Solidity security reviews @cantinasecurity https://teapawt.org/t.co/2Ql2W2pa9w
Rotterdam, Nederland
Joined October 2010
- Tweets338
- Following2.1K
- Followers3.3K
- Likes1.2K
Tomorrow 10.15 in the Pearl room of @summit_defi I will present my EVM/Solidity decompiler that can roundtrip (so when the Solidity is compiled again it results in the same bytecode). The ending question is: now what do I do with it, without enabling more hacks?
Speaker spotlight: @gpersoon of Cantina.
“From EVM bytecode to Solidity and back to bytecode”
Open a talk and save it to your agenda.
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Gerard Persoon: From EVM bytecode to Solidity and back to bytecode.
Gerard Persoon retweeted
the TOP use case for muse wonder in building it was for use in Muse to serve consumers
really great to see that people are enjoying the upgrade 🫶
Very early impressions of Muse Wonder in the Muse app:
1. No regressions I notice. In particular, no personality or writing regressions. Feels like the same entity I was talking to with Spark.
2. Better UI sense. Had it polish an app made with Spark and it found a really elegant way of positioning a footer “Next” button that kept going off screen in a quiz (it floated the button so it always stays in the same place rather than getting pushed down).
3. Caught subtle bugs in that same app. Not major ones, but ones that required a close reading of the code and understanding of how it was supposed to work and actually worked.
One thing that’s not clear right now is whether Wonder also powers background tasks like goal summaries and the news feed. My current feeling is yes to to the news feed and no to the goal summaries based on how they’re still written (have some of the really bad AI writing tells, like trying too hard to have a voice, and self-referentially calling attention to things that they only need to show rather than also tell).
Gerard Persoon retweeted
Speaker spotlight: @gpersoon of Cantina.
“From EVM bytecode to Solidity and back to bytecode”
Open a talk and save it to your agenda.
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Gerard Persoon: From EVM bytecode to Solidity and back to bytecode.
AI-s hacking social, economic and political systems. Talk by Bruce Schneier: youtube.com/watch?v=eEBv0STi… .
Gerard Persoon retweeted
📢 Call for Speakers
Applications are open to speak at DeFi Security Summit 2026!
The conference will take place in Mumbai, Oct 31–Nov 2 just before @EFDevcon
Deadline: July 15th, 2026
Link below
Congratulations @0xPolygon with your 6 years anniversary, up to the next trillions!
And thanks for the nice gift from teapawt.org/0xPolygon/status/20614…
P.S. Whatever you do, don't ask your LLM to search for an easter egg
$2.5 trillion+ in stablecoin value moved. Translated into things you know.
Explore them at: trillions.polygon.technology
Gerard Persoon retweeted
It's not the end, it's still living on in the LLM data training sets. That's why you see so many zero-address check suggestions and inflated severities. (My feeling is that it has improved with recent models though?)
The very early 2021 days with @0xRajeev @gpersoon @sockdrawermoney were peak fun.
What ruined contests from an SR's POV was:
Fewer real bugs because devs and tooling got a lot better, once foundry came along devs started actually testing their code with high coverage. This led to more (arguably) out-of-scope bug submissions which made the highest-impact move arguing about your own & others' issues. The difference between a high and a medium was not well defined in practice & there were some incompetent judges (sorry). Pool sizes also never kept up with the increase in participants.
In the end, the audit contest payout structure changed so much that many were just pre-deployment bug bounties (different pool size unlocks for H/M).
Ironically, now would be a great time for contests again as everyone is boasting about their AI being the best. Would love to see more real results instead of vagueposting.
Cool idea. Why not use the exact bounty amount as liquidity? That removes the uncertainty if the white hat pays back the 90%. And that is the amount that the protocol should reserve anyway.
Cool idea by @sockdrawermoney : Label data, enforce policies to manage AI security & prompt injections. See mlld.ai teapawt.org/i/status/2027494630380…
I've spent every day for the last 14 months building a language for scripting LLMs because I believe we need new primitives to defend against prompt injection.
Here's why:
teapawt.org/sockdrawermoney/status…
When you compress the time between intent and finality, you also compress the time between mistake and catastrophe.
Vitalik talking about privacy and security at Ethereum Cypherpunk Congress 2
@web3privacy
Gerard Persoon retweeted
Always great to hear @gpersoon’s wisdom, some notes I made from his last interview
- Approach to SR:
- Creates schemes/drawings
- Takes notes on things that seem odd or unclear, then refines them into issues after discussing with teammates and the project
- How schemas help:
- Build a mental model
- Identifies incorrect modifiers
- Detects when tokens are moved from the wrong contracts
- Too many crossing lines (complex interactions) can be a red flag, signaling areas that need deeper investigation
- Drawings aren’t always complete—sometimes they focus on specific parts
- Reveals logic of access control
- Multiple security layers to access data
- If you can trace the full access path, you can better protect it
- New in web3 security:
- Firewalls are set up by a different team
- Separation of duties is key for code quality
- AI:
- Still not great at finding vulnerabilities, needs more training
- Can be useful in the short term for flagging suspicious areas and spotting simple bugs
- Example of codebase drawing:
- teapawt.org/gpersoon/status/184609…
From @TRUSTBYTES_X youtube.com/watch?v=eUSs-ePD…
