We completed the security review of @LidoFinance NEST: automated LDO buybacks and DAO-owned liquidity. The report is public. How NEST works, what we found, what shipped ↓

Yes.

Our kernel patch to @luceboxai helped speedup DeepSeek V4 Flash on AMD ROCmFPx cards Sharing is caring, enjoy!

this guy will have some talks about AI security at @summit_defi

What happens when a web3 company applies its values to its own tech stack? 🤔 @ack3ai co-founder & security researcher, @jaczkal is joining Devcon 8's Privacy & Consent track to share the reality of building a company without relying on Google Workspace. See you in Mumbai, Jan!

Lately we use GPT far more than Claude The @OpenAI Daybreak verification provides @ack3ai access to unrestricted cyber defense ▮

there were some questions about fuzzing efficiency lately, so I better explain how manually guided fuzzing works. let's use the @LidoFinance stonks CI wake tests as an example lido stonks: sells lido treasury tokens on cow swap at chainlink prices. isValidSignature accepts an order only while the quote stays within tolerance and improvement cap wake fuzzing sequence (4x per CI run): - fork mainnet at a random block (21.0M to 25.7M) - deploy stonks against the forked chainlink feeds and cow swap contracts - draw a fresh stonks config: margin and tolerance 0 to 10%, improvement cap 0 to 10% or off, max chainlink feed age 60s to 24h wake fuzzing flow (100x per sequence): - fund stonks with a random amount of the token it sells - python model predicts the quote: decimals math minus margin - place the order: a signed cow swap order that any solver may fill at or above floor = max(quote, minBuyAmount set by the lido manager) - call isValidSignature, the check cow runs before filling: it recomputes the quote vs the floor. model predicts pass or the exact revert: zero quote, down past tolerance, up past improvement cap - move the chainlink price ±10% by writing the aggregator's storage, call isValidSignature again - expire the order, recover the tokens model vs contract mismatch = failed run 416 lines of python. bookmark it now, thank me later github.com/lidofinance/stonk…

Static analysis increased precision for all 3 GPT-5.6 models in Michal Převrátil's ETHBelgrade audit benchmark. Each model audited the same Go codebase with and without static-analysis MCP tools. Precision is the percentage of reported issues that were real: Sol: 80.9% with MCP tools, 79.6% without Terra: 78.0% vs 72.3% Luna: 72.7% vs 66.7% All 3 models dismissed more false positives with the MCP tools, which is why precision rose. The models used the MCP tools: Sol: 128/168 audit runs Terra: 54/168 Luna: 162/168 The two models that used the MCP most also had the largest LLM cost increases: Luna +14.3%, Sol +13.2%. Terra used it least and cost rose 1.1%. Recall is the percentage of known issues found. It improved for 0 of 3 models. Higher MCP use and higher LLM cost did not produce higher recall. Full method, results and cost breakdown > ack3.ai/research/ablating-st… ▮

Metropolis is live: @monad's six-week hackathon. $250K across four tracks. We're happy to sponsor the hackathon. All builders will meet us as mentors and finalists will have access to the most powerful ack3 AI security scan. Build something worth scanning nitter.net/monad/status/209482688…

AI audit engines are launching across web3 security, and ack3's AI scan runs with our manual audits and inside @sherlockdefi Audit Engine. The recurring failure in agent-written harnesses is the correlated oracle. Example test contract: deposit() credits msg.value * 2 by mistake. An agent that derives the differential model from this code reproduces the same multiplication, and assert expected == balanceOf passes. The test agrees with the bug because it was derived from the bug. A correlated oracle does not fail; it stays silent. The countermeasure is an invariant independent of the implementation, for example: credited balances must never exceed assets held. Whether an agent can state what a contract should do, instead of translating what it does, remains the open question of agentic tooling. Our verification rule: no agent-reported finding counts until it replays against a fresh deployment. Builds, runs, passes is not a security model. Full measurement write-up > ack3.ai/research/benchmarkin…

At @ethbelgrade, @michprev demonstrated how static analysis affected recall in an AI audit. Three GPT-5.6 models audited the same Go codebase with and without static-analysis MCP tools. Recall is the percentage of known issues found. Out of 55: Sol: 38 with MCP tools, 39 without Terra: 32 vs 34 Luna: 32 vs 32 Static analysis improved recall for 0 of 3 models. ▮