lucyoa

lead security researcher at @openzeppelin

[lucyoa @lucyoas]

Interesting experiment on making CTF challenges harder to solve with AI: https://t.co/WYh7vILIdZ

[lucyoa @lucyoas]

Great video on generating secure keys.

https://t.co/myUxy5IX32

[lucyoa @lucyoas]

This is super dope, an LLM trained only on data up to the year 1930: https://t.co/pWfq79NVLL

[lucyoa @lucyoas]

Timeless laws of software engineering all in one place:
https://t.co/wZOildVwFV

[lucyoa @lucyoas]

Dependency cooldowns are essentially security measures that rely on the hope that someone else gets hacked first.

A better approach would be to introduce upload queues at package indexes, separating "published" from "distributed" so that scanners and maintainers have time to review releases and everyone is protected by default.

Interesting post by @cal_paterson https://t.co/MZil3fe7MV

[lucyoa @lucyoas]

New meta: tokenmaxxing - where engineers burn $$$ in AI tokens just to look productive 🤯https://t.co/e8S33ZxAPU

[lucyoa @lucyoas]

@wasabi_protocol drained $4.5M, looks like an admin key compromise. Another reminder that multisig on the README means nothing if the signers and thresholds aren't actually decentralized.

[lucyoa @lucyoas]

If you've followed RareSkills NTT thread, the inverse is the half that actually makes polynomial multiplication usable. Worth a read for anyone going deep on ZK.

https://t.co/npUBuVk41X

[lucyoa @lucyoas]

Move's type system kills whole bug classes Solidity devs sweat over, no silent drops, no dynamic dispatch hijacks, ownership enforced at both type and runtime layers. But novel guarantees breed novel footguns. Sharp writeup on what still bites in real Sui audits.

https://t.co/unOTj81tPQ

[lucyoa @lucyoas]

There's a cool beginner guide to spaced repetition, worth a read if you want to remember what you learn: https://t.co/AtzZvu5FNG

[lucyoa @lucyoas]

Audit results by @OpenZeppelin: 21 findings on Stellar Contracts RC v0.7.0 - 1 High, 6 Medium, 9 Low, 18 resolved. Zero criticals. Solid showing for a Rust library shipping toward production.

https://t.co/cX9iWC0tgf

[lucyoa @lucyoas]

Firefox patched 271 bugs surfaced by Claude Mythos preview and Mozilla notes none were beyond what a top human researcher could find. The interesting number isn't 271, it's how fast one model burned through that backlog.

https://t.co/1wDGZhoaSf

[lucyoa @lucyoas]

@trailofbits @dguido Serious question, how will you sustain expertise over time? The setup you presented seems short-sighted, as it largely focuses on exploiting existing knowledge and not developing it.

[lucyoa @lucyoas]

This is really cool https://t.co/QMWi1kaWmx

[lucyoa @lucyoas]

A security council freezing 30k ETH mid-exploit is the quiet admission that L2s aren't trust-minimized yet, they're trust-delegated to a multisig fast enough to push the pause button. Useful today, awkward for the decentralization pitch tomorrow.

https://t.co/wdEoQjrFXl

[lucyoa @lucyoas]

@trust__90 Yet more questions and no answers

[lucyoa @lucyoas]

@DevDacian 100% agree, but we shouldn't focus on a single party to blame. @LayerZero_Core's DVN got compromised, @KelpDAO used only one DVN, and @aave failed at due diligence. Imho, all three should cover the losses and prepare a recovery plan, otherwise, it's over for DeFi.