Security audits for high-assurance digital infrastructure: smart contracts, cryptography, protocols, and key management. Clear findings, open to talk.
Decentralized
Joined February 2025
- Tweets176
- Following494
- Followers65
- Likes661
Null Return retweeted
At DZap, security is not an add-on. It is built into the core
Our smart contracts are audited by @BlockSecTeam, @nullreturn_io & @0xCommitAudits, helping ensure every swap and bridge interaction is reliable, safe, & seamless across chains.
Try it now at DZap.io
Null Return retweeted
DeFi hacks have changed a lot in the last five years.
If you’re building today, you need to understand how attacks work now, and where they actually show up in code and tooling.
We’re hosting a livestream on modern DeFi attacks, including CPIMP attacks and GlassWorm.
More details and registration below 👇
Null Return retweeted
#PeckShieldAlert 2025 has witnessed a record-breaking year for crypto-related theft, driven primarily by systemic vulnerabilities in centralized infrastructure and a strategic shift toward targeted social engineering.
The total loss in 2025 exceeded $4.04B, reflecting a ~34.2% increase 📈 from the $3.01B stolen in 2024.
The breakdown includes:
📍$2.67B from crypto hacks (~24.2% YoY increase)
📍$1.37B from scams (~64.2% YoY increase)
Notably, ~$334.9M worth of stolen crypto was recovered or frozen, compared to $488.5M in 2024.
Null Return retweeted
All the children of God are beautiful, but they're especially beautiful when they need 500 audits 🥰
Null Return retweeted
🚨 September 2025 Hack Report: Over $100M Lost, Private Key Compromises Surge
The numbers are in, and September was a stark reminder of the critical challenges facing Web3.
QuillMonitor is here to break down the data, providing you with the crucial insights needed to navigate this landscape. Last month saw a massive $102.4 million lost to exploits, dominated by two major attack vectors.
Here’s your snapshot of September 2025:
Null Return retweeted
The SMTChecker is an underappreciated feature of Solidity.
It's a built-in compiler module that you can use to produce a formal verification report for your contracts.
And yes - it can be configured with Foundry! Here's a sample config:
Null Return retweeted
Another hack this week. First question: “Who audited?”
Truth: responsibility lies with the team, not auditors.
Tier-1 projects hand over code so polished even medium bugs hide.
💡 Tip: 2+ audits + formal verification. High TVL = high responsibility.
Null Return retweeted
Developers learned about formal verification today.
Do they have to implement it themselves? Nope.
We’ve got them covered.😎
Null Return retweeted
Formal verification can sound intimidating or difficult.
But you don't need a PhD in math to get the benefits.
In this short post, we break 3 myths of formal verification, and how we make it easy using the Certora Verification Language.
certora.com/blog/3-myths-of-…
Null Return retweeted
The 80/20 of smart contract vulnerabilities:
20% of bug types cause 80% of exploits:
• Re-entrancy variants (not just the obvious ones).
• Access control assumptions.
• Oracle price manipulation.
• Integer overflow in edge cases.
• State inconsistencies during external calls.
Master these 5 patterns before chasing exotic bugs
Senior alpha: Look for combinations - access control + reentrancy = biggest payouts.
Most auditors find surface-level instances. The money is in finding creative variations of these classics.
Null Return retweeted
resources to become a smart contract auditor (by @Al_Qa_qa)
- Cyfrin Updraft Courses
- Securceum Bootcamp
- Advanced Web3 Security Course by @0xOwenThurm
- OpenZeppelin Ethernaut CTF
- Damn Vunerable DeFi V4 CTF
- CodeHawks First Flights
- Read @SoloditOfficial reports
- Read attacks from @RektHQ
- Understand popular protocols (UniV2, Univ3, synthetix staking)
- Immunefi Bug Bounty Writeups by @sayan_011
- Do Contests
Null Return retweeted
Smart contract bug-finding tools all have shortcomings. Fuzzing misses input-specific bugs. Formal verification is powerful but slow and complex.
At @EthCC, I’ll introduce Bounded Model Checking, an approach that finds realistic bugs by systematically exploring execution paths.
Null Return retweeted
Just a list of common Solidity attack vectors. Something to always keep in mind during development and review.
Null Return retweeted
Security is a culture, not a feature
Here is how Aave's (biggest DeFi protocol) security page is looking. Look at their process when it comes to securing upgrades, not full releases - small diffs.
Pashov Audit Group was one of the auditors for V3.2 and can confirm @bgdlabs's security approach is rigorous🫡
Null Return retweeted
The tx to update the master copy of the Safe wallet in @Bybit_Official incident.
app.blocksec.com/explorer/tx…
Null Return retweeted
Safe’s security team is working closely with @Bybit_Official on an ongoing investigation.
We have not found evidence that the official Safe frontend was compromised. However, out of caution, Safe{Wallet} is temporarily pausing certain functionalities.
User security is our top priority, and we’ll provide more updates soon.
Null Return retweeted
Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic. As a result, the attacker was able to gain control of the affected ETH cold wallet and transfer its holdings to an unidentified address.
Our security team, alongside leading blockchain forensic experts and partners, is actively investigating the incident. Any teams with expertise in blockchain analytics and fund recovery who can assist in tracing these assets are welcome to collaborate with us.
We want to assure our users and partners that all other Bybit cold wallets remain fully secure. All client funds are safe, and our operations continue as usual without any disruption.
Transparency and security remain our top priorities, and we will provide updates asap