MkXploit | Smart Contract Security Researcher

Smart Contract Security Audits | Solidity / Ethereum Building daily • Web3 security
I study smart contract failures so builders don’t repeat them

[MkXploit | Smart Contract Security Researcher @mkXploit]

Starting My Smart Contract Security Journey
Daily posts on real vulnerabilities, exploits, and lessons from audits. Learning in public, one bug at a time.
Let's build a more secure Web3 together

[MkXploit | Smart Contract Security Researcher @mkXploit]

Giving block builders a separate role doesn't make MEV disappear.

It changes who builds blocks and how the work is organised.

The financial incentives behind transaction ordering are still there.

Changing the architecture isn't the same as removing the underlying problem.

[MkXploit | Smart Contract Security Researcher @mkXploit]

@auronxyzeth For real

[MkXploit | Smart Contract Security Researcher @mkXploit]

A blue checkmark doesn't automatically mean someone is a trustworthy expert.

Blue checkmark is primarily linked to an eligible paid subscription.

It isn't proof that an account's technical claims are correct.

Verify the work, the code, and the evidence. Not just the badge.

[MkXploit | Smart Contract Security Researcher @mkXploit]

It can make certain processes more competitive and improve how responsibilities are separated.

But it doesn't make MEV disappear.

If the underlying financial incentive remains, participants will continue looking for ways to capture value.

#Ethereum #PBS #MEV #Web3Security

[MkXploit | Smart Contract Security Researcher @mkXploit]

Today I learnt about Proposer-Builder Separation (PBS) and why it doesn't eliminate MEV.

The idea is interesting because it separates two responsibilities that were traditionally handled together.

But separating roles doesn't automatically remove the incentives behind MEV.👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

It doesn't stop searchers from looking for profitable transaction orderings.

The incentives that create MEV can still exist, even when block building and proposing are separated.

My takeaway?

PBS changes the structure of block production.👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

PBS in one sentence: separate the person building the block from the person proposing it

Builders assemble and order transactions
Proposers select and propose blocks

It's an architectural approach to block production, not a magic switch that removes MEV

The distinction matters

[MkXploit | Smart Contract Security Researcher @mkXploit]

Ask how transactions can be observed, ordered, and executed around a user's trade.

A technically successful transaction doesn't always mean a good user outcome.

#Ethereum #MEV #DeFi #SmartContracts

[MkXploit | Smart Contract Security Researcher @mkXploit]

Today I learnt about sandwich attacks, one of the most notorious forms of MEV.

The interesting part?

A transaction can be valid, the smart contract can work as intended, and the user can still get a worse deal because of transaction ordering.

Here's how. 🧵👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

…ordering all influence the outcome.

A contract audit alone may not explain every risk a user faces.

My takeaway?

When building or reviewing DeFi applications, don't only ask whether the swap function works.👇

[MkXploit | Smart Contract Security Researcher @mkXploit]

AI can help you write the code.

You are still responsible for what goes live

[MkXploit | Smart Contract Security Researcher @mkXploit]

Before you deploy that AI-generated application, check these five things.

📌 Authentication and access control
📌 API keys and exposed secrets
📌 Database permissions
📌 Input validation
📌 Dependencies and package security 👇