JC 🔍

Fomer Protocol Security at @the_matter_labs/@zksync.

Smart contract security lecturer at @BlockchainUma and @UPorto

[JC 🔍 @jcsec_audits]

#Cosmwasm and #EVM smart contracts are quite different! Not just the language (#Rust Vs #Solidity) but the rest of the tech too! How do auditing skills transfer between them? 🧵

[vitalik.eth @VitalikButerin]

ZKsync has been doing a lot of underrated and valuable work in the ethereum ecosystem. Excited to see this come from them!

[ALEX | ZK @gluk64]

https://t.co/mbanFBPMVe

[AdamOnFinance @AdamOnFinance]

1/21

ZKsyncs Atlas stack means it is processing 10x the number of TPS of US credit cards, in a process that is:

-sub-1 second finality
-cryptographically provable
-0.06% the cost of an average interchange fee
-possible in private environments

[Marco López González @Marcologonz]

Hei @MetanaHQ ! I was reading your article on delegatecall, https://t.co/i4On6VJC3c, and I noticed an interesting behavior in the example you shared.

A short thread on why storage layouts really matter when using delegatecall! 🧵👇

[Jeff Security @jeffsecurity]

CosmWasm auditing roadmap by @jcsec_audits 🫡

https://t.co/Znwxr4scwf

[JC 🔍 @jcsec_audits]

@nmirchev8 @SecurityOak Hope you enjoy the CTF! It is very basic but serves the purpose of introducing someone to the tech 🙂

[JC 🔍 @jcsec_audits]

@timurguvenkaya @dethSCA Grateful to read those words from an OG 🎩

[deth @dethSCA]

Want to learn how to audit CosmWasm?

This roadmap by @jcsec_audits looks like the only one out there.

https://t.co/SnXdzVpr0u

[JC 🔍 @jcsec_audits]

@dethSCA Thanks for the mention man! Keep rocking it 🫡

[JC 🔍 @jcsec_audits]

Enjoy some of the cool work that we have done lately at @the_matter_labs 😎

[Denis Kolegov @dnkolegov]

As part of @zksync Trust & Safety initiative, @the_matter_labs Red Team reviewed the new features of @zkemail . Read the audit report: https://t.co/2ki6uQY9hb and dive into the most critical issues in our blog post: https://t.co/HW5RipH0sR cc @portport255 @gluk64 @anthonykrose

[Mudit Gupta @Mudit__Gupta]

How to get 8 hours sleep in 2 hours? pls help.

[JC 🔍 @jcsec_audits]

@namx05 Not at all, happy that you liked it!

[porter @portport255]

First audit report by @the_matter_labs 🥳 Our goal is to help decentralized applications built on ZKsync.

If you need an audit, contact [email protected] 🫡

[tpiliposian @tpiliposian]

Recently, I was reading about @immunefi bug fixes and decided to collect the last 2 years' findings in one place and open-source it. As imo, these are the best resources to learn security. No rocket science here, just gathered and documented it on GitHub. Sharing it here, maybe you'll find it interesting 🫡

https://t.co/r08gjN7WNC

[Oak Security @SecurityOak]

We have just published our audit report of @ApolloDAO's @osmosis Fixed Width Range Vault @CosmWasm smart contracts. Read all about our findings and recommendations here: https://t.co/X5BlO73jIk

[JC 🔍 @jcsec_audits]

@lmc_security @bytes032 @sm4rtcontr4ct 🫡

[Oak Security @SecurityOak]

Not sure which platform you should deploy your new #defi protocol on? Read Eduard Kotysh's guide on #security considerations to be aware of when choosing a blockchain.
https://t.co/fwrqcfnfOK

[JC 🔍 @jcsec_audits]

One of the latest audits that I took part in while I was (almost) full-time at @SecurityOak .
I will keep working on @CosmWasm audits from time to time though :)

[Oak Security @SecurityOak]

We have just published our audit report of @Eclipsefi's Equinox Lockdrop @CosmWasm smart contract. Find the full report here: https://t.co/GTBlKFTtnr

[Eloff @eloffd]

I disagree that Software Engineers should be accountable. Everyone writes bad code. Some more than others.

If that bad code can be easily released to cause havoc in the real world, the problem is the management and processes that enabled it. Hold the company and its management responsible.

All programmers that I know wish they could spend more time on tests, have better QA processes, have good practices like canary deployments, etc. We have to actually force ourselves to release code we don't think is good enough because management is standing there tapping their foot and pointing at their watch.

The problem at Crowdstrike isn't the engineer that messed up, because all of their engineers will mess up sooner or later. The problem is the poor processes they have in place, a lack of sensible precautions like canary deployments and sufficient automated and manual testing. The fault lies 100% with management, and I hope they are held accountable in the lawsuits that follow.

But watch them pay themselves hefty bonuses while they shift the blame to the people at the bottom of the hierarchy who didn't have responsibility or a say in the matter.

[JC 🔍 @jcsec_audits]

Ah sheit, I just found out there was a CosmWasm contest in June at @sherlockdefi... I may need to start keeping an eye if this becomes a trend 🧐