omnipotent

Leading Full Stack Audits @ValkyriSecurity

[omnipotent @omnipotentblock]

This hits close. Proof that consistent work still pays off. Keep killing it man!

[pashov @pashov]

I started in web3 security by doing code4rena contests in 2022. I made $46.04 on my first one (Nibbl). Got lucky on the second one and made $926.63 (Illuminate) with ~6hrs of focused work.

I was hooked. I was already making close to $200k/yr base pay in my full-time job, and this was even better ROI on my time, insane.

A few months into this, I won my first contest. A Champion. 1st place, everyone else was behind me. Still, it was a small contest, made only $3561.22 (VTVL). This taught me that everything is possible in this space.

I started doing all contests and posted about it on X, then it found me - someone reached out to do an audit for him. "A solo audit?" I said - he nodded. $600 for 6 hours of work - DEAL.

After this, in a week I got another solo audit for $1500, which took me ~10hrs - even better. Felt awesome. I later got invited to work with OakSecurity and got paid $3000. I felt rich now.

Here I was all-in, spending all my awake time to study and learn, speak to other people, analyse opportunities, I wanted to grow and be better. Was finding more and more vulnerabilities.

Now, I joined Spearbit as an Associate Security Researcher position which I was proud of, with an advertised weekly rate of $6250. I don't think I ever ACTUALLY got paid that, but on paper, it looked cool.

More solo audits followed - got my first 5 figure deals and it was pure profit. I had a good stream of clients. It was a business. This is ~February 2024.

In the end of the year I launched a full-blown web3 security company, Pashov Audit Group. It was really about doing MORE of the good work, for more web3 projects. In 2.5yrs we did 500 audits so I guess that's that...

The big lesson in here is that you can start small, very small. Again, $46.04 dollars. I kept going. Added lots of zeroes to that number. Spoke to the right people and teamed up with them. Ignored the naysayers, kept going. I really kept going, still going.

Your time to decide now - will you keep going, or will you quit? Choose wisely🙏

[omnipotent @omnipotentblock]

@0xaudron Canton’s architecture fundamentally solves the confidentiality integrity trade off that has bottlenecked enterprise DLT for years.

[omnipotent @omnipotentblock]

monetizing idle physical gold with a stablecoin sounds great until you have to actually build the security architecture for it.

a gold-backed token requires centralized custodians and oracles feeding physical vault data on-chain.

if an attacker manipulates the oracle, or the yield-generating smart contract has a basic logic flaw, the digital liquidity gets drained while the physical gold sits untouched in a vault.

web3 security for rwas is 90% operational security and 10% smart contract linting. you can't formally verify a physical gold bar

[Nikhil Kamath @nikhilkamathcio]

The world still runs on the dollar.

But countries are quietly hedging out: buying gold, trading in non-USD pairs, building payment rails outside SWIFT.

UPI has been incredible for India to say the least.

To friends championing dollar-backed stablecoins, specifically dollar-backed, this seems like a bad idea long-term for India. Credit where due, to Modi govt and regulators, you got this one right in the face of a lot of pressure.

On the other hand, if there were a gold-backed stablecoin and one could monetise the unutilised gold sitting in Indian households to return a yield… don’t know enough to talk about this, but thoughts?

[omnipotent @omnipotentblock]

We spend so much time auditing smart contracts, but decentralized state machines don't matter if your load balancers go down from a legacy proxy flaw. Secure your base layer.

[omnipotent @omnipotentblock]

An 18 year old NGINX bug just woke up and chose violence.

CVE-2026-42945 is a 9.2 heap buffer overflow currently getting exploited in the wild. You need ASLR disabled for full RCE, but anyone can trigger a DoS crash on your workers with a basic crafted HTTP request.

[omnipotent @omnipotentblock]

everyone is so desperate to save fractions of a cent on api limits that they are routing their agentic workflows through random third-party llm endpoints.

now 26 of those proxies have been caught injecting malicious tool calls to siphon seed phrases straight out of dev environments. if you are using an ai agent to deploy smart contracts through a shady router, you are literally giving blackhats root access to your keys.

stop cheaping out on infrastructure.

[Cointelegraph @Cointelegraph]

🚨 ALERT: Researchers discover 26 third-party AI LLM routers secretly injecting malicious tool calls and stealing credentials.

Developers using AI coding agents like Claude Code to work on smart contracts or wallets may be at risk of having private keys and seed phrases compromised.

[omnipotent @omnipotentblock]

anthropic just proved that the exploit market is about to be entirely automated.

they are refusing to publicly release their new claude mythos model because it is too effective at finding zero-days. the ai autonomously uncovered a 27-year-old vulnerability in openbsd and chained linux kernel flaws to take over systems. instead of a public launch, they are locking it behind "project glasswing" with massive tech partners just to patch web2 infrastructure before the blackhats get their hands on similar tech.

if an ai can break openbsd, it can absolutely find critical issues in your defi protocol.

[omnipotent @omnipotentblock]

🚨AI hack for your auditing to reduce false positives :

> Don't trust first pass findings. Just like you get issues and later turns out like design choice.

> Time to invalidate it by providing proper context with something like : “Invalidate this & find real impact for audit-report.md in the given codebase adhering to design choice (design.md), readme.md, and full code context.....”

> This saves you from reporting false positives to a better extent.

AI is at a point where it fetches and matches data, but without full context just like humans it cannot know the difference between "bug" and a "feature".

[omnipotent @omnipotentblock]

@ThisIsDK999 @astuyve 😂😂

[omnipotent @omnipotentblock]

Stop blaming the smart contract code. The $200M+ extraction was an infrastructure failure.

- The Vectors: Compromised admin keys combined with a cross-chain bridge vulnerability.

- The Execution: The attacker bypassed guardrails to mint unauthorized USDC, manipulated the oracle logic, and drained 85% of the DEX's liquidity.

- The Escape: Assets were immediately swapped and bridged to Ethereum (ETH) to prevent the chain from freezing the funds.

If your admin access and cross-chain messaging aren't mathematically secure, your protocol is just a honeypot waiting for a compromised key.

[Drift @DriftProtocol]

Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke. We’ll provide additional updates from this account as more information is available to share.

[omnipotent @omnipotentblock]

everyone is still arguing about which l2 is faster while the ecosystem bleeds out from basic opsec failures.

q1 2026 is a graveyard. almost $100m got drained because teams can't secure their aws kms keys or executive devices (resolv, step finance).

on top of that, tally and slingshot are shutting down because nobody actually wants to pay for decentralized governance or unsustainable yield models.

fix your infra and your tokenomics before you worry about ai smart contract linting.

[omnipotent @omnipotentblock]

@forefy @trailofbits good stuff!

[X Freeze @XFreeze]

First, make it exist, then polish it later

[omnipotent @omnipotentblock]

the "ai era" isn't about chatgpt writing your emails. it is about agentic commerce.

an actual agentic economy means autonomous entities holding digital wallets, paying each other for micro-services, and executing real-world procurement without a human in the loop.

but right now, the integration is completely broken. agents have no native identity, no secure execution environments, and no way to interface with traditional financial rails. we are trying to run a global autonomous economy on legacy web2 oauth and manual api keys.

the models are ready. the infrastructure isn't. whoever builds the integration primitives owns the next decade.

[Naval @naval]

Software was eaten by AI.

[omnipotent @omnipotentblock]

The engineers who keep their foundational skills sharp while everyone else forgets how to read code will command the entire market.

[omnipotent @omnipotentblock]

The "vibe coding" movement is a fast track to developer brain rot.

[omnipotent @omnipotentblock]

Abstraction is a tool, but when you abstract away the actual problem-solving process, you lose the ability to debug structural flaws.