naman

None of the people I admire and respect are impressed by the performance of LLMs in security. Codebases are full of bugs and latent vulnerabilities. There are simply no incentives to look for those issues or report them most of the time. All projects, including OSS, are "unsafe" in some way. Fortunately, we have built a lot of safeguards, sandboxes, upgrade mechanisms, and tooling to minimize the damage in traditional software. It's not impressive to find such vulnerabilities. The only difference is that any script kiddie can find them now without even knowing how to code. The case with Web3 is even more hilarious. The risks are higher, and there are fewer actual experts than in traditional software, though. Projects spend so much money on frozen-code audits, and yet so many criticals still slip through. This only speaks to the low level of Web3 security. It's a young industry with a lot of innovation. But it's just not that good for the problems crypto tries to solve or its inherited risks. This includes devs, auditors, tooling, infra, and languages. On the other hand, I'm glad that some automated tools are starting to gain traction via LLMs. There hasn't been any incentive to build such things until now. This can help both devs and security folks more reliably grasp ideas they hadn't thought of or examine areas they hadn't paid attention to. It may be helpful for scanning lots of codebases to find LLM low-hanging fruit. I see many wise hunters making money with this strategy. I'd just be wary of anyone who is truly impressed by the outcomes of an LLM, its novel ideas or how good it is in security. I find them cute.

2025 is 99% complete. What did you achieve in web3 security this year?