Jeff Security

Independent Smart Contract Researcher & Researcher at @ShieldifySec

My mission is to find vulnerabilities in smart contracts for a safer Web3 Space!

[Jeff Security @jeffsecurity]

Made $60k last month from audit 😎

What about you?

[Jeff Security @jeffsecurity]

BSC testnet contracts containing malware

Injected JS on hacked sites calls eth_call → pulls full malware payload from on-chain storage. No domain/host to seize, free testnet infra, un-takedownable🫠

https://t.co/GbSqmvmZkQ

[Shieldify Security @ShieldifySec]

|￣￣￣￣￣￣￣￣￣￣￣|
We need a BD Engineer
|＿＿＿＿＿＿＿＿＿＿＿|
\ (•◡•) /
\ /
——
| |
|_ |_

[Jeff Security @jeffsecurity]

The most expensive bugs aren't always the clever ones.

It's often the obvious ones everyone assumed someone else had already checked.
Reentrancy didn't die. It just learned to hide behind "we use OZ."

[Jeff Security @jeffsecurity]

The most expensive bugs aren't always the clever ones.

It's often the obvious ones everyone assumed someone else had already checked.
Reentrancy didn't die. It just learned to hide behind "we use OZ."

[Shieldify Security @ShieldifySec]

New audit report, this time for @Bankroll_Status 🤝

Quick audit, solid team, clean code! 🫡

For more details, check out the report at 👇
https://t.co/6T1Qndj73R

[Jeff Security @jeffsecurity]

Sadly "self-custody" is only as strong as the modules bolted onto your Safe. Gnosis just got hit through the Zodiac delay module 😢

https://t.co/ssc9MoWc5m

[Jeff Security @jeffsecurity]

@ShieldifySec @Crushxyz 🫡🫡

[Jeff Security @jeffsecurity]

No foolproof fix for prompt injection yet - but you can shrink the blast radius.

Good rundown on delimiting untrusted input, scoping permissions & monitoring LLM activity. Relevant if you're securing AI agents 🤖

https://t.co/gLP4Ty6Vzb

[chrisdior @chrisdior777]

Web3 hackers negotiating a 20% bounty after draining a couple mil:

[Jeff Security @jeffsecurity]

@ShieldifySec No

[Jeff Security @jeffsecurity]

Your audit is a snapshot. The codebase is a movie.

The diff between them is where the funds go. Re-audit every upgrade like your reputation depends on it. Because it does.

[Jeff Security @jeffsecurity]

Man recovers 5 BTC (~$350k) from a legacy https://t.co/6rEe5Bz5of wallet using Claude AI.

https://t.co/ShExWFZoeo

[Jeff Security @jeffsecurity]

@ShieldifySec

[Jeff Security @jeffsecurity]

If you're crossing from web2 sec into web3 (or vice versa), this repo is gold. Hundreds of bug bounty writeups grouped by class - IDOR, race conditions, RCE, SSRF, auth bypass.
https://t.co/zJBjAfEpbW

[Jeff Security @jeffsecurity]

ChainSecurity's 2026 ETH security wishlist:
- shared whitehat fuzzers
- safer signing.
- compiler-level 24KB fixes

https://t.co/scw5rpfOgc

[Jeff Security @jeffsecurity]

Neat find: recursive calldata decoder for EVM txs. handles multicalls, batched txs, and nested ABI-encoded calls that most generic decoders choke on. fully client-side, served via ENS.

https://t.co/knO5QijOp9

[Jeff Security @jeffsecurity]

@ShieldifySec @Fast_Protocol 😑

[Shieldify Security @ShieldifySec]

🚨PSA for anyone considering working with these guys, they don't pay for their audits. We've been chasing the invoice for months!

Repost, so no one else wastes their time.

@MuratLite @Fast_Protocol @primev_xyz

[Jeff Security @jeffsecurity]

Auditors heads up on these guys!

They don't pay for their audits. Repost it🫡

[Shieldify Security @ShieldifySec]

🚨PSA for anyone considering working with these guys, they don't pay for their audits. We've been chasing the invoice for months!

Repost, so no one else wastes their time.

@MuratLite @Fast_Protocol @primev_xyz

[Jeff Security @jeffsecurity]

@ShieldifySec @MuratLite @Fast_Protocol @primev_xyz 🫥