noah.eth

researcher & dev | Head of Security at Monad Foundation @monad | Former Lead Security Researcher / Spearbit Core Team @SpearbitDAO.

[koeppelmann @koeppelmann]

Here is the root cause of the current Gnosis Pay incident. Several other projects are affected. We tried to inform everyone privately in advance, but if you haven’t heard yet and are using a Zodiac module — Delay or Roles — please urgently check whether you are affected 👇

[noah.eth @Noah_eth]

They’re referring to implementation error when referring to smart contract risk.

Centralization risk is a design choice, and one that introduces operator misbehaviour and error into the threat model.

I agree with your sentiment, better system design would not put centralized operators everywhere.

Uni confidently ships without centralization baked in.

[noah.eth @Noah_eth]

@m4rio_eth deploy contract > deploy script

Don’t even give the keys a chance to dangle

[noah.eth @Noah_eth]

New rule. If your admin addresses are MPCs and not EOAs you have to label them on the block explorers 😡

[noah.eth @Noah_eth]

This is a reasonable policy 🔥

[Andrew Gallant @burntsushi5]

I've added an AI policy to ripgrep that was shamelessly copied from uv's policy. I plan to add this to the rest of my projects, but if anyone wants to offer feedback on wording, now would be a good time!

https://t.co/Lveq6HUoo1

[noah.eth @Noah_eth]

Antonio has been doing incredible work designing and tuning agentic vuln detection systems.

Check out below for a tour of what he’s been up to:

[Antonio Viggiano @aviggiano]

My first blog post for @monad's security team is out.

We spent a month building an AI system to hunt vulnerabilities in the Monad blockchain

here's what we learned

[Gonna 🔴🇦🇷 @GonnaEth]

End of an era 🔴

[NIK @ns123abc]

> I’m now in the LeCun/Marcus camp on LLMs
> real programming agents will need world models
> not some RLVR shit

it’s over

[port 🦞 @port_dev]

You have seen Qwen vs Claude Code vs Codex for Web2 apps.

But what about Web3?

I asked all three to build a DEX on Monad testnet:
- Best end-to-end: Claude
- Best contract/core engineering: Codex
- Best visual polish: Qwen

more in the vid & below 👇

[Mo @atmoio]

> the bottleneck in fixing bugs like these is the human capacity to triage, report, and design and deploy patches for them.

> some have even asked us to slow down our rate of our disclosures because they need more time to design patches.

It’s funny how adamantly “I only find bugs” Mythos is. It does not fix bugs. It does not use its gigabrain to design solutions to its own problems. Why? Because Anthropic knows this is not a joke. Because Anthropic knows that having LLMs pitch a patch to maintainers will likely create ten other downstream issues if you don’t have deep understanding of the architecture.

Finding bugs is pattern matching. Fixing them is a different labor entirely. It’s judgement, deep deep context, and consequence. And even Anthropic isn’t brash enough to pretend any model period is capable of that.

Good to see Anthropic finally communicate here that the need for humans goes up because of Mythos, not down.

[noah.eth @Noah_eth]

@__Raiders It already tries to anyway

Anything touching abi encoded data they seem to love reimplementing what already exists only with new bugs added

[noah.eth @Noah_eth]

@alice_nvr @fairside @acceleratooooor 👀

[noah.eth @Noah_eth]

@sockdrawermoney Wait I needed that one for me

[noah.eth @Noah_eth]

@aviggiano @karpathy @OpenAI Good friend 🔥

[noah.eth @Noah_eth]

@aviggiano Solo fuzzer with manual review

[noah.eth @Noah_eth]

@buntyverse EthWaterloo

[noah.eth @Noah_eth]

@0xnirlin The whole point of a timelock is to monitor for unexpected activity

[Sock @sockdrawermoney]

To my @code4rena people:

You’re always in my heart.

Thinking of all the centaur wolves, hms, and the absolute legends @CloudEllie1 and @itsmetechjay who carried the beautiful mess of C4 from the beginning. Unworkable without them and the great team I was priv’d to work with.

[noah.eth @Noah_eth]

@jsn_yrty @m4rio_eth I say this as someone who wants to rate limit where reputation is missing as a signal

[noah.eth @Noah_eth]

@jsn_yrty @m4rio_eth If you want to rate limit, just rate limit