@osec_io

Audits that protect blockchain ideas.

osec.io
Joined February 2022
  • Tweets1.2K
  • Following34
  • Followers21.6K
222Media
In 2026, no program is closed source. We decompiled a propAMM into Rust that recompiles to the exact on-chain binary, then used it to find a critical bug that put $6.1M at risk.
22
72
16
541
31,554
osec.io/blog/goonfi-decompil…

Breaking open a propAMM

At Accelerate 2025, we talked about making Solana programs open source. A year later, agents have taken over the world, so we wanted to see how far we could push things by applying our techniques to...

osec.io
4
2
43
3,782
Anchor v1.2.1 is here The new `solana-v4` feature gate allows Anchor to use Solana v4 dependencies. This allows Anchor to interact with Token-2022 mints with newer extensions such as `PermissionedBurn`.
1
6
25
2,121
OtterSec retweeted
thedao.fund
@thedaofundOct 6
🔥 @osec_io has pledged $37.5K to the Community Fuzzing Tooling initiative. This RFP is looking for a team to build scalable, continuous fuzzing infrastructure for Ethereum ecosystem projects. The goal is simple: make serious fuzzing easier to run, easier to access, and less dependent on every project building the same setup alone. Many teams know fuzzing matters. Far fewer can afford to run sustained, compute-heavy campaigns over time. This initiative aims to change that. Explore the initiative and help fund it: initiatives.thedao.fund/init…
2
11
1
32
1,559
Exciting news for Solana builders 🔐 We're glad to have contributed to its release.
jo
@dev_jodeeOct 1
Solana Keychain v2 is out 🔑 Yes you read that right, your favourite way to sign your txns on Solana has a brand new version What's new? 🧵
6
2,001
OtterSec retweeted
Project 0
@project0Oct 1

Inside Project 0's Security Stack

Article · @project0
18
15
4
59
7,070
OtterSec retweeted
Robert Chen
@NotDeGhostSep 24
Txv1 is live, and Anchor 0.30.2, 0.31.2, and 0.32.2 support receiving it. If you're still on old coral-xyz/anchor packages, update to anchor-lang/core and friends Anchor 1.2.1 is coming soon with support for receiving *and* sending Txv1 Thanks @clubby789 for pushing this through!
1
7
32
1,784
OtterSec retweeted
Velocity
@VelocityDEXSep 16
1/ Velocity completes its audit with @osec_io. The protocol is now open source, leaner, and safer. The full report and source code are now public.
Velocity
@VelocityDEXSep 16

Velocity completes Audit with OtterSec. The protocol is now open source, leaner, and safer.

Article · @VelocityDEX
9
5
5
75
26,873
OtterSec retweeted
Ethan Mollick
@emollickJul 29
Those who follow my feed know that I test new video models by having them show an otter using a laptop on an airplane. The new Flux 3 video model is really good, so I had it do a variation on theme, which will become apparent a couple seconds in. See the change from 2 years ago.
Ethan Mollick
@emollick2 Jul 2024
In October 2022, “an otter on a plane using wifi” typed into an jmage generator created nonsense first try. In July, 2024 the same thing typed into a video generator (plus “on a computer”) gets this first try. Not quite an otter, but look at the lighting & details. Quick pace…
24
54
9
950
119,048
Interesting data on the current phishing and wallet threat landscape. Excited to help contribute to this report alongside @okx
OKX Wallet
@walletJul 24
In H1 2026, we blocked 10M+ risky site visits and flagged 4M high-risk signatures. Our Web3 Security Report with @SlowMist_Team and @osec_io shows how threats are evolving, and how protection starts before you sign. Read it here: web3.okx.com/learn/security-…
15
3,412
OtterSec retweeted
es3n1n
@es3n1nJul 14
Today, we’re releasing rCTF v2, an open-source platform for hosting cybersecurity capture-the-flag competitions.
The signature rCTF wordmark, white on black with red accenting. A red stylized “v2” sits slanted on the bottom-right side.

ALT The signature rCTF wordmark, white on black with red accenting. A red stylized “v2” sits slanted on the bottom-right side.

A screenshot of rCTF's matrix-style leaderboard displays teams as rows, challenges as columns, and their intersection as the team's solve status on that challenge. Each team has a custom avatars, country flag, and tagline. A sparkline shows the team's scoring activity. The top-left corner of the leaderboard displays a line chart, plotting the visible teams against each other.

ALT A screenshot of rCTF's matrix-style leaderboard displays teams as rows, challenges as columns, and their intersection as the team's solve status on that challenge. Each team has a custom avatars, country flag, and tagline. A sparkline shows the team's scoring activity. The top-left corner of the leaderboard displays a line chart, plotting the visible teams against each other.

A screenshot of the rCTF's challenge listing. It is panel-style; the left side displays all challenges within the event, while the right side displays the details of a particular selected challenge (the challenge's description, attachments, and any custom instancing).

ALT A screenshot of the rCTF's challenge listing. It is panel-style; the left side displays all challenges within the event, while the right side displays the details of a particular selected challenge (the challenge's description, attachments, and any custom instancing).

The platform's admin view allows for viewing and auditing of the submission logs from all teams. A complex filtering system allows filtering against (non-exhaustively) challenge names, submission results, and time intervals.

ALT The platform's admin view allows for viewing and auditing of the submission logs from all teams. A complex filtering system allows filtering against (non-exhaustively) challenge names, submission results, and time intervals.

15
103
5
603
49,336

Anchor security update: what’s shipped since February

Article · @osec_io
7
6
5
46
14,457
OtterSec retweeted
Robert Chen
@NotDeGhostJul 7
We're launching a $100,000 fund to save CTFs.
17
104
17
646
65,936
OtterSec is happy to sign the OPSeC pledge and keep pushing for strong security practices across the teams we work with 🤝
asymmetric research
@asymmetric_reJun 23
The Open Protocol Security Coalition (OPSeC) is a new initiative by @fund_defi, in partnership with @_SEAL_Org and Asymmetric Research. What it does: → Curates existing, free cybersecurity resources → Hosts educational events → Engages with policymakers and regulators
2
24
4,639
When Hyperliquid has to clear bad debt, who covers it? We reverse-engineered the closed-source risk engine, verified some core properties & compared it to other perps. It's not neutral: the more leveraged and profitable your position, the sooner it's closed. Full breakdown ↓
9
28
10
211
44,730
osec.io/blog/2026-06-22-hype…

Auto reverse-engineering the Hyperliquid risk engine, with some agentic help

Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid’s risk engine to show how it ranks and...

osec.io
2
2
1
51
6,063
New research: We were able to access camera permissions and obtain user GPS coordinates across 20+ major mobile wallets by exploiting WebView misconfigurations. Here's how ↓
2
24
3
115
15,961
osec.io/blog/2026-06-18-gold…

The goldmine of insecure WebView integrations

WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authori...

osec.io
6
21
2,112
Anchor v2 docs are live!
4
7
1
46
4,503
Benchmarks, migration guide, and reference: v2.anchor-lang.com/docs

Anchor

A framework for building Solana programs, clients, IDLs, and workspace tooling.

v2.anchor-lang.com
5
1,766
Load more