My notes for @windhustler interview on @deliriusz_eth channel - "You are paid to think" - Another example of switching fields, this time from engineering to IT, learning from courses - 2018 java programmer - 2021 web3 job, solidity developer - 2023 web3 security - Bug classes specialization - Cross-chain apps - layer zero - 63/64 gas forwarding vulnerabilities - Most interesting bugs - Tx ordering (unconventional design in layer zero) - Permits front-running to DoS the original tx - Business-logic dependent - If setters controlled by admins are called at unusual times, like in the middle of a user flow, what happens? Can it be front-run? - Advice - Drill through external integrations - Explore parts others are not looking at - Don't approach competitive audits like regular private audits, because uniqueness matters more than severity - Focus on one part and try to find something unusual - About contests - Rules of contests - Unclear, very subjective. A lot of people are annoyed by them - Bugs often underinflated by judges, same as in web2 - Conditional rules have a problem: if you find A, make sure it does B, otherwise it's invalid - Big contests' escalations never look too healthy - Most people quit contests because they hate arguing with judges and navigating all the rules (move to private audits) - But the escalations are very hard to solve, as well as judging as a service - Only 3 severities (L, M, H) may not be enough - Conditional pots give projects motivation to argue as much as possible - Contests mostly rely on newcomers; without them, they wouldn't exist, as most participants move to private work after 6-12 months - Judges often don't have enough time to argue and understand - Always rushed - But it onboarded a lot of people - Opinions on platforms - @windhustler - Don't like payments for only the first, like @HatsFinance - Leads to spamming - Super rushed - @cantinaxyz and sponsors seeing the issues during the contest - It's fine because you don't have to submit. Leaves freedom to researchers - Most experienced SRs submit in the last 30 minutes. Because something theoretically can happen (like malicious team member), no reason to take additional risks - Less experienced have an opportunity to talk with the sponsor early when they are unsure - But it's debatable if it's good when the first submission is rewarded with an additional bonus - @escrow_ - Overall likes first come first served, (@HatsFinance) - No dupes is good, bigger payments - Faster payouts, less arguing - But time constraints can get into your head and work against you, reducing mental clarity - As soon as repo opens you see 40 spam submissions - but other than that not much - all these 40 instant submissions got invalidated - @sherlockdefi live judging - Fast payouts - @deliriusz_eth - Needs time to get a picture, find bugs, so doesn't like FCFS - But it can be beneficial for those who have the skills to find bugs fast - @windhustler ideal platform - Lead auditor, like in @sherlockdefi. Most projects really like it - Similar to reserved auditors on @code4rena - Find really good judges - Outsource judging - Some QA, but not too crazy, like 50 messages for one issue - @deliriusz_eth ideas - Like in @code4rena, first validators invalidate 0-value issues. Helps judges a lot, reduces number of issues to check - Add guaranteed auditor, like in @sherlockdefi - Ranking system, where you can fall very fast if you do badly in some contests and lose LSW and the money for it - Bigger pot for non-LSW participants - About @immunefi boost - Judging is better than on other platforms - The most unique - Requires PoC - PoC is actually required in web2 too, most agree it should be required - But some top auditors don't know how to write them or don't want to - @deadrosesxyz do mostly manual reviews, very rarely PoC - In some contests the winner finds 20-30 valid bugs, almost impossible to write PoCs for all of them - Has duplicates - SRs to look up to - @panprog great auditor overall, especially for perpetual protocols - @HollaWaldfee100 - @cmichelio - @deadrosesxyz - @zachobront - immunefi.com/profile/GothicS… - Not visible in the space, but has out of this world reports - @0xriptide - @trust__90 - AI - Won't replace us, but will help audit, won't be possible to do audits without it - Learning it will give a significant advantage - Now can't find anything useful, but can explain some parts of the code, especially low-level - Personal brand on X - Some strategies - Be really funny - Review novel bug classes - Genuinely share your struggles and experiences - A lot of work, 1-2 hours a day cumulative, including time for comments on other posts - Writing about something important to you helps clarify your mind - Everyone should market themselves - if you're technically inclined, focus on writing in-depth technical content - Typical day - Weekday - Wake up - A few hours of work: talks, messages, tweets, audit - Gym 1h - Lunch 1h - Another chunk of work, 4-5 hours - Family time - Some evening work, often just communication - Weekends - Some work, 3-4 hours - Not every day is perfect, but tries to keep consistency - Sometimes spend several hours organizing, planning and deciding what to do - Constantly mix technical with non-technical work - How to grow - Read reports - Work in teams - Bug breakdowns in @SpearbitDAO - But mostly just do audits and that's more than enough - Approach to understand codebase - Different every time - Starts - Sometimes starts from the smallest library and audits it in isolation, tries to understand only it first - If already familiar with the protocol that the project integrates with, starts there. Easier to start with familiar and then expand - User flows - Tests help to figure them out faster, see the data - Then build up from there - Pattern-matching using known findings, e.g. from @soloditofficial, and then try to force this issue - Use detectors that match the code with known vulnerable code - @BowTiedDravee has some custom ones that show points of interest, like a static analyzer - Checklists - Private vs contests - No need to argue about issues - Assess the client, sometimes it's best to suggest redoing the architecture, not finding singular issues, because of all the complexities - Usually team work - Learn a lot from the team - Discussions - Very collaborative - Health, including mental - Gym - Social life, family - Find enjoyment every day - Walks - Less social media - Remember that imposter syndrome is very common in our field, maybe more common than burnout - Music during audits - Classical can help, piano - Some beats that you don't focus on, jazz - But usually after 30-40 minutes you don't want to listen to it anymore, focus more on the audit - Closing advice: focusing on specific protocols and platforms can help you advance quickly - youtube.com/watch?v=xiIZyX0T…