Independent Smart Contract Researcher & Researcher at @ShieldifySec My mission is to find vulnerabilities in smart contracts for a safer Web3 Space!
Joined May 2021
- Tweets2.4K
- Following1.9K
- Followers8.4K
- Likes13.5K
Jeff Security retweeted
Solid resource 😱 This is one of the most structured open-source prompt packs I’ve seen for bug bounty hunting!
@mdp_sec broke down their entire workflow into 10+ reusable phases:
→ Recon & surface mapping
→ Authenticated access setup
→ Endpoint & vuln-class sweeping
→ Browser-based walkthrough
→ Critical-impact hunting
→ Triage, dedup & validation
→ Independent verification gates
It’s Web2 focused, but the methodology is gold for anyone building AI-assisted security workflows. The evidence-first, phase-by-phase structure is exactly how you avoid hallucinated findings and actually produce reliable results: github.com/mdpsec/bug-bounty…
Jeff Security retweeted
This deep dive on multi-agent software engineering pipelines shows how to partner with AI to build production-grade, highly tested Web3 systems.
Watch the full talk: youtu.be/UcZdy0JRrCQ
This deep dive on multi-agent software engineering pipelines shows how to partner with AI to build production-grade, highly tested Web3 systems.
Watch the full talk: youtu.be/UcZdy0JRrCQ
Jeff Security retweeted
Updated $DRKW on DexScreener and CA added to website.
We're also audited by Shieldify (@ShieldifySec).
Audit 👇
github.com/shieldify-securit…
Jeff Security retweeted
Another audit report for
@pear_protocol
is live ❇️
Another audit report for @pear_protocol is live ❇️
We reviewed their PEAR → PEAR migration to HyperEVM: a one-way LayerZero bridge, rate-limited minting, staking migration with preserved timestamps, and the HyperCore spot listing.
Read the full report 👇
github.com/shieldify-securit…
Jeff Security retweeted
Another audit report for @pear_protocol is live ❇️
We reviewed their PEAR → PEAR migration to HyperEVM: a one-way LayerZero bridge, rate-limited minting, staking migration with preserved timestamps, and the HyperCore spot listing.
Read the full report 👇
github.com/shieldify-securit…
Jeff Security retweeted
Hash-perfect decompilation of a Solana program is now a thing.
@osec_io went from a 220KB .so blob to byte-identical Rust source for GoonFi V2, using agents scored on how closely each function matched the original bytecode.
The bug they found once the code was readable? The AMM priced assets off its own vault balance. Donate tokens, skew the price, drain the other side. $6.1M at risk.
If your program is live, assume your source is public.
osec.io/blog/goonfi-decompil…
TryHackMe’s AI Security path: 25 hands-on labs on prompt injection, jailbreaks, AI supply chain attacks and RAG data poisoning. ~19h, intermediate. Worth it if you audit anything with an LLM in the loop.
tryhackme.com/path/outline/a…
ethereum.org curates 446 builder tools. Security & testing alone has 56: Slither, Aderyn, Echidna, Medusa, hevm, Certora, Kontrol, heimdall-rs. A solid map for building your audit toolchain.
ethereum.org/developers/tool…
Jeff Security retweeted
Whitehats defend every line. Blackhats only need one missed invariant. That gap is the difference between a clean launch and a 3am rekt thread
Double down on security 🫡
Sing, O Muse, of the vault that trusted its oracle. Of TVL unbounded, of a price fed by one thin pool, and of the flash loan that arrived at dawn like a god in disguise. ⚔️
Audit your feeds, anon.
Jeff Security retweeted
Prompt injection is the reentrancy of AI agents: untrusted input executing as instructions. This curated list covers OWASP LLM Top 10, adaptive attack papers, Garak, MCP tool poisoning and CTFs to practice on 🫡
github.com/Joe-B-Security/aw…
Malware C2 with no server to seize. ClearFake stashed payloads in BSC testnet contracts, and injected JS on hacked sites pulls them with a plain eth_call.
trendmicro.com/en_us/researc…
