OtterSec
@osec_io

Audits that protect blockchain ideas.

osec.io
Joined February 2022
220 Photos and videos
Pinned Tweet
OtterSec
@osec_io
Jul 9
Article

Anchor security update: what’s shipped since February

Since taking ownership of the Anchor release process (announced on the February community call), we've been working on securing how Anchor is built and shipped. While we have multiple improvements to

7
6
44
12,416
OtterSec retweeted
Robert Chen
@NotDeGhost
Sep 24
Txv1 is live, and Anchor 0.30.2, 0.31.2, and 0.32.2 support receiving it. If you're still on old coral-xyz/anchor packages, update to anchor-lang/core and friends Anchor 1.2.1 is coming soon with support for receiving *and* sending Txv1 Thanks @clubby789 for pushing this through!
1
7
30
1,390
OtterSec retweeted
Velocity
@VelocityDEX
Sep 16
1/ Velocity completes its audit with @osec_io. The protocol is now open source, leaner, and safer. The full report and source code are now public.
Velocity
@VelocityDEX
Sep 16

Velocity completes Audit with OtterSec. The protocol is now open source, leaner, and safer.

Velocity today published the OtterSec audit of its protocol and opened the protocol’s source code. Everything built since the fork has been externally reviewed with no critical findings, and every

9
5
75
25,960
OtterSec retweeted
Ethan Mollick
@emollick
Jul 29
Those who follow my feed know that I test new video models by having them show an otter using a laptop on an airplane. The new Flux 3 video model is really good, so I had it do a variation on theme, which will become apparent a couple seconds in. See the change from 2 years ago.
Ethan Mollick
@emollick
2 Jul 2024
In October 2022, “an otter on a plane using wifi” typed into an jmage generator created nonsense first try. In July, 2024 the same thing typed into a video generator (plus “on a computer”) gets this first try. Not quite an otter, but look at the lighting & details. Quick pace…
24
54
952
118,979
Interesting data on the current phishing and wallet threat landscape. Excited to help contribute to this report alongside @okx
OKX Wallet
@wallet
Jul 24
In H1 2026, we blocked 10M+ risky site visits and flagged 4M high-risk signatures. Our Web3 Security Report with @SlowMist_Team and @osec_io shows how threats are evolving, and how protection starts before you sign. Read it here: web3.okx.com/learn/security-…
14
2,793
OtterSec retweeted
es3n1n
@es3n1n
Jul 14
Today, we’re releasing rCTF v2, an open-source platform for hosting cybersecurity capture-the-flag competitions.
The signature rCTF wordmark, white on black with red accenting. A red stylized “v2” sits slanted on the bottom-right side.

ALT The signature rCTF wordmark, white on black with red accenting. A red stylized “v2” sits slanted on the bottom-right side.

A screenshot of rCTF's matrix-style leaderboard displays teams as rows, challenges as columns, and their intersection as the team's solve status on that challenge. Each team has a custom avatars, country flag, and tagline. A sparkline shows the team's scoring activity. The top-left corner of the leaderboard displays a line chart, plotting the visible teams against each other.

ALT A screenshot of rCTF's matrix-style leaderboard displays teams as rows, challenges as columns, and their intersection as the team's solve status on that challenge. Each team has a custom avatars, country flag, and tagline. A sparkline shows the team's scoring activity. The top-left corner of the leaderboard displays a line chart, plotting the visible teams against each other.

A screenshot of the rCTF's challenge listing. It is panel-style; the left side displays all challenges within the event, while the right side displays the details of a particular selected challenge (the challenge's description, attachments, and any custom instancing).

ALT A screenshot of the rCTF's challenge listing. It is panel-style; the left side displays all challenges within the event, while the right side displays the details of a particular selected challenge (the challenge's description, attachments, and any custom instancing).

The platform's admin view allows for viewing and auditing of the submission logs from all teams. A complex filtering system allows filtering against (non-exhaustively) challenge names, submission results, and time intervals.

ALT The platform's admin view allows for viewing and auditing of the submission logs from all teams. A complex filtering system allows filtering against (non-exhaustively) challenge names, submission results, and time intervals.

15
104
599
49,096
OtterSec retweeted
Robert Chen
@NotDeGhost
Jul 7
We're launching a $100,000 fund to save CTFs.
17
105
645
65,718
OtterSec is happy to sign the OPSeC pledge and keep pushing for strong security practices across the teams we work with 🤝
asymmetric research
@asymmetric_re
Jun 23
The Open Protocol Security Coalition (OPSeC) is a new initiative by @fund_defi, in partnership with @_SEAL_Org and Asymmetric Research. What it does: → Curates existing, free cybersecurity resources → Hosts educational events → Engages with policymakers and regulators
2
24
4,311
When Hyperliquid has to clear bad debt, who covers it? We reverse-engineered the closed-source risk engine, verified some core properties & compared it to other perps. It's not neutral: the more leveraged and profitable your position, the sooner it's closed. Full breakdown ↓
9
28
211
44,393
osec.io/blog/2026-06-22-hype…

Auto reverse-engineering the Hyperliquid risk engine, with some agentic help

Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid’s risk engine to show how it ranks and...

osec.io
2
2
51
5,853
New research: We were able to access camera permissions and obtain user GPS coordinates across 20+ major mobile wallets by exploiting WebView misconfigurations. Here's how ↓
2
24
114
15,579
osec.io/blog/2026-06-18-gold…

The goldmine of insecure WebView integrations

WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authori...

osec.io
5
21
1,974
Anchor v2 docs are live!
4
7
46
4,296
Benchmarks, migration guide, and reference: v2.anchor-lang.com/docs

Anchor

A framework for building Solana programs, clients, IDLs, and workspace tooling.

v2.anchor-lang.com
5
1,663
OtterSec retweeted
OtterSec
@osec_io
Jun 2
The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. @ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.
8
48
311
19,324
Our research team achieved client RCE on Minecraft Bedrock Edition via a heap overflow to bypass ASLR and sidestep CFG. Writeup to come.
59
259
2,922
227,236
Full writeup: osec.io/blog/2026-06-02-mine…

Pwning Minecraft: 4-byte heap overflow to RCE

We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary...

osec.io
1
5
653
The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. @ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.
8
48
311
19,324
osec.io/blog/2026-06-02-mine…

Pwning Minecraft: 4-byte heap overflow to RCE

We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary...

osec.io
1
9
29
2,429
We're a day late, but happy World Otter Day 🦦
2
1
17
1,161
OtterSec retweeted
Robert Chen
@NotDeGhost
May 24
how to save 38.2% of Solana CUs:
9
9
93
19,660
Load more