E r i c k λ

Code, math and physics are my passion ∑

Working as a Bitcoin security researcher

[Vincenzo Palazzo @PalazzoVincenzo]

Last week was the Lightning Dev Summit in Vienna, full of great people & talents, where we discussed the future of Lightning at the protocol level

Here are my personal takeaways:
1/N 🧵

[E r i c k λ @iamflops]

@1440000bytes May I ask why they banned you?

[Bitcoin Optech @bitcoinoptech]

Welcome to our live show! https://t.co/aP5c8vjyOv

[E r i c k λ @iamflops]

@bitcoinoptech Good talk about onion message jamming. Besides using onion_message_drop, an attacker can also create a loop between nodes. The entry node would initially see the attacker’s node ID, but once the loop completes, they would lose the path that leads back to the attacker.

[E r i c k λ @iamflops]

@spiralbtc @nishant282003 Congrats! 👏👏

[Bitcoin Optech @bitcoinoptech]

Erick Cestari (@iamflops) posted to Delving Bitcoin about the onion message jamming problem affecting the Lightning Network...
https://t.co/SG3T27uskF

[E r i c k λ @iamflops]

@luca0x46 @trailofbits @secondhq And make them use the trail of bits skills that makes sense for that specific task. At the end of you orchestration you can agregate multiple output (that each agent generated) to one and review that one. Also you can apply the fp-check to avoid reviewing trivial fp.

[E r i c k λ @iamflops]

@luca0x46 @trailofbits @secondhq Yes. You can create a command for your PR reviews, or even for a full scan of the codebase. In that command you have agent orchestrator, that's gonna spawn multiple agents in parallel focused in specific tasks. Per example, one for crypto, one for spec..

https://t.co/Ncpi513V4j

[bitcoin++ Insider Edition @btcinsider__]

LIT: Erick Cestari (@iamflops) dives into the topic of onion message jamming on Delving. Onion messages are distinct from onion payments, as they contain no payment details, just message data.

Onion messages are slated to be shipped in LND's (@lightning) next release, which would make the protocol standard across all lightning implementations and increases the likelihood of use across the network.

Without a payment, there's little to limit the creation and relay of these messages. In his Delving post, @iamflops digs into the options for how to best handle malicious message propagation. While each implementation has its own mitigation for message floods, there's no common method for dealing with them.

Read more on the delving post 👉
https://t.co/BL7rTndLHd

[E r i c k λ @iamflops]

@RascunhoEcono @brcryptosa @namcios "garantindo que não possam ser rastreados ou confiscados por causa das sanções".

Confiscado não tem como ser, e além disso existem diversas técnicas para dificultar a rastreabilidade, como payjoin por exemplo.

[E r i c k λ @iamflops]

@jaoleall 🔥 soh os brabos

[bitcoin++ @btcplusplus]

Exploits Replay: @iamflops explains how fuzzing can find cross implementation bugs at @btcplusplus exploits edition in Florianopolis, Brazil this past Feb 🇧🇷#btcpp

[Vinteum @Vinteum_org]

https://t.co/J1OzuwXGgI

[E r i c k λ @iamflops]

@niftynei @peterktodd Is "this is not a transaction" a reference for this?

https://t.co/yHVymqRFAT

[E r i c k λ @iamflops]

@fjwyuu Venha para o Bitcoin open source, Yuuka. Vi que você tem interesse em blockchain, redes P2P, descentralização, privacidade. Todos diretamente ligados ao Bitcoin.

[E r i c k λ @iamflops]

@samsantosb https://t.co/4eZvBeILMC

[bitcoin++ Insider Edition @btcinsider__]

Vinteum BDL Student Spotlight: Erick Cestari (@iamflops) ⚡

Erick shares his journey from submitting Lightning Differential Fuzzing as a hackathon project at @btcplusplus Floripa 2025 to having Andrew Poelstra review his code on rust-bitcoin. Today he is a @vinteum_org fellow.

[Vinteum @Vinteum_org]

First day of @btcplusplus Exploits Edition in Florianópolis.

Vinteum was proud to be the main sponsor of this deeply technical gathering, bringing developers together to explore historical bugs, attack surfaces, and ways to make Bitcoin more robust.

[Librería de Satoshi @libdesatoshi]

🔔 Mentor confirmado

Se suma Erick Cestari como mentor en la Residencia B4OS – Florianópolis 2026.

Erick es security researcher y Bitcoin open-source developer, actualmente financiado por Vinteum para trabajar en seguridad de Bitcoin.
Es uno de los maintainers de Bitcoinfuzz, un framework de differential fuzzing diseñado para encontrar bugs y vulnerabilidades en librerías de Bitcoin.

Su trabajo se centra en la búsqueda responsable de vulnerabilidades en implementaciones de Bitcoin y Lightning Network, contribuyendo directamente a fortalecer la seguridad del ecosistema.

Durante la residencia, los developers aprenderán junto a personas que trabajan en una de las capas más críticas de Bitcoin: la seguridad del protocolo y sus implementaciones.

🗓️ 22 de febrero – 8 de marzo
📍 Florianópolis, Brasil
@iamflops 

✈️

🔔 Mentor confirmed

We’re excited to welcome Erick Cestari as a mentor for the B4OS Residency – Florianópolis 2026.

Erick is a security researcher and Bitcoin open-source developer, currently funded by Vinteum to work on Bitcoin security.
He is one of the maintainers of Bitcoinfuzz, a differential fuzzing framework designed to find bugs and vulnerabilities in Bitcoin libraries.

His work focuses on hunting vulnerabilities in Bitcoin and Lightning Network implementations, contributing through responsible disclosures to strengthen the ecosystem.

During the residency, developers will learn alongside people working at one of Bitcoin’s most critical layers: protocol and implementation security.

🗓️ February 22 – March 8
📍 Florianópolis, Brazil
@iamflops