Kalp

1. Deflation attack in @SiloFinance vault during a @code4rena contest Share = _assets.mulDiv(_newTotalSupply + 10^_decimalsOffset(), _newTotalAssets + 1, _rounding) What the problem here? totalAssets is based on redeemable market shares, but market rounding can cause an issue

@Ehsan1579 goat🥷

This one has a bit of story behind it. Less than 12h after the report was submitted, it was confirmed by the team. The team didn’t even try to argue about how catastrophic the impact was. They were fast responsive and professional and transparent with their users, something I really admired. They simply straight told me because of a large hack last year that they suffered from they’re struggling financially and they’re letting a lot of their people go. The direct impact was around 7 million dollars. They were honest and I like honesty so instead of the normal 700k bounty, I accepted the 300k, I don’t regret my decision and I hope the project bounces back even stronger during these hard times, I admire them and their security standards and I wish them the best.

Today marks 8 years of QuillAudits. Most Web3 security firms didn't exist 8 years ago. Most won't exist 8 years from now. We've built through 3 bear markets, 2 exploit waves, and the full evolution of smart contract attacks from simple reentrancy to cross-protocol economic exploits. 1,500+ protocols. $3B+ protected. The biggest lesson from 8 years and 1,500+ engagements : One team, one method, one pass doesn't cut it when you're protecting hundreds of millions in user funds. So we rebuilt the model. Multi-Layer Audit → four independent security layers, delivered in the same timeline as a traditional audit: > Senior auditors who've collectively reviewed 1,500+ protocols > AI security agents trained on 5,000+ real exploits since 2017 > Independent bug bounty through curated security researchers > Continuous monitoring, because threats don't stop at deployment 4 layers. Each one catches what the others miss. Web3 has a $100T addressable market if institutions show up. They won't show up until security is embedded in every layer, every transaction, every deployment, the way HTTPS is embedded in the internet. That's the problem worth solving for the next 8 years. QuillAudits built the foundation, QuillShield is the next chapter — an AI security agent that brings what we learned from 1,500+ manual audits into every developer's workflow, before code ever hits mainnet. 8 years in. Still early.

@Nilima_Nair03 @QuillAudits_AI 🥷🥷

8 today 🥷🚀 Building, Breaking, Securing with the #web3‌‌ fam 💪 #QuillsTurn8 @QuillAudits_AI

@FirepanHQ @trailofbits @QuillAudits_AI @cyfrin @0xcastle_chain @0xKaden sure ser

@kalp_eth @trailofbits @QuillAudits_AI @cyfrin @0xcastle_chain @0xKaden Add Firepan to that list

As a smart contract security researcher, one trend blowing my mind right now: Claude Skills are going mainstream for audits 🔥 Seen killer ones from: @trailofbits @QuillAudits_AI @cyfrin @0xcastle_chain @0xKaden

@0xcastle_chain @trailofbits @QuillAudits_AI @cyfrin @0xKaden Well deserved. Keep building! 🚀

@kalp_eth @trailofbits @QuillAudits_AI @cyfrin @0xKaden Thanks for the mention. 😁

@NTkhage @trailofbits @QuillAudits_AI @cyfrin @0xcastle_chain @0xKaden thanks for adding

@kalp_eth @trailofbits @QuillAudits_AI @cyfrin @0xcastle_chain @0xKaden Well you're missing a name ser haha x.com/pashov/status/…

github.com/trailofbits/sk… github.com/quillai-networ… github.com/Frankcastleaud… github.com/kadenzipfel/sc…

zk × AI security × infra depth. 2026 grinding mode.

@0x3b33 awesome

I made $140k auditing web3 projects in 2025 Here's the exact breakdown: - Contest winnings: $9k (5 contests, 2 - top3) - Working for firms: $131k (32 audits) - Bug bounties: $0 😅 Time investment: - 50-60 hour weeks - ~2k hours auditing - ~$70/hour effective rate The best part? Year 2 earnings typically 2-3x year 1. Most auditors I know are at $200k+ by year 3 (some even before that 👀)...

It's probably a good idea to optimize🎯

Vibe audit = auditing based on assumptions without deeply challenging them. ✅ “Good” Side If you go live without a proper manual audit: - save thousands of dollars. - ship faster. - reduce short-term costs. ❌ “Bad” Side - A single broken assumption can collapse the system. - One exploit can lead to millions in losses. - Reputation damage.

@0xiSanford complete agree mate 💯

@kalp_eth When an invariant challenges core mechanics, that’s not friction, it’s feedback. Good protocols treat that tension as a signal to refine assumptions, not dismiss risk, for that doesn't remove the risk. Security improves when design and guarantees evolve together.

"It's not a bug, it's a design choice." The most expensive sentence in web3.

@0xiSanford True, i’ve seen valid invariants rejected simply because fixing them would require changes to core protocol mechanics,often time-consuming rewrite, but security shouldn’t bend to architectural convenience.

@kalp_eth Indeed, the most expensive, “design choice” often just means the threat model wasn’t formalized. If value can move in unintended ways, that’s risk. Clear invariants upfront would save everyone time, and a lot of rejected reports.

Generic AI audit = garbage output. Protocol-specific AI audit = actually scary good. 🥷

@cvetanovv0 truly understand it is progress in security, depth > velocity.🥷

Jumping from project to project feels productive. But real findings come from sitting with the code long enough to understand it. In security, depth beats constant switching.

AI audit tools are fast. Not deep. The sweetest spot right now bugs are sitting quietly, waiting for someone who actually thinks adversarially. New era. Same edge. Think deeper than the tool

@QuillAudits_AI 🥷

If your AI audit workflow is just asking: Find reentrancy > Check access control You’re not auditing. You’re autocomplete scanning. We just released the first version of 10 Claude Skills built specifically for smart contract security. These 10 Claude Skills weren’t built in isolation. They are derived from the same research and architecture behind QuillShield, our proprietary AI security engine used internally at QuillAudits. Most AI-assisted audits fail because they: - Pattern match - Ignore contract wide state - Skip exploit simulation - Don’t model severity Security requires reasoning not regex. Our 10 Claude Skills introduce: - Semantic state reasoning - Behavioral decomposition - Adversarial exploit simulation - Probabilistic risk scoring - Modular, targeted analysis Structured AI for real audits.