SHERLOCK

6.6K posts

SHERLOCK banner
SHERLOCK

SHERLOCK

@sherlockdefi

Complete Lifecycle Security for Web3 Protocols

Katılım Şubat 2021
1.6K Takip Edilen26.3K Takipçiler
Sabitlenmiş Tweet
SHERLOCK
SHERLOCK@sherlockdefi·
Why do leading Web3 teams choose Sherlock for auditing and security? Sherlock compounds insight across collaborative audits, contests, bug bounties, and AI review. That leads to stronger findings, tighter fix validation, and fewer blind spots from pre-deploy review through production. Connected security performs better than isolated point-in-time audits. Stop wasting time with firms that dump a report on your desk and disappear.
English
3
5
58
568K
SHERLOCK
SHERLOCK@sherlockdefi·
Did you know? Sherlock AI now lets teams query specific vulnerabilities and see how new repos, branches, or commits may affect the greater protocol. It becomes your security reference point for your team while building and shipping, so you're not starting from zero every time you launch an upgrade. Watch the workflow: > review findings > query specific vulnerabilities > understand downstream impact > ship faster and better code
English
2
1
8
569
Hyli
Hyli@hyli_org·
We’re co-hosting an invite-only event with @sherlockdefi and @Lombard_Finance on April 1. We’re bringing builders across security, infrastructure, and DeFi to compare notes on what it takes to make onchain finance trustworthy at scale.
Hyli tweet media
English
5
0
10
312
SHERLOCK
SHERLOCK@sherlockdefi·
Meet the new Sherlock brand kit page. Logos, marks, colors, and assets all in one place. Everything you need to use the Sherlock brand right. 👉 sherlock.xyz/brand-kit
English
0
1
8
896
SHERLOCK
SHERLOCK@sherlockdefi·
Attention security researchers: the @MidasRWA bug bounty is now live on Sherlock! $500,000 in rewards are on the table for valid findings - If you hunt RWA focused protocols, this one is worth jumping in to.
GIF
English
3
0
29
2.2K
SHERLOCK
SHERLOCK@sherlockdefi·
@moo9000 Thanks for the recognition of our superior auditing model 🫡
English
0
0
0
223
Mikko Ohtamaa
Mikko Ohtamaa@moo9000·
THE RESOLV HACK AND LESSONS NOT LEARNT This time, the damage was 100% self-caused and avoidable. Resolv $50M + $30M mint was "unauthorised" meaning its private key was compromised, good old North Korean style. The wrong kind of Kimchi premium could have been easily prevented. This was not markets going wrong, prices dipping, collateral becoming useless. This was simply caused by incompetence, a classical shotgun into your foot style kind of stupidity. Now, for 13 years, since 2013, when multisigs were added to Bitcoin, we have known how to avoid unauthorised private key usage: - Not to use a private key in the first place, but use a multisignature wallet - Use Hardware Security Module (HSM) with additional protections for the signing process But why did Resolv do this?? It is not exactly rocket science. WHAT CAUSED THE UNAUTHORIZATION "SERVICE_ROLE is a privileged role in Resolv's USR protocol contracts (part of the two-phase request/complete mint/swap flow). There is no detailed official documentation from Resolv explaining its purpose, security model, assignment process, or risks. It is mentioned nowhere in the public litepaper, user docs (docs.resolv.xyz), or the GitHub README." (Quote by Grok) AUDITED 18 TIMES Why didn't Resolv catch this despite multiple audits? Because auditors, outside rare cases like @sherlockdefi do not care if the project gets hacked or not. They do not take any kind of responsibility for a deployed system. No skin in the game. Just cash payment, and "code looks good." And even then, all of these auditors failed to flag this obvious thing. We have this SERVICE_ROLE that can mint unlimited amounts of our stablecoin, NOT DOCUMENTED ANYWHERE. Come on, man! "This all-powerful private key in the system", but if you pay us our little fees, your SOFTWARE is good, we do not really care what happens afterwards. Just don't hold it wrong, m'kay? INVESTED BY COINBASE, PRAISED BY STEAKHOUSE Brian's seal of approval did not help either. Only six days ago, Steakhouse wrote this in their Steakhouse Financial Insights: "Operationally, Resolv demonstrates institutional rigor through third-party custody, multi-oracle redundancy, and programmatic safeguards. Resolv has operated without incident to date and has demonstrated self-correcting behavior under adverse conditions" kitchen.steakhouse.financial/p/resolv-usr This is so hand-wavey that it could be an ISO 9001 quality audit report as well, by failing to name the actual systems, processes, and their properties. "I went for lunch with the guys, and after a glass of French red wine, I was shure the system is good." Third-party custody? Does this mean they used Fireblocks to secure the private key? A private key wallet written by an ex-Mossad agent is still a private key wallet, and even more risky because the key is likely stolen by your closed source software-as-a-service provider directly, as you cannot know how rotten their software is inside. HOW TO AVOID THESE IN THE FUTURE It is not that hard. Especially with $10M seed money and a peak of $500M at stake, one can easily do better. 1. Less privileged private keys 2. Use skin-in-the-game auditors 3. Transparency and follow the way of decentralised finance HOW CAN YOU AS A DEFI USER TO AVOID THESE INCIDENTS This is a tricky one. The problem is that the underlying smart contracts are written in Solidity, a hodgepodge homebrew language. It's very hard to reason about the security properties of Solidity smart contracts. There are better languages, but it seems we are stuck with legacy Solidity. Despite Solidity's well-known flaws, there has been little actual effort to make it safer by looking past incidents and having someone paid to figure out how to pluck these holes at the language level. AI is going to help a lot. Because we haven't been able to hold security auditors accountable, as their staked reputation doesn't seem to correlate with the hacks, the way forward is to get rid of security auditors. One day, and very soon, anyone will be able to point an AI agent to a complex deployed smart contract system, and it will give you a thumbs-up or thumbs-down report. On this topic, I already did a small pilot here github.com/tradingstrateg… and Claude Code was able to pick a priviledged private key in one of our partners system on a deployed smart contract that should not have been there. Ps. For HSM: You do not have any of the other commercial opaque crap to secure your critical private keys. If you are building security-critical smart contract systems that need an offchain highly trusted private key, you can use Google Cloud for this. Here is our free and open source Ethereum signing module for Google Cloud: #module-eth_defi.gcloud_hsm_wallet" target="_blank" rel="nofollow noopener">web3-ethereum-defi.tradingstrategy.ai/api/core/_auto… - just remember to set the organisation policies accordingly. Kudos to @zacodil and @omeragoldberg for the research.
Mikko Ohtamaa tweet mediaMikko Ohtamaa tweet media
English
17
6
60
9K
SHERLOCK
SHERLOCK@sherlockdefi·
“If you are trying to exploit an L2, you have many more ways to exploit the ZK side than the smart contract side. It just gets exploited less often because ZK is much more complex.” @Mudit__Gupta, CTO of Polygon Labs, with Sherlock CEO @jack__sanford on AI bug finding, phishing as the starting point for many Web3 attacks, and where ZK risk may be underappreciated.
English
2
1
18
1.9K
SHERLOCK
SHERLOCK@sherlockdefi·
There’s a lot of misinformation floating around about Resolv’s recent hack. The team has shared an official update here for anyone looking for the source.
Resolv Labs@ResolvLabs

This notice is issued on behalf of Resolv Digital Assets Ltd. in relation to the Resolv protocol. Earlier today, a malicious actor gained unauthorized access to Resolv infrastructure through compromised private key, resulting in the minting of approximately $80M of uncollateralized USR. A full post-mortem is currently in progress and will be shared once completed. The incident was identified quickly, and the relevant smart contracts were promptly paused. Approximately 9M USR held by the attacker has since been burned in order to reduce the potential impact. The protocol currently holds approximately $141M in assets, with the only realized impact identified to date being approximately $0.5M in redemptions processed prior to the pause. Current USR supply consists of 102M pre-incident USR and approximately 71M newly and illicitly minted tokens. As an initial step in the recovery process, we are preparing to enable redemptions for all pre-incident USR, beginning with allowlisted users. The current target start date is 23 March 2026. Affected users should coordinate directly with RDAL through official channels. This incident resulted from unauthorized third-party actions, including a targeted infrastructure compromise and cyberattack. Resolv’s underlying collateral was not directly compromised. We are actively:  • tracing and seeking to contain illicitly minted USR and other affected assets  • coordinating with partners and counterparties  • working with law enforcement and onchain analytics firms to identify those responsible We will pursue all available avenues to recover assets and hold those responsible accountable. We strongly advise against trading USR or related Resolv tokens at this time while recovery measures are being implemented. Actions of users during post-exploit period may affect the recovery. Further updates regarding illicit USR, and RLP will be communicated in the near term.

English
0
0
22
3.5K
cap
cap@capmoney_·
Security at Cap runs deep. Along with 6 completed audits, our layered, proactive approach includes: 🔒 Quarterly Audits (upcoming one from @cantinaxyz) 🕵️ @sherlockdefi bug bounty program 🛡️ @octane_security ai-native code analysis 🔍 @HypernativeLabs on-chain threat detection
cap tweet media
English
13
6
66
10.6K
SHERLOCK retweetledi
SHERLOCK
SHERLOCK@sherlockdefi·
Who’s going to EthCC? 👀 On April 1 from 7:00–10:00 PM, Sherlock is hosting an invite-only side event in Cannes with @Lombard_Finance and @hyli_org. Founders, leading protocol teams, senior researchers, and top auditors coming together for a night of sharp conversation, drinks, and a panel worth showing up for. If you’re in Cannes for EthCC, request to join here: luma.com/397vh9td
English
4
6
43
6.9K
Current
Current@CurrentSUI·
The firms behind the security of billions dollars on DeFi just went through every line of our code. We gave them full access and told them to break it. They couldn't. ✓Full audit @AsymptoticTech @MoveBit_ ✓Formal verification @AsymptoticTech ✓Penetration test @MoveBit_ ✓Audit contest @sherlockdefi
English
7
6
42
2.6K
SHERLOCK
SHERLOCK@sherlockdefi·
We just published the full Aave x Sherlock case study on our brand new case studies section of our website. Read it here 👇 sherlock.xyz/case-studies/a…
English
1
0
4
656
SHERLOCK
SHERLOCK@sherlockdefi·
The @aave team partnered with Sherlock across the V4 upgrade through three major phases: a multi-phase collaborative audit with Blackthorn, a $365K audit contest, and a bug bounty to protect live code after launch. For one of the biggest architectural shifts in Aave’s history, the margin for missed issues was basically zero. Sherlock was brought in to go deeper on the parts of V4 that were entirely new, especially the Hub-and-Spoke architecture + risk premium system.
SHERLOCK tweet media
English
8
13
93
97.5K