Some news: I’m no longer at Aztec following the recent restructuring I’m on the hunt for a new role in DevRel or technical sales, so if you’re hiring, reach out! In the meantime, I will be getting back to making videos again after a much needed rest 🩷

If you don't know the current situation in @code4rena, here is the brief: Code4rena hosted K2 competition, which was the last one before announcing a winding down. After distributing rewards to participants and sending judging fees, two SRs, @MaxZuvex and @0xArav, found what appears to be a Sybil attack. They found that two wardens created their accounts days before the competition ended and submitted findings clearly copied from other wardens' work. One submission belonged to a less-duplicated issue group, which increases their profit, and the other one was a QA report that resembles another warden's QA report and got 1st place. Code4rena Team believes that the Judger is the one responsible for this, as he was one of the few people who had access to the submission before closing. Code4rena was able to recover funds from these 2 newly created accounts (propabbly as KYC process and newly created account payout delays). Code4rena asked the Judger to return the funds, but he has not responded to date. C4 head judge will review the issues, remove duplicate sybil issues, review QA reports, and post the final result, and wardens will receive the amount deducted from their reward.

Every SR who's ever submitted a finding in contests/bounties has operated on the same quiet assumption - *hope the privileged roles dont rip you off* this was one of those rare incidents that showed.. such assumptions are assumptions after all K2 was Code4renas' last ever contest, hours after the report was made public - @MaxZuvex and I observed some things - that were too good to be just coincidences after some digging, we found more and more undeniable proofs that all pointed to an exploit by none other than - the judge of the contest this contest also had one of the highest Judging rewards $9.5k - and apparently that wasnt enough we'll withdraw from sharing further as this could've been a rare mistake by the individual. In truth however- this is more than any single person, recording such incidents in public is how better systems can evolve. Respect to the C4 team (esp Cloudellie / Bytes32) for being supportive throughout and handling it with real transparency "The happy ending we want to celebrate is that in the end, it was members of the Code4rena community who stood up and called out misbehaviour, and helped us make things right." peace _/\_

We just can't stop learning new stuff every day 🤯 ... I thought my list of forcefully sending ETH to smart contract was complete, but apparently not: 1. SELFDESTRUCT opCode — can select a smart contract to receive the ETH balance of another smart contract. No receive() triggered. 2. Pre-deployment — If we are able to calculate the smart contract address before the deployment time we can fund it with ETH. Deploying with non-zero balance isn't going to revert. 3. Crediting the block priority fees — the validator who is the current block producer can place a smart contract address to receive the block priority fees. No receive() triggered. And now adding 4. as explained by @ProgrammerSmart's tweet. thank you ser 🫡

They should investigate all team mates that had access to the reports Not only dadekuma. Cos why do you assume he is the culprit. Protocol team can be the one because what stops them from doing this to dilute the pot. We have seen instances that teams downplay just no to pay

fantastic breakdown of frame transactions from @forshtat piped.video/watch?v=5UTJf74A…

Layoffs data. Very informative cryptojobslist.com/crypto-la…

We are hiring a security researcher at @aave Join us to review our smart contracts, build our AI-assisted tools, and help secure the ecosystem You will work directly with me, have room to experiment, and develop new approaches as our industry evolves aave.com/careers/protocol-se…

🚨 Web3 security researchers, STOP SCROLLING. This entire playlist is FREE. 8 deep dives into auditing, stateful fuzzing, formal verification, L2 + bridge security, ZK circuits and more. This is hours of serious security education. SAVE IT. piped.video/playlist?list=PL…

What the fuck is up with contest platforms??

The single most powerful habit in Web3 Security Reading the code I’ve spent 2+ years and read +220.000 lines of DeFi & Blockchain code finding the most effective way to uncover bugs Here’s what I’ve found:

Found a bug that allows 2,677 CVX loss, about $6,000 depositors funds at risk. Anyone can: 1. Manipulate the protocol zap contract 2. Call a permissionless function 3. Reverse the price and walk away with $6k I responsibly disclosed the bug to the team, guess what happened?

txgraph.org/ - Visualize transaction - Compiles and visualizes Solidity contracts - Code navigation if contract compiled