Solidity security reviews @cantinasecurity https://teapawt.org/t.co/2Ql2W2pa9w
Rotterdam, Nederland
Joined October 2010
- Tweets338
- Following2.1K
- Followers3.3K
- Likes1.2K
Gerard Persoon retweeted
the TOP use case for muse wonder in building it was for use in Muse to serve consumers
really great to see that people are enjoying the upgrade 🫶
Very early impressions of Muse Wonder in the Muse app:
1. No regressions I notice. In particular, no personality or writing regressions. Feels like the same entity I was talking to with Spark.
2. Better UI sense. Had it polish an app made with Spark and it found a really elegant way of positioning a footer “Next” button that kept going off screen in a quiz (it floated the button so it always stays in the same place rather than getting pushed down).
3. Caught subtle bugs in that same app. Not major ones, but ones that required a close reading of the code and understanding of how it was supposed to work and actually worked.
One thing that’s not clear right now is whether Wonder also powers background tasks like goal summaries and the news feed. My current feeling is yes to to the news feed and no to the goal summaries based on how they’re still written (have some of the really bad AI writing tells, like trying too hard to have a voice, and self-referentially calling attention to things that they only need to show rather than also tell).
Gerard Persoon retweeted
Speaker spotlight: @gpersoon of Cantina.
“From EVM bytecode to Solidity and back to bytecode”
Open a talk and save it to your agenda.
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Gerard Persoon: From EVM bytecode to Solidity and back to bytecode.
Gerard Persoon retweeted
📢 Call for Speakers
Applications are open to speak at DeFi Security Summit 2026!
The conference will take place in Mumbai, Oct 31–Nov 2 just before @EFDevcon
Deadline: July 15th, 2026
Link below
Gerard Persoon retweeted
It's not the end, it's still living on in the LLM data training sets. That's why you see so many zero-address check suggestions and inflated severities. (My feeling is that it has improved with recent models though?)
The very early 2021 days with @0xRajeev @gpersoon @sockdrawermoney were peak fun.
What ruined contests from an SR's POV was:
Fewer real bugs because devs and tooling got a lot better, once foundry came along devs started actually testing their code with high coverage. This led to more (arguably) out-of-scope bug submissions which made the highest-impact move arguing about your own & others' issues. The difference between a high and a medium was not well defined in practice & there were some incompetent judges (sorry). Pool sizes also never kept up with the increase in participants.
In the end, the audit contest payout structure changed so much that many were just pre-deployment bug bounties (different pool size unlocks for H/M).
Ironically, now would be a great time for contests again as everyone is boasting about their AI being the best. Would love to see more real results instead of vagueposting.
Gerard Persoon retweeted
Always great to hear @gpersoon’s wisdom, some notes I made from his last interview
- Approach to SR:
- Creates schemes/drawings
- Takes notes on things that seem odd or unclear, then refines them into issues after discussing with teammates and the project
- How schemas help:
- Build a mental model
- Identifies incorrect modifiers
- Detects when tokens are moved from the wrong contracts
- Too many crossing lines (complex interactions) can be a red flag, signaling areas that need deeper investigation
- Drawings aren’t always complete—sometimes they focus on specific parts
- Reveals logic of access control
- Multiple security layers to access data
- If you can trace the full access path, you can better protect it
- New in web3 security:
- Firewalls are set up by a different team
- Separation of duties is key for code quality
- AI:
- Still not great at finding vulnerabilities, needs more training
- Can be useful in the short term for flagging suspicious areas and spotting simple bugs
- Example of codebase drawing:
- teapawt.org/gpersoon/status/184609…
From @TRUSTBYTES_X youtube.com/watch?v=eUSs-ePD…
Gerard Persoon retweeted
LIVE STREAM: If You Can’t See the Vulnerability, You Can’t Fix It!
Join us for an exclusive live stream with @gpersoon , Lead Security Researcher at @spearbit and Advisor at TRUSTBYTES, as he reveals his expert approach to mapping vulnerabilities before attackers do.
Date: 13 February 2025
Time:
10:00 AM EST
4:00 PM CET
8:30 PM IST
11:00 PM SGT
Topics of Discussion:
- How Gerard entered the Web3 security industry
- His approach to reviewing security protocols
- Personal preparation for security contests
- The power of visual diagrams in vulnerability detection
- Real-life examples of vulnerabilities found through visualization
- Trends and challenges in Web3 security
- AI’s role in Web3 security
Block your calendar ✅
Gerard Persoon retweeted
The wait is over!
The results of Underhanded Solidity Contest 2024 are out. We’re excited to announce the winner of this year’s contest, Gerard Persoon.
Congratulations, @gpersoon! 🥇
→soliditylang.org/blog/2024/1…
Keep reading for announcement highlights in the thread 🧵
Gerard Persoon retweeted
Thank the Web3 community for the 100 fantastic @summit_defi submissions so far. There are three more days to go.
Please submit to the CCC of Web3 security; here is my wishlist: testing, web2-web3 security issues, layer two, and protocol security.
Gerard Persoon retweeted
Markets got you down bad? Don’t worry, no need to start flipping burgers yet.
🚀 DSS will be offering the opportunity for top talent to connect with leading security firms. Stay tuned!
Gerard Persoon retweeted
1/ Gerard Persoon, Lead Security Researcher at @SpearbitDAO and independent security researcher at Superform, @code4rena as well as @sherlockdefi , joined us as our 𝗮𝗱𝘃𝗶𝘀𝗼𝗿. Furthermore he is a judge at @OpenZeppelin and part of the review committee of @summit_defi.
Gerard Persoon retweeted
🎟️ TICKETS ARE LIVE 🎟️
We are *very* excited about all the amazing speaker submissions, workshops, and activities coming together for DSS 2024!
This year is going to be EPIC 🚀
Full-price & student tickets now available 👇
defisecuritysummit.org/
Gerard Persoon retweeted
Introducing Code4rena Pro League 🏆
⭐ All-star auditors
🔒 Custom security services
🥇 The best security talent including @cmichelio, @samczsun, @hellocccz, @IAm0x52, @xuwinniexu, @zachobront, and more!
Read more: code4rena.com/blog/introduci…
Gerard Persoon retweeted
My notes from @DeGatchi interviewing @gpersoon on @scrapingbits
1. Audit approach
- Understand everything, how all fits together
- Make drawings
- Then let your mind find something in the background
- Start with the biggest contract, and try to understand everything
1/15
Gerard Persoon retweeted
Coming up on March 27th 🔥
DSS Webinar on War Rooms with @_SEAL_Org.
Ft. @Mudit__Gupta, @samczsun, @pcaversaccio, @hudsonjameson, @casatay & @isaacpatka.
Register below ⬇️
Gerard Persoon retweeted
Welcome... to the new largest competition in history with @eulerfinance!
💰 $1,250,000 USDC
🗓️ May 20th - June 17th
📍 @cantinaxyz
Invite only. Don't have one? Details below:
Gerard Persoon retweeted
Spearbit has published our seminar with @AlchemyPlatform and our very own LSR @gpersoon
In this seminar, Gerard and the Alchemy team dissect the innovative ERC-6900 standard / Modular Account and the findings uncovered from the Spearbit review.
Full Seminar Below.
