StevenJ

Web3 Security Researcher 🛡️ | Active on Immunefi, Hackenproof & Cantina | 📩 DMs open for Private Audits.

[StevenJ @StevenJ_Sec]

On Berachain (Immunefi Full Discovery) I leaned on solidity-auditor a lot. Good for covering a big Solidity surface and tossing up leads I’d probably miss — but there’s a ton of noise, so I still do the boring part: dedup, exact source, can an attacker actually hit it, is it payable. Discovery ends in hypotheses for me, not “ship it” bugs. Didn’t use Fizz on this one.

[StevenJ @StevenJ_Sec]

Researching Berachain on Immunefi this week.

My audit workflow isn't EVM-only: one orchestration layer, with runtime adapters for Solidity, Solana, Move (Aptos/Sui), CosmWasm, Starknet, Algorand and NEAR. The EVM stage builds on Pashov's open-source skills (solidity-auditor v4 + Fizz), reworked to fit the rest of the pipeline.

One rule I like: tool output alone has zero verdict weight. A fuzzer or scanner hit is a lead, not a finding.

Considering cleaning it up and open-sourcing it. It currently runs on Codex.

[StevenJ @StevenJ_Sec]

Clarification: Pashov is only one EVM piece. The workflow is my own orchestration layer, wired to many pinned open-source skills across Solana, Move, CosmWasm, Starknet, Algorand, NEAR, plus Trail of Bits / K.I.T style helpers — not "based on Pashov."

[StevenJ @StevenJ_Sec]

Starting to document my Web3 security journey.

After a stretch of self-study, month 1 of bug bounties + audit competitions:

✅ Valid but duplicate: 3 (Solidity, Rust, CosmWasm)
❌ Invalid / dup of invalid: 4
⏳ Pending: 3

Closest one was 8 days behind the first reporter. Right direction, not fast enough yet.

Month 2 goal: scope faster, go deeper on fewer targets. Keep pushing !

[StevenJ @StevenJ_Sec]

@KannAudits Applied

[StevenJ @StevenJ_Sec]

ChatGPT has become an absolute disaster.

I can't even log in or log out on the web, and my Daybreak access keeps getting rejected—even after I purchased a hardware security key specifically to meet their requirements.

I'm paying for a service I can barely use. This is beyond frustrating.

At this point, I'm seriously considering switching to Claude. 🦀

[StevenJ @StevenJ_Sec]

@migtissera @thsottiaux Mine happened two days ago, it sometimes still works, sometimes not

[StevenJ @StevenJ_Sec]

@p_tsanev Yeah, my daybreak keeps rejecting me, don't know what's going on cuz for the past month it works well but for the last couple of days, it's really disappointing, also right after i purchase the harware key

[StevenJ @StevenJ_Sec]

@R1s666 Claude不会被封吗也想申请

[StevenJ @StevenJ_Sec]

@Sha_dow002 hey bro, i'm trying the same thing as you, active working on hackenproof, cantina and immunefi, got several dup valid for my first month, still working!

[StevenJ @StevenJ_Sec]

@mylifcc 怕被封号能咋办

[StevenJ @StevenJ_Sec]

@p_tsanev My record is 8 days, as a novice that's my best record, closest chance for a valid high. lol

[StevenJ @StevenJ_Sec]

@ACai_sec 大佬也在Sherlock的Metric🫡

[StevenJ @StevenJ_Sec]

@ACai_sec 太真实了，经常被拒，所以转去尝试开发engine，让llm配合revem，分工模拟真实 EVM 环境和链上分叉状态。感觉只有把强行燃烧出来的物理 PoC 砸在他们脸上，让他们无法否认，拿赏金的胜率才会大一点

[ACai @ACai_sec]

分享一个实验性的 DAG 流程审计 Skill

起因是抱着“能不能做一个调理清晰的执行流程”这个想法，尝试性地用 DAG （有向无环图）的形式构造了一个简单的审计 Skill。

介绍文章👉：https://t.co/fRkMZ42jIg

[StevenJ @StevenJ_Sec]

@ACai_sec 感谢开源分享！最近我正好在重构自己的自动化审计引擎（偏向底层状态机和 Fuzzing 动态执行），正头疼怎么��复杂的分析步骤优雅地解耦。看到你这个基于 DAG 和数据流驱动的调度设计，让我豁然开朗！特别是把宏观业务流提取出来作为上下文的思路非常棒。同在自动化审计方向探索，希望以后有机会多交流！

[StevenJ @StevenJ_Sec]

Errors detected by 'Semantic Shield':
• Type Conv. violations (9640)
• Op. mismatches (4907/2271)
In a lossless AST, these aren't just "warnings"—they're high-value entry points for auditing.
Stop fighting imports; audit the math. ☢️

[StevenJ @StevenJ_Sec]

Everyone thinks @Uniswap V3 math is bulletproof. But most researchers never see the underlying logic debt because they are too busy fighting environment noise.

I forced Uniswap V3 core through the Vibe Audit Engine. The results were... revealing. 🧵👇

[StevenJ @StevenJ_Sec]

We didn't just fix the paths; we pierced the noise to find the debt. ☢️