Security Researcher @QuillAudits_AI | Ambassador
🌏
- Tweets 2,298
- Following 487
- Followers 398
- Likes 7,654
Pinned Tweet
I witnessed firsthand how a protocol could live with a live bug (and possibly never catch it) because there's no way to responsibly disclose these issues.
In a review with @QuillAudits_AI , an RWA project <redacted> had forked a portion of @DinariGlobal's code but requested we treat it as a black box.
(Un)fortunately, I tend to digress when not working with code I'm familiar with -- and stumbled on a sizeable vulnerability in their codebase
Thankfully it wasn't exploited before it was patched, but they had ~$3m at risk (which grew to $60m in less than 4 months), big liquidity injection in RWA's this year (and likely for the next few years)💰
While this isn't Yearn-scale, many small drops fill a barrel.
Josselin has been talk about the need to beef up internal security -- this awareness is something I expect to grow as well, and this exploit is another example why
(ty for your talk with Rajeev and Alex at DSS).
1
10
700
Anu retweeted
AI has solved security but somehow we have more work to do than ever before
14
3
61
3,876
Anu retweeted
We’re starting Quill Findings 🥷
Detailed write-ups of real issues from client audits. What we caught, why it mattered, and what the fix was.
First one: Eligibility Replay in Tokenized Assets.
A gold-backed vault where the bar left and the custody certificate did not. That leftover NFT minted a second claim.
Full breakdown below 👇
2
3
16
732
This critical severity issue would have caused permanent asset loss. It proves really useful (time and time again) to not overlook an external audit before going to production.
ERC4626 vaults are interesting DeFi use-case. Adding on delays to make vault functionality asynchronous increases the surface of risk and trust assumptions.
For this audit, we consumed lots of resources on ERC7575 and ERC7540 to understand the tweaks made to the regular vault mechanism.
Happy to lend an unbiased pair of eyes to any developers pushing new changes. Reach out and I'll connect you to the best auditors on the team @QuillAudits_AI .
1
6
108
OpenAI is closing the door to new subscribers on its $200/month ChatGPT Pro plan.
Starting yesterday, September 10, @OpenAI is temporarily pausing new sign-ups and upgrades to Pro 20x. Existing subscriptions will continue to renew, and the $100 Pro plan remains available.
The catch: If you cancel or downgrade and let the change take effect, you can't get the $200 plan back until the pause is lifted. You can still reverse a scheduled cancellation before your billing cycle ends.
No reopening date is given. For anyone relying on the highest usage limits, that's a pretty consequential change.
3
131
Anu retweeted
RWA security is not an ERC-20 review with extra steps.
$38B already live. $355B represented. Almost all of it sits on three standards:
3643: identity + freeze/force
4626: share price + rounding
7518: partitions + lock math
This is the attack surface. Checklists in the thread 👇
On-chain RWAs have crossed $38B in distributed assets, representing $355B in assets and reaching 2.9M holders.
All of that value runs on a handful of token standards. Each one has a live attack surface, and the industry is short on people who can find the bugs.
We wrote the checklists. 🧵
2
5
26
1,597
🏆
August was one of those months where you just sit back and feel genuinely proud of the team.
Our audit team @QuillAudits_AI absolutely crushed it: ✅ 12 projects audited - all delivered on time
🔍 155 findings identified
Huge kudos to @kalp_eth, @Pro___King1,@phoenix244001, @cryptanu, and @turvec_dev for the exceptional work and relentless commitment to securing Web3.
Hats off to you all. On to the next one....
3
122
A good book sparks a new web of thinking and subsequently sponsors new actions.
If you're a frequent traveler this book here is a useful bite-sized read to improve your safety score.
Thanks to @_SEAL_Org and @theredguild
1
5
89
Anu retweeted
Bring Solana to your campus, help classmates ship, and build a community.
We're opening applications for the Solana University Ambassador Program.
Two undergrad ambassadors per campus will work directly with @SolanaFndn and receive hands-on training, funding, perks, swag, and access to a global community of peers.
Apply now: solana.com/university
70
95
603
171,204
Anu retweeted
🚨 @term_labs was hacked for 8.5M in a governance exploit.
The attacker didn't break governance. He was the governance. Across 7 USDC vault proposals attacker held 100% of the voting power, and drained 5 of those vaults. In the ETH Meta Vault attacker was the majority holder.
2,841.74 WETH and 1,679,639 USDC were drained across six vaults total, the USDC later swapped to DAI.
Attacker EOAs
etherscan.io/address/0xD5183…
etherscan.io/address/0x68645…
etherscan.io/address/0xa908b…
Example Attack tx
etherscan.io/tx/0x284fc544f3…
etherscan.io/tx/0xca084d9489…
2
4
31
1,574
nitter.net/cryptanu/status/208023…
@phoenix244001 has 💯% has the multisig details you'll need.
The most expensive click in crypto was a multisig approval.
In February 2025, Bybit signers approved what looked like a routine transfer.
The transaction was a delegatecall that rewrote the Safe’s implementation.
$1.5 billion left in minutes.
No smart contract was exploited.
The signers were.
This pattern has continued.
Over $1.7B has left secure multisigs in the last 18 months through hidden delegatecalls, silent config changes, and thresholds that quietly drifted.
We’re going live on this exact problem.
2
91
...alpha coming from chads actively involved in securing Ethereum, I'll be there! 🛠️
This Thursday, we’re kicking off TheDAO’s monthly Ethereum security Spaces with OpSec.
Set your reminder and join us for a conversation on operational security and the risks that live outside the code.
nitter.net/i/spaces/1qxvveebjzlxB…
3
16
264
