cstg1🏖️💻

Red Team Trainee / Apprentice / Recent college graduate (within one year of graduation)
Currently studying blockchain security auditing / Escape room enthusiast

[cstg1🏖️💻 @nirenix]

@0xArav congrats

[cstg1🏖️💻 @nirenix]

Today I studied a multisig-related vulnerability.
The deeper I go into smart contract security, the more I realize that “multisig” does not automatically mean “safe.”
You still have to understand:
Who are the signers?
What is the threshold?
Is there nonce protection?
Is the signature bound to chainId, contract, and action?
Can execution permissions be bypassed?
Are owner changes and module extensions properly protected?
Auditing is not about memorizing bug names or rushing through reports.
My plan is to study one vulnerability every 3 to 5 days and understand it deeply: the mechanism, the assumptions, the permission flow, the fund flow, and how it appeared in real-world reports.
Speed is not the goal. Quality is.
Every vulnerability I truly understand brings me one step closer to finding my first Immunefi bug.
#bugbounty

[cstg1🏖️💻 @nirenix]

Hey ，i m back！
Today I dug deeper into Wildcat H-02 and finally moved from “knowing the conclusion” to understanding how the PoC actually works.
Key takeaway:
codehash != 0 does not mean a contract is deployed.
It only means the account is not empty.
With CREATE2, future contract addresses are predictable. An attacker can send 1 wei to a future address before deployment, turning it into a non-empty account with:

code.length == 0
codehash == keccak256("")

In Wildcat, the issue wasn’t about deploying an attacker contract. It was about polluting the state of a future address, causing the protocol to believe a controller / market / escrow had already been deployed.

The most critical path was escrow:
the protocol skipped deployment and transferred assets to an address with no contract code.

Auditing isn’t about memorizing bugs.
It’s about understanding state changes, variable flow, and how a small assumption can become real financial impact.

I’m going to keep learning this way: one vulnerability a day, starting from the core mechanism, then tracing it into real audit / bounty reports.
I’ll keep doing this until I find my first Immunefi bug.
It feels a bit exhausting sometimes, but I’m learning a lot. Slow progress is still progress.
Study seriously, stay consistent, and keep improving.

[cstg1🏖️💻 @nirenix]

After finishing the Solidity basics, I realized how much traditional financial knowledge I was still missing when it comes to properly understanding and finding vulnerabilities in DeFi protocols.Spending today working through the fundamentals on Khan Academy. Quietly building the foundations — no shortcuts.#DeFi #SmartContractAudit #BugBounty

[cstg1🏖️💻 @nirenix]

@rnemes4 @immunefi Congrats

[cstg1🏖️💻 @nirenix]

@alisawuffles Congrats! !

[cstg1🏖️💻 @nirenix]

Slowed down, but never stopped.

Spent this stretch resting + reviewing past audits — and changed how I look at contracts: from "reading the code" to "following the money." Where it comes from, where it goes, which step can be pried open.

I haven't given up on blockchain security auditing. I've just learned to move at a pace I can sustain.

Ready for the next one 🛡️
#SmartContractAudit #Web3Security

[cstg1🏖️💻 @nirenix]

Excited to join SR Summer 2026 🏖️💻

This summer I’m committing to upskilling as a security researcher on @immunefi.
Focusing on better target selection, structured research, and writing stronger reports.

Goal: Turn skills into real bounties 💰

Who else is in? Let’s make this summer count!

#SRSummer #BugBounty #Web3Security

Excited to join SR Summer 2026 🏖️💻

This summer I’m committing to upskilling as a security researcher on @immunefi.
Focusing on better target selection, structured research, and writing stronger reports.

Goal: Turn skills into real bounties 💰

Who else is in? Let’s make this summer count!

#SRSummer #BugBounty #Web3Security

[cstg1🏖️💻 @nirenix]

A medium I submitted got duped into oblivion. On paper: worthless.
In practice: proof my attacker-mindset is transferring from red team → smart contracts.
The bug doesn't pay. The confirmation that I'm on the right path does. Keep showing up. 📈
#RedTeam #Web3Security #SmartContractAudit #Solidity #DeFiSecurity #PentestToWeb3 #BugBounty #EVM #Auditing #InfoSec #Blockchain #Cantina

[cstg1🏖️💻 @nirenix]

I just joined the waitlist for @immunefi Signals. Project-level intel on payout velocity, response times, and where to hunt. https://t.co/tYr48I32n8
Stay focused. Repetition is the mother of learning. Keep going.

[cstg1🏖️💻 @nirenix]

First standalone PoC done today — reproduced the "empty-array bypass"
on SimpleBank from DeFiVulnLabs.
@1nf0s3cpt @PatrickAlphaC
Key insight: when signature verification lives inside a for-loop,
an empty array skips the entire loop. No sigs → no revert → free withdraw.

Mitigation is one line: require(sigs.length > 0).

From red team → smart contract auditor, one PoC at a time. 🔍

Show up. Focus. Don't fear the mistakes. Repetition is the only real teacher.

#Web3Security #SmartContractAudit

[cstg1🏖️💻 @nirenix]

@PatoNguch @CyfrinUpdraft Thank you so much for the resource recommendation! Super grateful The videos and account are fantastic. Appreciate it a lot!

[cstg1🏖️💻 @nirenix]

Been grinding through @cyfrinupdraft's smart contract security curriculum.
Next up: one full week dedicated to reentrancy attacks.
Not just the classic single-function pattern — cross-function, cross-contract, read-only reentrancy. All of it.
The deeper you go into how protocols get drained, the better you get at protecting them.
Let's get it. 🔐
found a drain-the-whole-contract bug recently. out of scope. no bounty.
kept going anyway.
now studying every variant — single, cross-function, read-only, cross-chain — from source.
OZ, SWC-107, @cyfrinupdraft.
if you've seen one of these in a real audit, what did the entry point look like?
5 days. 10 hours each. nothing to show for it yet.

[cstg1🏖️💻 @nirenix]

@BensonDynasty_ Hey, keep grinding! I'm also learning smart contract auditing. Recently found a critical bug — severe enough to drain the entire contract — but ended up getting marked out of scope. No bounty.

[cstg1🏖️💻 @nirenix]

Day 2026-5-21
Just completed my first audit from #web3education and signed up for @codehawks!
thank to everyone

[QuillAudits 🥷 @QuillAudits_AI]

https://t.co/zH1pivNR8N

[cstg1🏖️💻 @nirenix]

Day65：
Today's log:
→ Wrapped Pt.2 of @CyfrinUpdraft Smart Contract Security
→ Opened Pt.3 (manual code review)
→ 1 long-form interview + several papers

9 hours in, no shortcuts.
Pivoting from offensive sec into Web3 audit. The reps compound. 🛠️
Thanks @PatrickAlphaC for the curriculum 🛠️

[cstg1🏖️💻 @nirenix]

@code4rena

[cstg1🏖️💻 @nirenix]

Truly the end of an era. 💔 As a newcomer to Web3 security, I was really looking forward to growing and honing my skills here. But more than anything, I just want to say a huge thank you for giving beginners like me such an amazing platform to learn and find real opportunities. You will be missed! 🙏✨
#Web3Security #SmartContract #bugbountytips

[cstg1🏖️💻 @nirenix]

Day 60 learning smart contract security 🛠️
Today's wins: ✅ Forked mainnet at a specific block with Foundry ✅ Read Uniswap V2 traces line by line ✅ Wrote my first fuzz test — Foundry actually found the bug: args=[6] 🎯
Today's L's: ❌ Spent 30 min on setUP vs setUp❌ Named function without test prefix → Foundry ignored it ❌ Hardcoded fuzz param instead of putting it in the signature ❌ Forgot to new the contract in setUp ❌ Posted an API key in chat (rotated immediately, lesson learned)
Lesson: every "low-level mistake" is just a bookmark for "next time you'll know."
Onwards. 🚀
自己犯了好多低级错误 例如 ：写fuzz的时候函数名不加test ，还有忘记new 一个新的实例 不new 直接写，还有明明fuzz的是data参数结果 把data直接写死。。。。。 啊哈哈啊哈真好笑 我是不是不适合干这个 唉，明天接着干吧 @CyfrinUpdraft
#Web3Security #Foundry #SmartContractAudit