Eric Will Work for Crypto Punks

Web3 Security Researcher (Do NOT DM for audits..... yet) // Smart Contract Developer // Educational Content // NFT Project Founder

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

Here is the video walkthrough of our Quick & Dirty Guide to the UUPS Proxy Pattern:
https://t.co/WtsPNUzPUv

#SmartContracts

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

It's been a minute but here is another Quick & Dirty guide for #smartcontract devs who don't have time to mess around and need to get up and running fast. Today we go over the UUPS proxy pattern.

https://t.co/icqL9igGJq

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

Look who cracked @TheSecureum RACE-33 leaderboard top 32!

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

@FearedBuck You mean these jerk$ weaving in and out of traffic in NYC at faster than 100mph actually have fans for that sh!#? Lock this fool up for life!

[Jeffrey Scholz @Jeyffre]

I got a lot of support and DMs with helpful leads, thanks everyone!

Also, ngl the outpouring of appreciation helped a rough week not suck as much. 💜

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

Cracked the leaderboard for @TheSecureum's RACE-29 designed by @kamensec. Great exercise, this blade is getting sharper. Lookout hackers!

[Owen | Guardian @0xOwenThurm]

Auditing becomes very *very* fun once you're over the hump.

Still trying to break through that barrier?

Just follow these steps in order:

1️⃣ Learn The Basics

I covered it all for you, get all the basics down with the following playlist:

https://t.co/SrllpL3okr

After that, you know everything you need to get started. 🫡

2️⃣ Start Competing In Contests

Here are some platforms to try out:

- @CodeHawks (First flights to start)
- @code4rena
- @sherlockdefi
- @cantinaxyz
- @HatsFinance

Now let's set the expectations before you dive in, contests will be hard, that's expected.

Rising through the ranks and gaining mastery is extremely time-intensive and in the beginning... quite brutal.

In the beginning:

• You'll feel overwhelmed in a new codebase
• You'll struggle to uncover solid high findings
• You'll struggle to uncover solo findings
• You'll find it hard to even learn from each audit

We need to get out of this beginner phase ASAP.

This is where the majority of folks get stuck.

Let's not get stuck.

3️⃣ Absorb From Someone Who's Already Done It

To rocket out of the beginner's phase let's learn from the experience of those who have done it before us.

We can absorb years of Web3 Security experience in weeks just by working alongside a security veteran.

Not only that but having a partner to audit with can drastically accelerate your rate of understanding a codebase.

→ Consult the code
→ Consult your partner
→ Understand the code more

Do anything you can to get around and learn from someone who's put in the time and done the head-banging for you.

Offer to:

• Write reports
• Write articles
• Create PoCs
• Create Fuzzing or Test Suites

Anything you can do to provide value and get your foot in the door.

Spending just 1 week with a Web3 Security veteran can outperform months of work.

It's about learning what you don't know that you don't know.

4️⃣ Partner Up!

Web3 Security gets tough!

If you have a partner you're much more likely to stick it through and see the fruits of your labor on the other side.

Not only that but having a partner to audit with can drastically accelerate your rate of understanding a codebase.

→ Consult the code
→ Consult your partner
→ Understand the code more

5️⃣ Get The Feedback Loop Right

Your feedback loop is everything when it comes to mastering a new skill.

Auditing is no exception.

If your feedback loop is off you can spend months working without making any noticeable progress...😨

You can gauge the effectiveness of your feedback loop by your contest results:

Clearly increasing with a stair-step effect?

Yes → You got the feedback loop down
No → You need to go back to the drawing board

If you aren't seeing a clear stair-step effect in your contest results here's what might be happening:

You do a contest, wait weeks for the findings to come out, see what you missed and study that.

Here's what's wrong with that:

• The loop is too slow

If you're waiting more than a day or so to get feedback on your work, you're wasting time.

Plain & simple.

Drag your future into the present and figure out a way to shorten that feedback loop.

• Auditing is not flash cards

You can't memorize findings and then copy-pasta them into new codebases.

The worthwhile findings don't function that way.

Start seeing real improvements by getting actionable feedback on your auditing approach, not the outcome.

A fantastic way to do this is by consulting someone ahead of you or auditing in a team and observing how others come to new findings.

6️⃣ Gain Credibility

Security review demand is driven by credibility. Clients are trusting you with millions of $TVL.

However, to get credibility you must have secured millions of $TVL already.

We have a bit of a chicken & egg situation.🥚

There are several ways to tackle this, here's a favorite of mine:

Find a new open-source project being launched by a big name in the space.

Learn everything there is to know about it and spend an entire month auditing it.

Present your findings to the team in a comprehensive report, and ask for nothing in return.

Now you have a fantastic report for a big name in your portfolio of work.

Chicken & Egg → Solved.

Bonus points if you complete a fuzzing suite for them.

7️⃣ Go To The Market

You've got a handful of contests under your belt.

You've worked with several auditors & learned from their approach.

You've completed a thorough engagement for a well-known team.

And now you're ready to go to the market!

Now it's time to see the fruits of your labors. 🏆

Use your network to get your initial reviews or shadow audits with a firm.

The most important part here is doing your absolute best.

Opportunities multiply when you deliver exceptional work.

And that is exactly how you can join the Web3 Security industry!

Best of luck, we need you in here. 🤝

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

"The C students run the world."
-- Harry S. Truman

Thanks to @RealJohnnyTime's #smartcontract #hacking course

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

Guess who found a High-Risk vulnerability in the NextGen by @6529Collections contest on @code4rena? ....👍👍 this guy!

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

We got ourselves a real life Gotham super villain here!

[Vladimir S. | Officer's Notes @officer_secret]

The @KyberNetwork exploiter sent the team another message!

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

For web3 auditing skills I participate in contests AND study online resources. To avoid tutorial hell I'm picky about which ones I use.

I recently discovered @RareSkills_io blog (free on their website) and boy is it chock full o' amazing practical + theoretical knowledge.

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

Took advantage of Udemy's Black Friday sale and picked up the Yul + Gas Optimization courses from @RareSkills_io.

Gas optimization reports coming soon to a protocol near you!

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

@0xOwenThurm Read only reentrancy
1) Deposit 2 Eth. Now canWithdraw() returns 'true' for 2 Eth
2) Withdraw 2 Eth. On receipt you still have control and can make new calls that depend on canWithdraw() that don't necessarily decrease balance
3) Balance gets decremented too late after the fact

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

Wrapping up a @code4rena contest today. Submitted some highs, meds and lows. Are they valid? Time will tell.

Taking a break from contests for 1-2 weeks to reflect, refine my knowledge, review material from @RealJohnnyTime's SC Hacking course and then back to bug hunting!

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

@pashov Open to jr roles/internship, poc writing, temp, perm, pt/ft opps. Whatever value I can bring. Name it! The knowledge gain would be invaluable

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

@0xKbl FT web2 job + small child here. For me it’s about blocking time daily. Whether 30 min or 4 hours minimizing distractions is key.

Do I get discouraged at times? Yes but I remind myself of the goal. The occasional encouragement from online strangers oddly helps a little too. lol

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

@CyfrinUpdraft Assembly/Yul

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

Woo Hoo! Made the leader board for @CodeHawks PuppyRaffle First Flight. These are fun but unfortunately I may have to bow out of the current BossBridge challenge to focus an a different contest. I am learning to not spread myself too thin with these audit contests.

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

@DevDacian @SoloditOfficial @cyfrin Now that's a massive effort. Bookmarked!

[Eric Will Work for Crypto Punks @eric_wwf_cpunks]

Any other rising Web3 Security Researchers also have a non-auditing related day job? You are not hustling alone, let's stay focused. That goes double if you also have a family.