Turvec

Security Researcher @quillaudits_ai I Smart Contract Audit | @chainlink DevExpert
Learning & acquiring knowledge consistently

[Turvec @turvec_dev]

🥇 secured 1st place in the MorpheusAI contest! 🥇congrats to all and let's keep improving 💪 with the aim of making the web3 ecosystem safer.

[Cyfrin CodeHawks @CodeHawks]

Awards have been announced for the MorpheusAI contest🤝

Top 5:
🥇 @turvec_dev - $2664.89
🥈 SovaSlava - $2530.1582328058903
🥉 @0xhals - $2068.79
🏅 @mrpotatomagic - $1952.28
🏅 @iamandreiski - $1908.08

(1/2)

[Turvec @turvec_dev]

@ubong_ephraim Yoo @ubong_ephraim! Thank you

[Turvec @turvec_dev]

We hosted "Unlocking Web3 in Nairobi" last month — and it was everything 🔥

Devs, students, and builders packed the Blockchain Centre NBO to learn about how blockchain's core fundamentals work, the career opportunities in Web3, and what it actually means to build on-chain.

Huge thanks to everyone who showed up and @Chainlink for making it happen.

The energy in Nairobi's Web3 scene is REAL. This is just the beginning 🇰🇪

[Preetam📍NYC 🇺🇲 @raopreetam_]

Audited once. Scanned by a leading AI tool.

Still had 15 bugs hiding inside.

@QuillAudits_AI found them. High severity. Medium severity. Manually and with QuillShield.

The bar just moved. @turvec_dev @phoenix244001

[Turvec @turvec_dev]

Spent the morning reading StarkWare's Quantum Secure Bitcoin (QSB) proposal. Wild concept.

It protects BTC from quantum attacks without a soft fork by replacing ECDSA with hash-based puzzles. Cost? $75–$200 per transaction and hours of GPU compute.

Not a daily-use fix. More like cold storage for the post-quantum era. The attack surface around signature schemes is about to get very interesting. 👀

[Francesco Andreoli ᵍᵐ @francescoswiss]

North Korea didn’t hack crypto.

They hacked people, hiring funnels, signing flows, and trust.

Security in 2026 = wallets, UI, RPC, ops, and human training.

Everyone should study THIS playbook.

S/O to @QuillAudits_AI for the visual

[Turvec @turvec_dev]

Profanity vulnerability:

- Profanity seed space = 2^32 (uint32)
- An attacker can brute-force all seeds on a GPU in minutes, $3.3M stolen

- Real private keys should have 256-bit entropy

Always verify the generator's source code. Minimum acceptable seed: 128 bits of true randomness.

[Turvec @turvec_dev]

@victorokpukpan_ @QuillAudits_AI Yeah 🔥

[QuillAudits 🥷 @QuillAudits_AI]

Today marks 8 years of QuillAudits.

Most Web3 security firms didn't exist 8 years ago. Most won't exist 8 years from now.

We've built through 3 bear markets, 2 exploit waves, and the full evolution of smart contract attacks from simple reentrancy to cross-protocol economic exploits.

1,500+ protocols. $3B+ protected.

The biggest lesson from 8 years and 1,500+ engagements :

One team, one method, one pass doesn't cut it when you're protecting hundreds of millions in user funds.

So we rebuilt the model.

Multi-Layer Audit → four independent security layers, delivered in the same timeline as a traditional audit:

> Senior auditors who've collectively reviewed 1,500+ protocols
> AI security agents trained on 5,000+ real exploits since 2017
> Independent bug bounty through curated security researchers
> Continuous monitoring, because threats don't stop at deployment

4 layers. Each one catches what the others miss.

Web3 has a $100T addressable market if institutions show up. They won't show up until security is embedded in every layer, every transaction, every deployment, the way HTTPS is embedded in the internet.

That's the problem worth solving for the next 8 years.

QuillAudits built the foundation, QuillShield is the next chapter — an AI security agent that brings what we learned from 1,500+ manual audits into every developer's workflow, before code ever hits mainnet.

8 years in. Still early.

[Turvec @turvec_dev]

@RealJohnnyTime DOS on any user, their stake about to unlock? increase time again by another 30 days by calling stake() on the user address with an insignificant amount

[Turvec @turvec_dev]

Excited to be part of the first in-depth Protocol Developer Cohort by BloK Capital 🚀

[Blok Capital @blok_cap]

250+ registrations and now the doors are closed.

Congratulations to everyone who secured a spot.

The journey with BLOK Capital is just getting started. More opportunities and updates ahead.☘️

[Turvec @turvec_dev]

"risk reduction through redundancy on high-risk intents" - same pattern found in 2-step authenticators.

Also, lesser divergence = more secure

[vitalik.eth @VitalikButerin]

How I think about "security":

The goal is to minimize the divergence between the user's intent, and the actual behavior of the system.

"User experience" can also be defined in this way. Thus, "user experience" and "security" are thus not separate fields. However, "security" focuses on tail risk situations (where downside of divergence is large), and specifically tail risk situations that come about as a result of adversarial behavior.

One thing that becomes immediately obvious from the above definition, is that "perfect security" is impossible. Not because machines are "flawed", or even because humans designing the machines are "flawed", but because "the user's intent" is fundamentally an extremely complex object that the user themselves does not have easy access to.

Suppose the user's intent is "I want to send 1 ETH to Bob". But "Bob" is itself a complicated meatspace entity that cannot be easily mathematically defined. You could "represent" Bob with some public key or hash, but then the possibility that the public key or hash is not actually Bob becomes part of the threat model. The possibility that there is a contentious hard fork, and so the question of which chain represents "ETH" is subjective. In reality, the user has a well-formed picture about these topics, which gets summarized by the umbrella term "common sense", but these things are not easily mathematically defined.

Once you get into more complicated user goals - take, for example, the goal of "preserving the user's privacy" - it becomes even more complicated. Many people intuitively think that encrypting messages is enough, but the reality is that the metadata pattern of who talks to whom, and the timing pattern between messages, etc, can leak a huge amount of information. What is a "trivial" privacy loss, versus a "catastrophic" loss?

If you're familiar with early Yudkowskian thinking about AI safety, and how simply specifying goals robustly is one of the hardest parts of the problem, you will recognize that this is the same problem.

Now, what do "good security solutions" look like?

This applies for:

* Ethereum wallets
* Operating systems
* Formal verification of smart contracts or clients or any computer programs
* Hardware
* ...

The fundamental constraint is: anything that the user can input into the system is fundamentally far too low-complexity to fully encode their intent. I would argue that the common trait of a good solution is: the user is specifying their intention in multiple, overlapping ways, and the system only acts when these specifications are aligned with each other.

Examples:

* Type systems in programming: the programmer first specifies *what the program does* (the code itself), but then also specifies *what "shape" each data structure has at every step of the computation*. If the two diverge, the program fails to compile.
* Formal verification: the programmer specifies what the program does (the code itself), and then also specifies mathematical properties that the program satisfies
* Transaction simulations: the user specifies first what action they want to take, and then clicks "OK" or "Cancel" after seeing a simulation of the onchain consequences of that action
* Post-assertions in transactions: the transaction specifies both the action and its expected effects, and both have to match for the transaction to take effect
* Multisig / social recovery: the user specifies multiple keys that represent their authority
* Spending limits, new-address confirmations, etc: the user specifies first what action they want to take, and then, if that action is "unusual" or "high-risk" in some sense, the user has to re-specify "yes, I know I am doing something unusual / high-risk"

In all cases, the pattern is the same: there is no perfection, there is only risk reduction through redundancy. And you want the different redundant specifications to "approach the user's intent" from different "angles": eg. action, and expected consequences, expected level of significance, economic bound on downside, etc

This way of thinking also hints at the right way to use LLMs. LLMs done right are themselves a simulation of intent. A generic LLM is (among other things) like a "shadow" of the concept of human common sense. A user-fine-tuned LLM is like a "shadow" of that user themselves, and can identify in a more fine-grained way what is normal vs unusual.

LLMs should under no circumstances be relied on as a sole determiner of intent. But they are one "angle" from which a user's intent can be approximated. It's an angle very different from traditional, explicit, ways of encoding intent, and that difference itself maximizes the likelihood that the redundancy will prove useful.

One other corollary is that "security" does NOT mean "make the user do more clicks for everything". Rather, security should mean: it should be easy (if not automated) to do low-risk things, and hard to do dangerous things. Getting this balance right is the challenge.

[Turvec @turvec_dev]

In @solana using Anchor, accounts are usually written like this 👇

Anchor will:
bytes → deserialize → modify → serialize back.

But some teams implement this instead 👇

And use AccountLoader<T> instead of Account<T> in the context 👇

Now you’re working directly on account memory.

No deserialization.
No copying.
Lower compute.

⚠️ What does this mean to auditors:

Struct layout is now part of your security surface.
Bad upgrades or padding mistakes = silent corruption.

Zero-copy is powerful…
but you’re one step closer to raw memory.

[Turvec @turvec_dev]

@Pelz_Dev Saw a video where they are already teaching them Shaolin in China 🥲

[QuillAudits 🥷 @QuillAudits_AI]

Dropping Claude Skills to speed up smart contract audits with structured AI workflows.

10 open-source Claude Skills that turn AI into a reasoning-driven audit companion:

→ Reentrancy Detector
→ Access Control Mapper
→ Oracle Risk Scout
→ Upgradeability Checker
→ MEV Pattern Watcher
→ Invariant Generator

[Turvec @turvec_dev]

@VitalikButerin Best post I've seen in a while

[Turvec @turvec_dev]

@Al_Qa_qa 🤝

[Turvec @turvec_dev]

Thanks for sharing, many seem to be unaware of this

[Al-Qa'qa' @Al_Qa_qa]

In Foundry tests, the gasLimit value used for txs is very high; it even exceeds the block gas limit and the tx gas limit.

Your test suite should limit the gas passed to txs that use gasLimited internal calls, or you will have 100% coverage, but in reality, it is not.

[Turvec @turvec_dev]

@SamuelXeus 21 right?

[Turvec @turvec_dev]

@zdravkohristov0 😂 I think we should audit the LLMs instead

[Turvec @turvec_dev]

@raopreetam_ Backup providers and migration to a new environment in the case of a failure are important here