Team of experts doing security audits right. 🤝 Trusted by @origami_fi, @MontraXYZ, @ClutchMarkets & @ponsdotfamily. https://teapawt.org/t.co/eVpq3lxXAY
Joined November 2023
- Tweets427
- Following48
- Followers2.1K
- Likes1.3K
SBSecurity retweeted
SBSecurity 🤝 @MontraXYZ
Audit kicked off.
Montra is the place to launch and grow tokens on @Enter_Elysium.
Our senior team is on it.
Looking forward to yet another strong audit with the team behind it. 🫡
SBSecurity retweeted
Montra's number one priority is your security.
Our trusted partners at @SBSecurity_ have it covered.
Ready for @Enter_Elysium 🦋
SBSecurity 🤝 @MontraXYZ
Audit kicked off.
Montra is the place to launch and grow tokens on @Enter_Elysium.
Our senior team is on it.
Looking forward to yet another strong audit with the team behind it. 🫡
SBSecurity 🤝 @MontraXYZ
Audit kicked off.
Montra is the place to launch and grow tokens on @Enter_Elysium.
Our senior team is on it.
Looking forward to yet another strong audit with the team behind it. 🫡
SBSecurity retweeted
This week, we started 5 audits in parallel with 12 auditors.
- Cross-chain NFT launchpad and bridge
- NFT marketplace with AMM pools
- 3 token launchpads
Looking forward to securing these strong teams. 🫡
This week, we started 5 audits in parallel with 12 auditors.
- Cross-chain NFT launchpad and bridge
- NFT marketplace with AMM pools
- 3 token launchpads
Looking forward to securing these strong teams. 🫡
SBSecurity retweeted
The worst decisions you can make for your protocol:
- Assume your fork inherited the original's security
- Run an AI scan and skip the audit
- Ignore audit fixes because "we'll patch it post-launch"
- Skip the re-audit after rewriting 40% of the code
The basics aren't optional
The worst decisions you can make for your protocol:
- Assume your fork inherited the original's security
- Run an AI scan and skip the audit
- Ignore audit fixes because "we'll patch it post-launch"
- Skip the re-audit after rewriting 40% of the code
The basics aren't optional
The @initia hack, step by step:
08:27: 0.1 ETH from Tornado funds the attacker
14:37: a small deposit into the ETH bridge adapter
14:59: one tx mints 2M AUSD out of nothing
15:01: the bridge releases 1.4M real AUSD on Ethereum
15:06: $2.65M is back on Ethereum
15:41: Initia halts the L1 and every rollup
Root cause: unconfirmed, reportedly a MoveVM bug.
Attacker now holds ~$2.7M.
If you're building on smaller chains, you can't stop the chain from getting hacked.
You can be ready if it rolls back to a block before the hack.
Know what your contracts do when it does.
SBSecurity retweeted
You'd be amazed how many bugs sit in live contracts.
- 90% aren't critical. Still impactful.
- 10% drain funds.
We keep pointing our AI auditor at deployed code, and everything worth reporting gets disclosed.
You should too.
Cover as much ground as we can. That's the point.
In 3 weeks, our AI auditor found 2 High and 14 Medium issues that prior audits missed.
The protocols we scanned:
- Went through 2025 C4 contests
- Were audited by tier-1 firms we admire
Most issues were in code that's live with real TVL. All responsibly disclosed.
That's not a knock on anyone.
Audits have limits, and deployed code deserves more eyes.
The more of us hunting, the fewer nine-figure hacks.
We hope more researchers point their tools at live protocols too.
If your protocol is deployed and you're wondering what slipped through your last audit, DM us.
We'll run a pass and show you what we find. 🫡
You'd be amazed how many bugs sit in live contracts.
- 90% aren't critical. Still impactful.
- 10% drain funds.
We keep pointing our AI auditor at deployed code, and everything worth reporting gets disclosed.
You should too.
Cover as much ground as we can. That's the point.
In 3 weeks, our AI auditor found 2 High and 14 Medium issues that prior audits missed.
The protocols we scanned:
- Went through 2025 C4 contests
- Were audited by tier-1 firms we admire
Most issues were in code that's live with real TVL. All responsibly disclosed.
That's not a knock on anyone.
Audits have limits, and deployed code deserves more eyes.
The more of us hunting, the fewer nine-figure hacks.
We hope more researchers point their tools at live protocols too.
If your protocol is deployed and you're wondering what slipped through your last audit, DM us.
We'll run a pass and show you what we find. 🫡
SBSecurity retweeted
Security Alpha:
If you open an audit report and the audit findings start with:
- Potential
- Maybe
- Possible
The job is half-finished.
An auditor's job is to decide: exploitable or not. There's no in-between.
Security Alpha:
If you open an audit report and the audit findings start with:
- Potential
- Maybe
- Possible
The job is half-finished.
An auditor's job is to decide: exploitable or not. There's no in-between.
SBSecurity retweeted
Robinhood Chain is the hooks chain.
Builders are shipping Uniswap v4 integrations like crazy.
Most underrated way a v4 hook breaks?
A) Reentrancy during unlock callbacks
B) Fee/accounting rounding
C) Bad PoolManager assumptions
Real example from our reports 👇
SBSecurity retweeted
@ClutchMarkets's Smart LP v2 report is public.
They did a great job fixing every issue before launch.
That's how you raise the standard.
Proud to keep securing @OxSimpleFarmer's innovations.
Full report 👇
SBSecurity retweeted
This is really cool bug in GoldPesa uni v4 hook
Attacker took a 175k USDC flash loan from Morpho and opened one-sided liquidity position in WETH/USDC pool below the price range using `MINT_POSITION`, skipped `SETTLE_PAIR` which created ~115k USDC unpaid debt on the shared POSM
Your v4 hook can pay the attacker's debt.
GoldPesa on @base lost ~$115K.
Hook rebalanced inside someone else's unlock.
Deltas are shared across the whole unlock.
Attacker's unpaid debt got settled by the hook.
Always assume PoolManager can be used for cross-function reentrancy.
SBSecurity retweeted
Your v4 hook can pay the attacker's debt.
GoldPesa on @base lost ~$115K.
Hook rebalanced inside someone else's unlock.
Deltas are shared across the whole unlock.
Attacker's unpaid debt got settled by the hook.
Always assume PoolManager can be used for cross-function reentrancy.
Your v4 hook can pay the attacker's debt.
GoldPesa on @base lost ~$115K.
Hook rebalanced inside someone else's unlock.
Deltas are shared across the whole unlock.
Attacker's unpaid debt got settled by the hook.
Always assume PoolManager can be used for cross-function reentrancy.