silverologist

Security Researcher @cantinaxyz 🔍 | Will audit for treats 🐾

[silverologist @silverologist]

First time looking at Rust code 🦀

Thank you @cantinaxyz!

[silverologist @silverologist]

@abarbatei @immunefi Sounds like Stockholm syndrome

[silverologist @silverologist]

Great contribution to the Stacks ecosystem! 🔥

[Cyba Blockchain Security @CybaSecurity]

https://t.co/CAPoFWUIY7

[silverologist @silverologist]

Great summary for the week 💯

[Cyba Blockchain Security @CybaSecurity]

Last week in web3 security we saw several exploits. Two of them, plus two from a few days earlier, came down to a check nobody made.

Here is where each one broke and what we'd change:

🔹 Third-party MakerDAO ETH-A liquidation keeper: $538K loss (on @ethereum)

This third-party keeper, a dormant 2020 proxy, never settled four auctions it had won, and its drain function had no auth, so anyone could take the 200 WETH. The bug was not in MakerDAO core.

The lesson for anyone running a liquidation keeper is to put auth on every function that moves funds, even on a retired bot.

🔹 Third-party FlashLoopAdapter Safe module: $305K loss (on @ethereum)

On Oct 1, this third-party Aave v3 loop module trusted any caller claiming it was enabled, then called a router the caller chose, so a fake Safe drained two real ones.

If you're building a Safe module, you should check callers against Safes you track and never call addresses they supply.

🔹 GoldPesa: $114.9K loss (on @base)

On Oct 2, GoldPesa's own Uniswap v4 hook rebalanced inside the attacker's unlock without checking deltas were settled, so its burn credit paid off the attacker's unpaid mint.

Teams shipping a Uniswap v4 hook should require settled deltas before moving liquidity inside a caller's unlock.

🔹 Set Protocol: $13.7K loss (on @ethereum)

An old v1 contract, still holding collateral after the team deprecated V2 and TokenSets, let anyone call actualizeFee(), which rounded unitShares up with no fee taken, so issuing before and redeeming after paid out extra.

When building a rebalancing DeFi mechanism, make sure to round collateral per share in the protocol's favor.

All of them mentioned hacks were the result of misplaced trust and unbacked assumptions. The protocols never actually checked:
- who was calling
- whether the books were settled
- which way a number rounded

If you're building or running contracts like these, from Safe modules to Uniswap v4 hooks, we at Cyba can review them for you.

More on each hack in the reply below 👇

[silverologist @silverologist]

@Valistheaeth @CybaSecurity @AccountableData No worries ser 🐹

[silverologist @silverologist]

Once again, happy to work with @CybaSecurity on securing @AccountableData 🔥

[Cyba Blockchain Security @CybaSecurity]

@AccountableData It's been a pleasure continuing to work with a team that keeps security close to the development process.

Engagement details & full report ↓
https://t.co/0XnDVmibf2

Also, a new engagement is already underway, marking yet another step in our growing collaboration. More to come!

[silverologist @silverologist]

@Valistheaeth @CybaSecurity @AccountableData Triage girl maybe 💅

[silverologist @silverologist]

@abarbatei @immunefi Congrats! 🔥🔥

[silverologist @silverologist]

Honored to contribute to the safety of @AccountableData once again 🐾

[Cyba Blockchain Security @CybaSecurity]

We've completed our security audit for @AccountableData, reviewing a staking module extension to their DeFi vault infrastructure.

The team's fixes were also verified through a dedicated fuzz testing campaign.

More on the engagement:
https://t.co/JRuoob9atZ

[ABA @abarbatei]

For who maybe is not familiar with this attack vector, these use the .vscode autorun tactic.

In this case, the malware is added here:

https://t.co/o0BfginONB

https://t.co/5iaDp2tXRi

(report repo when you have time pls)

[silverologist @silverologist]

@heisenberg_btc @cantinasecurity @revertfinance Keep grinding and don't give up, nothing great comes easy💪

[silverologist @silverologist]

Quick side quest paid off 🥉

Thanks @cantinasecurity and @revertfinance!

[silverologist @silverologist]

@KalpShah_eth @cantinasecurity @revertfinance Thank you ser💪

[silverologist @silverologist]

@abarbatei @cantinasecurity @revertfinance Those are the most fun ones indeed😁

[silverologist @silverologist]

Proud to be part of this 🔥

[Cyba Blockchain Security @CybaSecurity]

1/2

We recently completed a security review for @GraniteBTC, a Bitcoin liquidity protocol built on @Stacks enabling users to borrow stablecoins against Bitcoin collateral through sBTC, developed by @trustmachinesco.

This engagement focused on reviewing fixes, hardening efforts, and protocol enhancements across the protocol’s lending system, covering changes across borrowing, liquidation flows, staking, governance, LP incentives, oracle integrations, withdrawal logic and related core functionality.

Granite combines Bitcoin-backed liquidity access with design choices such as isolated collateral, soft liquidations, and Bitcoin-native infrastructure.

Happy to support teams building BTCfi infrastructure. Always a pleasure working with security-oriented teams pushing the ecosystem forward.

[silverologist @silverologist]

@vitobotta @immunefi I don't think I'm allowed to share details at least not yet

[silverologist @silverologist]

My first confirmed bounty report on @immunefi yay 🐾
https://t.co/OkfI3ZgKuy

[silverologist @silverologist]

@abarbatei @base Cat memes are the best type of memes 🐾

[silverologist @silverologist]

Let's gooo 🔥 @base #immunefitribe https://t.co/6JeqfyMsr7

[silverologist @silverologist]

@pashov @CybaSecurity

[silverologist @silverologist]

Pround to be part of securing @AccountableData once again 🔥

[Cyba Blockchain Security @CybaSecurity]

We've completed our security audit for @AccountableData, reviewing an extension to their DeFi credit vault infrastructure.

Accountable is a key player operating at the intersection of DeFi and TradFi.

Their vault-based credit layer programmatically allocates capital across lending strategies, with over $160M deployed to generate risk-adjusted yield.

They are also building the Data Verification Network (DVN), a privacy-preserving infrastructure that verifies financial data directly at the source. It already secures $1B+ in assets across partners like Galaxy, Amber Group, and K3 Capital, positioning Accountable at the intersection of onchain finance and institutional reporting.

Security at this scale is never a one-off.