nmirchev8

Proud to win this one! We haven't previous stableswap math experience, but we always want to challenge us, so we can improve.

before you pay anyone to audit your code, spend one afternoon doing this > run @pashov's solidity auditor (github.com/pashov/skills) > fix the bugs > run it again a lot of bugs can die for free nowadays, the rest are for auditors to find.

My "morning" routine: > 30-45 minutes of @_MathAcademy_ > Bug of the day (onebugperday.com), shoutout @GalloDaSballo > Read and run one exploit from the excellent DefiHackLabs repo (github.com/SunWeb3Sec/DeF…)

my audit stack: > eyes > brain > every line guilty until proven innocent

BonkDAO lost ~$20M this week and no contract was hacked. Every transaction was valid. An attacker spent ~$4M buying BONK, then passed a treasury-draining proposal with 7 wallets (2.9% turnout), clearing quorum by a hair — 882.38B vs 879.95B BONK. The code executed the vote flawlessly. That's the point. Audits verify code correctness at a moment in time. They can't see the live economic state — price, treasury value, and quorum drifting — until $4M of votes can move $20M of treasury. That's not a bug in the code. It's a config no audit is scoped to catch. An invariant a monitor enforces at runtime: a treasury transfer must not execute while the market value of the votes backing it < the value it moves out. Bonk violated it 5:1. Pair it with a timelock so a flagged proposal pauses for a guardian instead of settling instantly. Detection + a pause is a security procedure on top of a code security audit. Security has a lot of layers and the worst part is that if you leave one layer uncovered, it may compromise the entire system. Take notes, think twice and continue to progress!

@dethSCA Hbd, champ!

Turning 26 today, these are the most important things I learned > If you want something, you have to take it > If you want success, hard work and lonely years are inevitable > The woman next to you can make or break you

There are 3 certain things in life > Death > Taxes > Not getting paid for a valid bug bounty at least once

back in 2024, @EgisSec took 1st in the @useteller contest on @sherlockdefi — 16+ findings, one of our first wins here's a unique High we caught: a lender could stop any borrower from ever repaying, then take their collateral. the whole bug is this try/catch

Today was my last day @Certora. It was a fun ride — worked with many great people, audited the biggest DeFi protocols in the space, and learned more than I can fit in this post. I had the pleasure of working with many of the friends I made throughout the olden days of @code4rena and @sherlockdefi — when contests were the shit and the judging was too <3 Met some very talented, hard-working people like @tpiliposian , who posts more about his BJJ medals than his actual work 😁 And I was lucky to work under the guidance and mentorship of @BowTiedDravee — the best team lead anyone could ask for. He always had my back, no matter what. I consider you a true friend, brother. What will I do now? I thought about it, and it's time to dust off this old t-shirt from the closet and get back to work. We're back, stronger than ever. If you're a protocol in need of elite-level auditors — or a security agency in need of the best — you know where to find us. @EgisSec

@dethSCA @Certora Egis sec got your back 💪

Bear market is just an oppertunity to catch up with the latest technology and innovate

One invariant neutralizes inflation & donation attacks — the vector behind most vault drains Checkpoint the rate. Revert + auto-pause on >X% deviation per block A vault's share rate (totalAssets/totalSupply) moves in bps per day. Exploits move it 10–1000x in one tx

Looking forward to the "Grandpa, tell us again about the audit contests..." moment

@MaslarovK Congrats, brother!!! The best is yet to come

Turning 29 today, so I thought it was a good time for my half-year summary and 2026 has been amazing so far. - 17 audits completed with Paladin. - Bought a house with my wife - our second property. - Learned a lot, grew a lot, and kept pushing forward both professionally and personally. But most importantly, we became parents to our first son 👼. Nothing I’ve achieved comes close to that feeling. I’m incredibly grateful for how life has been going lately - for my family, for the opportunities, and for the years of hard work that are now paying off.

Quick tip on how to open a Visual Studio Code preview of a GH repo at a fixed commit: -> After the repo path paste "/blob/{commit}" then enter -> You open a GH view at the commit -> Press "." and you're redirected to vscodе.dev/githib/... for the given commit hash

@BowTiedDravee Niceee

@nmirchev8 Bro, additional tip, try pressing "y" while on a branch on GitHub 😄 This swaps the branch name to its commit hash in the url.