Comprehensive security from @Nethermind, from audits to formal verification. Book now: nethermind.io/nethermind-sec…
- Tweets 773
- Following 44
- Followers 1,658
- Likes 269
Pinned Tweet
Most protocols stop at the audit. Lido didn't.
An audit is essential, but it's a snapshot:
New AI models find what older ones and past reviews missed.
New attack vectors surface, and attackers weaponize them fast.
So @LidoFinance had us run AI + experts on already-audited Lido Core: AuditAgent and AgentArena, tuned on their protocol knowledge. Together they went deeper and wider, with less noise.
And it doesn't stop. We re-run AgentArena as new models drop, so coverage gets sharper as the models do.
Full write-up ⬇️
nethermind.io/blog/piloting-…
1
18
42
6,849
One signing key, days of settlement volume behind it. That's the risk @xochi_fi's PXE Bridge is built around: it gives EVM solvers a familiar JSON-RPC path to shielded settlement on Aztec, backed by a pre-funded account.
SpendingLimitAccount puts the spending rules in the account: per-tx and daily caps, a fail-closed allowlist, and a proof that what gets checked is what actually moves.
We reviewed it assuming the signing key was already stolen. Even then, the contract must prevent a compromised signer from bypassing the spending controls. The team addressed all findings before the final report.
6
8
34
7,981
Building on Lighter?
We're a Lighter Accelerate partner, so your audit just got cheaper.
nethermind.io/audit-subsidy-…
If you’re building on Lighter, we want to help you accelerate!
Check out @lighter_hub’s program for support, visibility, and perks from partners — including credits, discounts, and access to tools and services for your app.
272
Jacob at @particle_cs summed up Bloxchain Protocol's security review in one line: "Each layer caught what the last one left, and we fixed as we went." Bloxchain is a reusable library for approvals, time-locks and role-based controls, built to be dropped into other teams' EVM stacks.
The layers: AuditAgent with fixes between runs. Then an AgentArena competition, where independent agents on the same codebase caught what the scans had left. By the time our auditors opened the repo, the routine defects were already fixed and their time went to design and algorithmic questions.
auditagent.nethermind.io/blo…
4
2
9
900
We completed a security review of @1inch's Aqua and SwapVM.
Aqua is a shared liquidity layer where the same capital backs multiple strategies and tokens stay in the LP's wallet until a swap executes. SwapVM runs swap strategies as signed bytecode programs, so makers get pegged swaps and concentrated liquidity without deploying a contract.
The review covered 1,903 lines of Solidity across three repositories, with well-documented, well-tested code throughout.
1
2
9
21,009
AuditAgent's Findings tab is built for triage now, not just reading. Every finding shows who can trigger it, what config makes it exploitable, what's lost and who bears it, all filterable. Notes save with the scan. Export as JSON, MD or PDF.
auditagent.nethermind.io/
6
222
We completed a security review for @voicecc, a platform where users vote on the outcome of events to create an opinion economy. With Voice, users don’t have to pick the winning outcome to earn rewards. Everyone who votes is rewarded.
The review covered 2,386 lines of Rust across the Solana program, including deposits, off-chain reward commitments, and token validation.
5
22
8,444
We completed a security review of @VistaPex, a perpetual futures exchange on Avalanche. The review covered the protocol's pooled USDC custody logic and its offchain trade settlement path, which uses SP1 zero-knowledge proofs to verify offchain calculations onchain.
We reported 5 findings, all addressed swiftly by the VistaPex team. Full report:
github.com/NethermindEth/Pub…
1
3
13
1,007
Privacy bridges rarely fail at the cryptography. They fail at signature scope and the timing of state updates.
We audited Holonym's Aztec Bridge, which moves ERC-20s from Ethereum to @aztecnetwork while proving Proof of Humanity and Proof of Clean Hands, so transfers stay compliant and private.
The risk didn't sit in the ZK math. A signature issued for another Holonym use case could be replayed against the bridge, weakening its Sybil resistance. And Aztec's DelayedPublicMutable timing left two openings: a denial of service that would have made the deployed contracts unusable, and a nonce that could be reused because reads went stale between a scheduled state update and when it took effect.
6 findings, all resolved before mainnet. Solidity, Noir, the ZK circuits, and the credential logic, reviewed as one system.
nethermind.io/blog/auditing-…
2
1
11
829
Solidity accounts for 0.01% of The Stack v2, one of the main datasets AI coding assistants learn from.
So when one finishes your withdrawal function for you, it's guessing from almost nothing, in a language where a single wrong line locks funds for good.
Our approach is therefore trust but verify, and we hold our own tooling to it as much as anyone else's. Use AI across the workflow, whether you're brainstorming contract designs, scaffolding functions, or generating tests, but never ship code without manual review and thorough testing. Keep the human in control and keep your own engineering judgment sharp.
nethermind.io/blog/trust-but…
6
592
Formal verification isn't worth it for most code.
That flips at the infrastructure layer.
An app bug stays local. A verifier or zkVM bug hits everything that trusts it, and onchain there's no undo.
When does proof cost less than uncertainty? ⬇️
nethermind.io/blog/formal-ve…
1
1
7
642
AuditAgent's MCP server is live. Start a scan on your contracts and get the results straight in your coding agent
New accounts come with $50 in free credits, enough to run Auditor, our most in-depth scan mode, on your own code.
By popular request, findings can now be grouped by file or by topic too, not just severity. Makes triage a lot faster on a big codebase.
2
7
845
We started an audit of @0xNullEth.
Null is the first modular synthetics protocol on Ethereum. Its markets are permissionless, immutable, and provide exposure to any asset.
The review covers the full Solidity codebase, focused on settlement logic and ERC-4626 vault architecture.
1
10
2,604
We started an audit of @axol_io's PXE Bridge.
It exposes Aztec's shielded settlement to EVM intent solvers over JSON-RPC: solvers request note creation via a simple RPC call, and the bridge's embedded Aztec PXE creates the shielded note and generates the proof on their behalf, so solvers never need to run their own PXE or handle Aztec's private execution model themselves.
4
9
23
5,402
If you run an AI security scanner twice, the second turn usually starts from zero. It forgets your codebase, so you get the same false positives every time.
AuditAgent remembers. Every scan builds on the last, so the noise drops and the signal sharpens with every run.
3
2
12
686
That's Persistent Memory: a per-project knowledge base your scans build on, and one you can edit and check yourself. Run it as the pre-audit baseline, not a replacement for one.
See how it works → docs.auditagent.nethermind.i…
1
4
805
"We're audited" and "nothing can go wrong" aren't the same sentence.
An audit checks the code. It can't see the governance action, the manipulated oracle, or the contract someone composes on top of you next year. That risk only exists once you're live.
Secure by Design at Blockchain Rio, co-hosted with @HypernativeLabs. Us on the audit, them on runtime. Off the record with security leaders, protocol teams, and institutional builders on threat detection, incident response, and the calls that keep a protocol standing.
RSVP: luma.com/hypern-hfz3
1
5
532