DemoreXTess

LSW in @sherlockdefi 15+ Top 5 in Audit Contests Portfolio:

[DemoreXTess @demorextess]

New milestone unlocked: I’m now officially an LSW at Sherlock DeFi after securing 1st place in the recent “Burve” contest with a solo high-severity finding.

This is just the beginning. Holding this title requires consistency, and I’m fully committed to maintaining the standard.

Big thanks to @sherlockdefi for the opportunity. I’ll do my best not to let anyone down.

[Parletto @parlettodotbet]

We have completed our smart contract audit with @sherlockdefi.

0 high. 0 medium. 4 low/info.

Low/info issues are non-exploitable.

All resolved.

The rails are checked.

Mainnet is next.

[DemoreXTess @demorextess]

Ultracode - xhigh + workflows

What will be the next ? 🤔

[DemoreXTess @demorextess]

@oot2k1 Blackhat hacking

[DemoreXTess @demorextess]

😞

[pashov @pashov]

🤯CODE4RENA SUNSETTING. THE END OF AN ERA

Thank you for everything, code4rena, forever in our hearts <3

[DemoreXTess @demorextess]

Proud to be a small part of it. Thanks all the @sherlockdefi members for the opportunities created 🫡

[SHERLOCK @sherlockdefi]

Sherlock has secured some of the biggest stablecoin and RWA protocols in crypto.

Incredibly proud of the work we've done alongside @SkyEcosystem, @GHO, @ethena, @usualmoney, @MidasRWA, @maplefinance, @noble_xyz and more.

With 11,000+ security researchers in our network, each audit team is staffed around the protocol’s exact architecture, risk profile, and domain.

Stablecoins are becoming the backbone of Web3 and securing them is a major priority for us going forward.

[pashov @pashov]

The reasonable man adapts himself to the world, while the unreasonable man persists in adapting the world to himself.

Therefore all progress depends on the unreasonable man. Have a beautiful Saturday🌸

[ether.fi @ether_fi]

DeFi United

[Immunefi @immunefi]

Most security firms are quietly moving away from audit competitions.

This is one of the biggest mistakes happening in crypto security right now.

There is a simple way to think about audit value: what does it cost to find a critical vulnerability?

We looked at the actual data on what it costs to find critical bugs in crypto, and the numbers are not surprising.

Finding a critical vulnerability in an audit competition costs $6,548 on average. The exact same severity bug through a bug bounty program costs $114,000. That is 17x more expensive for the same result.

Now look at the traditional audit model.

Some top firms charge $100 per line of code. Others charge as high as $25,000 per auditor per week. A single engagement can easily run $200k to $500k+, and you are getting maybe 2 to 4 people looking at your code.

But cost per critical is not even the most interesting part.

The interesting part is the structure of who is looking at your code.

When you hire a firm, you get 2 to 4 auditors. Maybe they are great. Maybe one of them is having a bad week. You are making a concentrated bet on a small number of people.

An audit competition attracts hundreds of security researchers. These are some of the best hackers, people who have found real vulnerabilities in major protocols.
These hundreds of researchers are now armed with AI tools. They understand codebases faster. They write PoCs faster. They find bugs that would have taken DAYS in just hours.

Think about what that means.

You are not just getting hundreds of humans. You are getting hundreds of AI-augmented humans, each running their own workflow, each with their own intuition about where bugs hide.

The scaling dynamics are extraordinary.

The firms moving away from competitions are optimizing for predictable revenue, not for their clients’ best outcomes.

That is understandable from a business perspective.

But if you are a project choosing where to spend your security budget, you should optimize for bugs found per dollar spent.

Audit competitions now also have scaling pots. The prize pool grows with the scope of the codebase.

This aligns incentives in a way that fixed-fee engagements never can.

But what about AI spam, low-quality submissions, and the time it takes to triage all of those submissions?

Immunefi is addressing these with mechanisms like pay-to-submit, managed triage, and AI triaging agents, which are already showing very strong promise.

The best security strategy is not either or.

But if you have a limited budget and you want the most eyes, the most diverse skill sets, and the best cost per finding ratio, audit competitions are still the obvious choice.

[DemoreXTess @demorextess]

My public address is 0xB942aA9fEF01b633306737c4A87EA8974B914811

[DemoreXTess @demorextess]

These guys are cooking 🤌 Incredible...

[HackenProof @HackenProof]

A $250,000 payout on HackenProof says a lot 💰

Could this be the highest payout yet for an AI Auditor? This massive critical was discovered by @therealgregoai.

Huge congrats from HackenProof 🎉

[pashov @pashov]

🥷One-shotting Threat & Trust models, invariants (stated & inferred), Git History & tests analysis and much more within a sub-10min run.

This is the new "X-Ray" tool on pashov/skills. Free & Open Sourced. Let us know if we should keep building these🫡

[DemoreXTess @demorextess]

@Fav_Truffle Stay on cash 💵

[pashov @pashov]

🚨Solidity Devs: this FREE AI security tool's been used by 1000+ people and has found tens of Critical/High vulns in real codebases.

solidity-auditor v2 is OUT - now with 7 specialized sub-agents on top of v1. Free. Open Source. 1min install. Pls share if you find it valuable🫡

[DemoreXTess @demorextess]

@Fav_Truffle We still face with multi million dollar hacks which lives for 4 years in old projects. I keep getting surprised by this.

[DemoreXTess @demorextess]

@0xSilvermist Coverage is good but more context is needed, what did it miss ?

[DemoreXTess @demorextess]

There is no best time to start. The best time to start is always right now.

[Pyro @0x3b33]

The best time to start was 5 years ago, the second best is now.

[DemoreXTess @demorextess]

@Fav_Truffle @sherlockdefi 😍

[DemoreXTess @demorextess]

@philbugcatcher @Certora Congrats mate 🥳

[DemoreXTess @demorextess]

@MartinMarchev @Certora Congrats!

[DemoreXTess @demorextess]

@vinicaboy Of course, especially if the guy is vinica boy. 🥳