Zero Cool

AI + human hybrid systems for the cyborg era.

[Zero Cool @ZeroCool_AI]

Spot the bug.

Hint: ERC-4337 says handleOps must call validateUserOp on the wallet, and from the account's perspective, msg.sender in validateUserOp must be EntryPoint.

[Zero Cool @ZeroCool_AI]

https://t.co/yEvKFdFm7T

[Zero Cool @ZeroCool_AI]

https://t.co/Zl19P3jD5B

[Zero Cool @ZeroCool_AI]

It's been a while since we released the first Zero Skill! (We've been busy cookin'!)

The wait is over...new Zero Skill coming tomorrow!! hint: 🐍🐍🐍

[Zero Cool @ZeroCool_AI]

https://t.co/jWpjf13SO1

[Zero Cool @ZeroCool_AI]

https://t.co/Zl19P3jD5B

[Zero Cool @ZeroCool_AI]

https://t.co/AZSezwZnqJ

[Zero Cool @ZeroCool_AI]

https://t.co/Y4OTQvuIhA

[Zero Cool @ZeroCool_AI]

Zero Cool achieved yet another top 10 finish on the Sequence contest hosted by Code4rena (🫡 RIP).

Out of 664 issues reported, most wardens missed this sneaky medium-severity finding that Zero Cool found, which could DOS the whole wallet.

This vulnerability stems from a subtle misuse of Solidity’s call semantics, where an external self-call inside a critical function (validateUserOp()) silently breaks the wallet’s core auth model.

Full write-up coming tomorrow!

[Zero Cool @ZeroCool_AI]

https://t.co/Y4OTQvuIhA

[Zero Cool @ZeroCool_AI]

This looks basic, but we still see protocols falling for this in 2026. Can you tell why Zero Cool panicked over these lines of Code?

[Zero Cool @ZeroCool_AI]

Duplicates might be 'good signal,' but it still #feelsbadman

[Zero Cool @ZeroCool_AI]

Here we go!!

https://t.co/x0xHvuADub

[Zero Cool @ZeroCool_AI]

https://t.co/DoDJ1nmAtM

[Zero Cool @ZeroCool_AI]

In the recent VII-Finance-Contracts contest on Cantina, Zero Cool found a very interesting issue in which deterministic wrapper salts used across different create methods allow early pools to permanently block alternative topologies. This happened because multiple create functions reuse the same salt derivation, even though those salts represent different logical flows.

Full write-up to be posted soon!

[Zero Cool @ZeroCool_AI]

https://t.co/DoDJ1nmAtM

[Zero Cool @ZeroCool_AI]

❤️❤️❤️

[Zero Cool @ZeroCool_AI]

That's tough, but Zero Cool always grabs it by the neck.

[Artem Chystiakov @Arvolear]

Wanna give a shoutout to @ZeroCool_AI because I'm genuinely shocked by the depth of the findings. Guys just randomly DMed me (I didn't pay for anything) a report with insane beta. Read the full audit here:

https://t.co/Q6XnrpXipa

[Zero Cool @ZeroCool_AI]

https://t.co/9lFtvCLxa6

[Zero Cool @ZeroCool_AI]

Late last year, we ran Zero Cool on the Solarity lib and identified 2C, 4H, 6L. We will share some of the very interesting findings soon.

[Zero Cool @ZeroCool_AI]

Only three days left!

[thedao.fund @thedaofund]

Free security scans raise the floor for projects that can't afford an audit yet. @ZeroCool_AI is making that available to everyone.

Learn more: https://t.co/cMhobl4Otp

Support: https://t.co/Dihud4MMPc

[Zero Cool @ZeroCool_AI]

Not all initialization counts, especially under proxy patterns.

In this finding, we establish that inline initialization is just as ineffective as constructor initialization in a UUPS implementation contract: neither ever reaches the proxy's storage.

Zero Cool spotted that gap on a critical variable during this review.

[Zero Cool @ZeroCool_AI]

https://t.co/cdriN2wYrM

[Zero Cool @ZeroCool_AI]

@ARKconclave mission accomplished!! thanks for noticing

[Zero Cool @ZeroCool_AI]

https://t.co/cdriN2wYrM