Pherm

Web3 Security Researcher, Rust && Solidity

Job 8:7

[Pherm @realpherm]

Sicut habent parum fidai

[Category Labs @category_xyz]

https://t.co/Z2EBag3Igd

[Pherm @realpherm]

@ZeroCool_AI its assuming the debt token and the collateral token are the same
and again reducing the collateral balance to the grossseize, if the grossseize is greater than the collateral it will sent the grossseize to the collateral since it already reduce the collateral no fee will sent

[pkqs91 @pkqs91]

https://t.co/Ae4Pbk32vZ

[Pherm @realpherm]

@Mrbankstips first we need to uncover what conciousness is about, i think AGI research will make us understand how conciousness works. if we can uncover that i think with time we can discover time travel

[Pherm @realpherm]

dont say you have failed unless you have tried 10000 times

[Pherm @realpherm]

@Huntoor alright thanks

[Blckhv @blckhv]

If someone says they don’t get the meaning of:

“I’ve failed more today than you’ve tried in your lifetime.”

Introduce them to Web3 Security. 🤝

[Sigma Prime @sigp_io]

AI is just a tool, an extremely powerful tool.

But human expertise and intuition is what turns it into a massive security advantage.

Deep dive here - https://t.co/3G5lKGJZkj

[0xfirefist @0xFireFist]

This is your reminder to start combining different skills.

[Yi @SuplabsYi]

1/ Recently, I found a critical vulnerability in @provenancefdn that could turn a metadata scope ownership denom into an infinite mint primitive, and also produce a deterministic chain halt.

[Pherm @realpherm]

But I'm still here
The bar has been raised. That's not a reason to stop. It's a reason to level up

[Pherm @realpherm]

I started my journey as a security researcher about a year ago, and honestly, a lot has changed
Nobody talks about the mental struggle been SR
There are days I want to quit,
AI has changed the game. Bugs that would've been valuable a year ago are now being found at scale

[Pherm @realpherm]

The bar is higher, contests are tougher, and novel bugs matter more than ever

[Pyro @0x3b33]

https://t.co/YRlPw7TX5x

[Pherm @realpherm]

@shealtielanzz @immunefi Huge mehn congrats

[Prof. Feynman @ProfFeynman]

Understand. Don't memorize.
Learn principles, not formulas.

[Pherm @realpherm]

how bad do you want it

[Omišanin @Omisanin0]

Got a lot of DMs after the Immunefi post asking for advice on web3, security, careers, etc.
Thank you all, but unfortunately I don’t have time to reply to everyone individually.

Still, there’s one story I really want everyone to hear:
A young man once came to Socrates and said he wanted knowledge. Socrates took him to the sea, pushed his head underwater and held him there. When he finally let him up, the young man was gasping desperately for air.
Socrates said:
“When you want knowledge as badly as you wanted air just now, then you will get it.”

The same applies to web3, smart contract auditing, security, or anything else.

There are no shortcuts. If you truly internalize this story and want knowledge that much, I believe you will succeed.

[BengalCatBalu😽 @BengalCatBalu]

It takes real mental toughness to choose web3 security as your path in the current market.

The fact that many people — even very experienced auditors — are finding it harder to get work is undeniable.

For newcomers it's worse. Contests (if any) and bug bounties are flooded with AI submissions that drag judging out for weeks. And that's before the mental pressure of sitting in a contest with ~3k findings, where staying in the chair to the end is itself a test of resilience.

You could justify all of this if protocols were getting safer and hacks were going down. The opposite is true. The field is in a transitional state — the mechanisms for working well alongside AI aren't built yet, and a lot of researchers are operating under pressure that does nothing for their actual output.

So what can each researcher do individually? First, accept the rules of the game and decide honestly whether you're ready for them. The space is more competitive than it has ever been, and only genuinely effective work will be worth paying for.

If that doesn't stop you, start doing something about it. Improve your audit workflow. Study harder things. Spend more hours sitting with the codebase. Do your maximum to be useful, because nothing less clears the bar anymore.

None of this guarantees success. It only maximizes your chances of it. A 100% guarantee doesn't exist, and being at peace with that is part of the job.

[Dimitar Tsvetanov @cvetanovv0]

Times have changed