Robert Chen

Lots of work happening in the background⚓️

@_mwc @SolanaFndn congrats!

Big Update for me - a new chapter and I'm now CISO of @SolanaFndn . I've always been drawn to fast moving new frontiers. Head of Security of Mozilla during the height of the browser wars, the first CISO of Twitter as they burst onto the world's stage, and even as a startup founder innovating on data security for enterprise SaaS as cloud deployments skyrocketed. Years ago through the acquisition of our startup, Altitude Networks, to CoinList I found my way into crypto. I'm excited to share that I'm continuing the crypto adventure as CISO of Solana Foundation. Why Solana? This is the chain doing tens of billions of dollars in stablecoin volume a day. It's the chain where SpaceX's tokenized shares went live the same day as its Nasdaq debut. It's processing more transactions daily than most of crypto combined. Solana is establishing itself as the future of financial infrastructure, at massive scale. Now, this is not without its challenges. I'm keenly aware of the adversaries' incentive to separate people from their crypto. I'm aware of the rising threats from malicious use of AI (something I testified to Congress about earlier this year), and the massive power for defense when harnessed effectively. And I’ve felt the push and pull when innovative new approaches meet established traditional businesses. I'm thrilled to work across the foundation and the entire Solana ecosystem to help tackle these challenges head on. That means building security into this industry, from operational and appsec fundamentals to the crypto-specific challenges, working with policymakers and standards bodies to get cybersecurity regulation right, and bringing the lessons and battle scars I've picked up along the way. Innovation is messy and security is hard. This is the nexus where I enjoy working to solve the hardest challenges alongside the smartest folks around the world. Onward!

I have been working on this blog post for an embarrassingly long time. While the thought of CTFs depressed me during most of this time period, I'm more hopeful now. I think what made the scene so beautiful to me will persist. I can't wait to show you all what we have in store.

also, big shoutout to @_mixy1 @enscrbe for helping get this over the line. this blog was 4 months in the making! x.com/_mixy1/status/…

Read the blog post here: osec.io/blog/save-ctfs…

We're launching a $100,000 fund to save CTFs.

ctf is back

@zeyu1337 @S1r1u5_ @rootxharsh hacktron.ai/open-source/

Anchor is secured by @HacktronAI Thanks to their open source program, all PRs get 24/7 coverage for security issues

GPT 5.6 Solana

is this the first working decompiler in a blog post? from @marspiterr's recent deep-dive on Hyperliquid

the latest tornado cash proposal 67 is _malicious_: https://bafybeie5hxovqc4ifcnrnhvmjbefxgeix6oqvzaspyytdxiyscji22v5pu[.]ipfs[.]inbrowser[.]link/governance/67 decompilation of the proposal: app.dedaub.com/ethereum/addre… the try to set the governance address to a vanity address that looks almost like the governance address: - spoofed version: `0x5EFDa50f22D34F272c7077689d6ABc42F15E285f` - real governance address: `0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce` same for the staking governance proxy: - spoofed version `0x2fc93484614a34f7dbf98d7f7e997f6424e54a32` - real staking address: `0x2FC93484614a34f26F7970CBB94615bA109BB4bf` furthermore, worth mentioning the function `nullifyBalance` checks against the spoofed governance address above; so whoever controls that vanity address can zero out any relayer's balance at will. this is a governance attack on Tornado Cash and i ask all TORN tokenholders to reject this proposal

Proud to sign the OPSeC pledge We need more coordination to address structural cybersecurity problems in blockchain

Related: we're looking for sponsors to cover our tokens We (.@SuperDiceCode) won DEFCON quals this year, and will be headed to our 6th DEFCON finals DMs open! x.com/NotDeGhost/sta…

When Hyperliquid has to clear bad debt, who covers it? We reverse-engineered the closed-source risk engine, verified some core properties & compared it to other perps. It's not neutral: the more leveraged and profitable your position, the sooner it's closed. Full breakdown ↓

Fixed soon on Anchor nightly (h/t @clubby789)