Natachi

Security Researcher

[Natachi @natachisr]

@0x158_ Awesome work chief 👏🏾

[Natachi @natachisr]

@adeolRxxxx remember when i said that earlier

[Natachi @natachisr]

@ret2basic Bro just chill 😂😂

[Natachi @natachisr]

@adeolRxxxx That’s her

[Natachi @natachisr]

whats the best place to spot early stage AI labs

[Natachi @natachisr]

spent almost a week on this codebase and still nothing solid 😅

[taek.eth @leekt216]

I started writing smart contracts in 2018, and one thing always bothered me: why did running my own RPC mean running a full node, or an archive node if I wanted historical state?

My app only cared about my contracts, a few dependencies and some ERC20s. Why did I need to keep up with everything everyone else was doing on Ethereum just to serve those reads?

The annoying part was keeping that smaller set of state up to date. Reading a value at one block was doable, but knowing what changed in the next block meant executing it or asking a node that had. A transaction could reach my contract through several other contracts, so just filtering transactions by their destination wasn’t enough.

I mostly forgot about it. RPC providers got reliable enough for what I needed, and I had other things to build. I still didn’t love the setup, but it stopped being something I spent time thinking about.

Then over the weekend, I was looking through Glamsterdam’s EIPs and realized block-level access lists might make this practical.

BALs include the state changes made during a block, including the new values, and the block commits to that list. So once you have the initial state you care about, you can follow its changes without re-executing every transaction.

So I started vibe coding it. It’s called skim.

You tell it which accounts and storage slots you care about, or let it discover the state your simulations read. It fetches the initial values from Ethereum’s P2P network through SNAP, checks their Merkle proofs, and keeps them updated using BALs. Your eth_calls then run locally. If a call needs something it hasn’t fetched, it gets that from peers too, just with more latency. No upstream RPC provider for those reads.

It can also keep historical versions of the state you’re tracking. That was another thing I wanted: being able to query my app’s past state without keeping everyone else’s history. It exposes a JSON-RPC interface, so existing tools can use it for the methods it supports.

It still receives full payloads and BALs. The state it maintains is selective, not everything it downloads. There’s also a consensus light-client implementation now, but that path isn’t active on Sepolia yet because the required Gloas light-client data isn’t being served by the peers tested so far. For now, the head is still trusted.

It’s still an experiment, and I’m working through correctness bugs and longer-running tests. I’m not presenting it as a production node replacement.

But it’s pretty satisfying to finally build something around a complaint I’ve had since 2018. I wanted a small client that knows the parts of Ethereum my app actually uses, and that’s what I’m trying to make.

https://t.co/kqHmbIbC4R

[WhiteHatMage @WhiteHatMage]

Quick thoughts on the events I missed over the past two months:

- The XRP bug is a great finding, but the reward was low. But even Ethereum had a $250k max bounty a few months ago, so I wouldn’t criticize Ripple too hard.

- The max cap wasn’t specified in the XRP bounty program, so most hunters didn’t even bother checking it.

- The $50k Vercel bounty is too low. They advertised a $1 million bounty, which is misleading, since there's a $50k max cap. Are they expecting 20 Criticals?

- Other projects continue lowering their bounties or closing programs while hacks increase. I understand that it hurts to pay so many reports, but there’s no coming back from a hack.

- The “Duplicates” problem hasn’t been solved. You can still report a Critical issue, prevent major damage to a project and its users, and they will still try to find a way to pay you nothing while pointing to some non-impactful report as sharing the same root cause. Platforms should address this scam immediately.

- The LLM decompilation movement is pretty cool. It's the end of the era of closed-source code.

- People building security tools that depend on LLM tokens should try to make a profit today, or have a clear plan to sell their company before models get better. There's no long-term plan.

- LLM spam continues to be the main trend for getting bounty rewards. It feels like buying lottery tickets. The more tokens people spend, the more chances they have of landing an actual exploit. Having a unique approach seems to help too. But nobody is performing much better than the model they use, since there's no clear outstanding winner in the leaderboards.

- We’re getting to the end of 2026, and bounty rewards paid haven’t increased 10x with AI. According to Grok, for the top 100 on Immunefi the total earnings were:
* 2026 $16M, 1364 reports
* 2025 $11M, 820 reports
* 2024 $21M, 775 reports
* 2023 $17M , 559 reports
* 2022 $57M, 443 reports

- What happened with Ledger is worrisome. Keep improving your OpSec, whitehats.

Personal thoughts:

We keep seeing more and more bugs in all kind of software. That's not because of superhuman AI capabilities. It's because how bad we've been building software over decades in terms of security.

Nobody cared about exploits because they were difficult for the average hackers. Now everyone has a low-level-IQ tool that can crack neglected code, and we see the results.

We're in a transition phase, where LLMs trained with human bugs are outperforming the average guys. We'll probably get to an era of LLMs-code-first, with LLM bugs that with unprecedented vulnerabilities.

Yes, LLMs are just that bad at coding, and the current models might not be able to see some obvious errors, since they also have "cognition bias".

I see a bright future for bounty hunters, full of vulnerabilities waiting to be found and prevented. We just need to solve the bug-pocalypse first if we don’t want blackhats to win.

[Lesley John Jumbo @JumboLesley]

I’m proud to announce that I’m now a National Geographic Young Explorer.🔥

I’m extremely excited to be part of the @NatGeo family and I’m also excited to be armed with the responsibility of protecting the wonder of the world. Let’s get it. 🚀

[Natachi @natachisr]

@saxenism @bluethroat_labs please check dm sir

[Natachi @natachisr]

@themoonkami @0xenzo_eth Personal but I will open source it and send you the link

[Brandon Rossi @0xConda]

If you guys could stop submitting my bugs before me I’d appreciate it

[Natachi @natachisr]

@0xAlexSR 😂😂

[Natachi @natachisr]

@adeolRxxxx @klever_io nice catch chief

[Natachi @natachisr]

@CompleteSkeptic how do i get access I've been on the waiting list for a while

[Natachi @natachisr]

This better be it !

[Natachi @natachisr]

@Muse note available in my region lol

[Josselin Feist @Montyly]

We are hiring a security researcher at @aave

Join us to review our smart contracts, build our AI-assisted tools, and help secure the ecosystem

You will work directly with me, have room to experiment, and develop new approaches as our industry evolves

https://t.co/slHIsu9Nen

[Natachi @natachisr]

the urge to embark on a side quest away from SR, idk maybe join a hackathon this weekend