvh @cvhessert]

A “whitehat” who turns blackhat because the bounty wasn’t big enough was never a whitehat to begin with

Real whitehats are driven by ethics and a sense of integrity

[cvh @cvhessert]

Play the game: What if someone gets unauthorized access to my Google/Insta/Apple? Can the steal my money/identity/pictures…

[Pablo Sabbatella @PabloSabbatella]

Your threat model should assume at least one of your accounts (Gmail, Apple ID, Password manager, 2FA app, Telegram, Signal, etc) are gonna be compromised eventually without your intervention.

[cvh @cvhessert]

$840M in DeFi losses in 2026. May: 14 incidents.

CT will say "we need more audits"

The pattern says something else: cross-chain bridge configs. Smart contract upgrades. Deployer key opsec.

None of that is in scope in a standard smart contract audit. None of it.

The architecture keeps failing in the same places while the industry keeps looking at the wrong thing.

[cvh @cvhessert]

Deployer key compromised. Again. $91K this time, could've been $91M. The contract was fine. The opsec wasn't...

[The Defiant @DefiantNews]

🚨 NEW DEFI HACK:

A hacker minted 5.4 TRILLION tokens on @StakeDAOHQ — backed by nothing — then cashed out $91K in ETH and walked away.

The weapon: a stolen private key and a forged @LayerZero_Core message.

Read more here:
https://t.co/yqSAYxXzHk

[cvh @cvhessert]

@Conste11ation Stopping the injection is necessary, but sufficient. The agent already has production credentials by design and as much as you try, it will continue happening.
The real control is what it can reach at all, least privilege per tool, per API scope, not just per request.

[cvh @cvhessert]

Right in line with Claude Opus 4.8 launch... Coincidence? Never

[SHERLOCK @sherlockdefi]

Applications are now open for the Sherlock x @0xPolygon Heimdall v2 security engagement.

Individual security researchers and teams building AI auditors / agents are welcome to apply.

Accepted applicants will receive next steps by email - Kicks off June 15.

Apply here 👇 https://t.co/jOQOZv9I0j

[SHERLOCK @sherlockdefi]

Applications are now open for the Sherlock x @0xPolygon Heimdall v2 security engagement.

Individual security researchers and teams building AI auditors / agents are welcome to apply.

Accepted applicants will receive next steps by email - Kicks off June 15.

Apply here 👇 https://t.co/jOQOZv9I0j

[cvh @cvhessert]

https://t.co/TCGYCr30Uz just formalized what anyone building agents has known: you can't fully block prompt injection without also blocking legitimate behavior. It's not a mitigation gap, it's a constraint.

The question is blast radius: what can a compromised agent actually do, and can you contain it? Focus here!

[cvh @cvhessert]

The bottleneck in bug bounty has never been finding bugs. It's always been triage, verifying something is actually exploitable. Sounds familiar? Explanation incoming…

Great work by @aviggiano btw

[Antonio Viggiano @aviggiano]

My first blog post for @monad's security team is out.

We spent a month building an AI system to hunt vulnerabilities in the Monad blockchain

here's what we learned

[SHERLOCK @sherlockdefi]

The next era of Web3 infrastructure deserves a brand new type of security review.

For @0xPolygon's Heimdall v2 upgrade, Sherlock is bringing that model to life.

June 15 to July 6.

[cvh @cvhessert]

@ElliotSecOps @immunefi The format problem is a symptom. The real issue is that triage was designed for human-scale submission rates. Programs that don't automate triage first are going to collapse under volume regardless of style policies.

[cvh @cvhessert]

@gakonst @paradigm @tempo Any plans to add Socket mode for Slack? It will increase speed and also security by not having a open endpoint needed

[cvh @cvhessert]

👀

[SHERLOCK @sherlockdefi]

A completely new security format is emerging.

One of the biggest protocols in Web3 is working with Sherlock to put it to the test.

June 15 to July 6.

More revealed tomorrow.

[cvh @cvhessert]

Security vendors emailing security@ just to get the attention of security folks is an auto-reject for me. Does this strategy actually work?

Its intent is for emergencies and serious security issues, not cold outbound.

I should probably start calling this behavior out publicly and even maintain a shared blacklist of vendors doing it.

[cvh @cvhessert]

@m4rio_eth Wonder what EDR where they running…

[cvh @cvhessert]

💯

[cvh @cvhessert]

@PabloSabbatella Assume everything is compromised/ malicious, and start mitigating based on impact x likelihood