deth

Today was my last day @Certora. It was a fun ride — worked with many great people, audited the biggest DeFi protocols in the space, and learned more than I can fit in this post. I had the pleasure of working with many of the friends I made throughout the olden days of @code4rena and @sherlockdefi — when contests were the shit and the judging was too <3 Met some very talented, hard-working people like @tpiliposian , who posts more about his BJJ medals than his actual work 😁 And I was lucky to work under the guidance and mentorship of @BowTiedDravee — the best team lead anyone could ask for. He always had my back, no matter what. I consider you a true friend, brother. What will I do now? I thought about it, and it's time to dust off this old t-shirt from the closet and get back to work. We're back, stronger than ever. If you're a protocol in need of elite-level auditors — or a security agency in need of the best — you know where to find us. @EgisSec

reference issue #m-02-in-stable2lut1getratiosfrompriceliquidity-in-extreme-cases-updatereserve-will-start-breaking" target="_blank" rel="nofollow noopener">code4rena.com/reports/2024-0…

how to find convergence bugs > fuzz extreme ratios > log every iteration > track distance from the target > flag widening oscillation or a loop hitting its cap stopping is not the same as converging

day 3, no code started auditing the hotel's wristband access control

Touching grass (sand)

the public part of auditing is the report the private part is all the conversations behind it. technical, marketing, sales, and everything in between i've lost count of how many times @0x3b33 and @blckhv have helped me lately I'm very grateful to both of you

shoutout to my good friends @0x3b33 and @blckhv I've lost count of how many times they've helped me over the past weeks

@pashov Indeed

@dethSCA Spitting facts here, people still sleeping on this - someone needs to tell them🫡

before you pay anyone to audit your code, spend one afternoon doing this > run @pashov's solidity auditor (github.com/pashov/skills) > fix the bugs > run it again a lot of bugs can die for free nowadays, the rest are for auditors to find.

@0xDontonka Very nice, nice to do something else than stare at code all day

I've been 100% off web3sec for last few months to build the following project : alert.camp If you are around Canada and the US, and enjoy taking fresh air in nature, you might want to have a look, this service could help you getting nice camping spots. Unsure yet when I will be back to web3sec, for now pretty happy at full throttle on this new project 😄, it feels nice to be back building something concrete (owning it, not for a company xyz), and I'm really leveraging AI to develop this service, which was also one of the goal initially, to start learning to use Claude Code and similar product to understand the AI potential in developing a software product from A to Z, which in this case include a mobile app, backend, website, ops/infra work and the list goes on.

@kuprumxyz m'm not a judge, but this has been a very interesting read fascinating that you did all this on the fly, can't wait to see what you come up with

d) the pressure of not delivering what I mean is both delivering for the client and for my peers this mostly comes down to imposter syndrome and taking the job very seriously for us, it’ll be another audit, but for the client it’s basically life or death as for delivering to my peers, seeing as I always view whoever I work with as better than me, I push myself harder to make sure I can match their “skills” and findings + a bit of competitiveness as @MarioPoneder put it, it’s a character trait more than an incentive

An open-ended question for web3 security researchers. What makes you perform at your highest level on a private audit? a) Competition dynamics where issues are shared in the end and performance gets tracked (similar to leaderboards on competitive audits) b) Collaborative audits where you work with someone much more senior and you "want to prove yourself" c) An incentive-based system where you're paid (extra) based on your performance d) Other reasons

@MartinMarchev @deadrosesxyz Same, I barely hold anything rn Waiting for the discounts

@deadrosesxyz Well, unironically smart imo. I myself parked most of my portfolio in EUR MMFs. Getting paid to wait for actual discounts beats catching falling knives 🔪

bought some more at ~$64k. crypto portfolio is now 6-7%. hopefully we see some more dips and we get it to 15-20%

I was just writing an article on an old LayerZero bug I found and this happens…

your tests cover what you thought of. @EgisSec covers what you didn't.

my audit stack: > eyes > brain > every line guilty until proven innocent

@0xcuriousapple I haven’t opened it in years, this confirms there isn’t much point in going back

man I fucking hate linkedin recently activated it as i was told my some wise men that even if i hate it there still could be good inbound from there but still it doesn’t change that i hate it it was slop before, it is slop now, and will remain in future