Will I be unemployed by the end of the year? The desired answer is Yes Hey, I'm deth, founder of @EgisSec and ex-Certora security researcher I've felt that auditing/web3sec twitter has been pretty stale recently, so as an introvert and someone who is shit at writing I plan to change that For the next ~4 months I'll be building Egis in public with concrete numbers, concrete methodologies, what I learned, what I did good and things I did bad The above question has a loaded answer, so if I fail with Egis I'll be forced to get a job, which is a no-no for me The North Star for this "challenge" is purposely vague, but it's the only one that makes sense to me and how I set goals > Will there be a point working on Egis in 2027? If it's yes then I'll continue with the series and continue being unemployed, if it's no then I'll be looking for a job This community, and auditing itself, has given me so much, I've made so many friends and it's genuinely changed mine and my family's lives With this series I hope I can bring back a small spark of that community back, at the very least there will be someone you can talk shit about on the regular So follow me if you want to follow my, hopefully not short, journey as a businessman and follow @EgisSec for technical content, bug breakdowns, tools and AI in web3 security Stay safe

If your backend or relayer acts on an emitted event, it can be lied to. The EVM never checks that a log matches the state it claims. A contract can emit a transfer that moved nothing. EventSpec reproduced it on bridge relayers. arxiv.org/abs/2609.07865 A log is a claim, not a receipt.

Does your protocol give out anything per address? High severity issue we found while auditing a raffle project. An address with one Wei staked had the same odds of winning as the largest staker. 1️⃣ Project summary Lotus is a staking protocol. You lock LOTUS, your position earns shares, and five percent of every reward distribution funds a separate raffle pool. Every two weeks that pool pays its whole jackpot, in TITANX, to one staker, drawn with Chainlink VRF. 2️⃣ The bug The pool holds its participants as a set of addresses, and the draw is one line, index into that set with the random word. One address, one ticket. Stake size doesn't appear in that line. Entering the set was a side effect of staking, with no threshold of its own. One share put an address in, and one share was one wei of LOTUS. The randomness was never the problem. What the random number indexed into was. 3️⃣ The attack path 1. Stake a wei of LOTUS from an address. That address is now a ticket. 2. Repeat from a substantial number of addresses. 3. Every honest staker's odds drop, whatever they locked. The protocol priced a raffle ticket in gas and priced everything else in stake. 4️⃣ Fix The client shipped a minimum stake to enter the draw. Run the split test on anything you weight. If splitting one position across ten addresses beats holding one, you don't have a weighting, you have a headcount. If you have the same pattern in your codebase, contact us so you don't repeat the same mistake. egissec.net

Can't afford an audit? Talk to us anyway Although we are a boutique firm and our prices are higher than most, passionate founders that are very invested in what they are building deserve our time, even if they don't have the budget for us

This is still happening btw

Do you review your own contracts before an audit? @AwareXone has skills that cover 10 different bug classes using a knowledge base consisting of target scoring, bug patterns, grep arsenal, PoC templates and real case studies. Check them out below ⬇️

Day in a life of an auditor > Cold DM protocol > Protocol is interested and wants a quote > Quote is sent > Ghosted Bruh

If every user of your protocol delegatecalls into one shared helper contract, this affects you too. On 1st of September, four forgotten Reflexer vaults were drained for 5.9436 ETH by two rules that are both correct. 1️⃣ Summary Reflexer's GEB is the engine behind RAI, a stablecoin you mint by locking ETH in your own vault. Nobody calls the vault manager directly. You delegatecall a shared helper from your own proxy, so address(this) is your proxy, recorded as the owner. 2️⃣ The bug Rule one, record address(this) as the owner. Correct under delegatecall. Rule two, let only the recorded owner move a vault's balance. Correct on its own. In 2020 someone reached the helper as a plain call instead of through a proxy. address(this) was then the helper itself, so vaults 3, 5, 8 and 18 ended up owned by a shared contract whose migration function, quitSystem, is public and unchecked. The manager compares the caller to the recorded owner, sees the helper on both sides, and says yes. Nothing was bypassed. 3️⃣ Attack path 1. Reflexer has been in permanent settlement since January 2021, so anyone may cancel a vault's debt. Do that for all four, leaving debt free ETH in each. 2. Call that migration function directly, once per vault, moving every balance to a handler you control, then exit through the ETH adapter. Four vaults, one transaction, five years after that owner field was written. Delete either rule and the ETH is still there. An access check is only as trustworthy as whatever filled in its owner field. If you have the same pattern in your codebase, contact us so you don't repeat the same mistake. egissec.net

There's no shortage of audits There's a shortage of reasons to pick you

My man cooking

I've been cooking hard over the last few weeks to get my new project @Stature_finance up and running. After billions of tokens and not seeing the sun for a while, I submitted the first version for the @solana Stocklana hackathon today. Stature will be the easiest and cheapest way for end users to buy tokenized stocks. Now I still have about 2 weeks left to add more functionality, start the beta, and get the first people to actually invest using the app before I hand it in for the big Colloseum hackathon. I'm a complete newbie at videos, but my assistant (he loves to eat tokens) and I got it to look really decent, so I'll share it here with all of you Also, check out the website/waitlist -> stature.finance

> Be Bob > Bob conducts an audit > Audit finds Critical > Bob waves it off as “out of scope” > Bob gets drained the moment he deploys live > Don’t be Bob

"This video will restore your faith in humanity" The feeling I get from watching those videos is the same one I get using Opus 5.5

Intended and safe are two different things Just because this is you “intended” design doesn’t mean it’s a “safe” design Auditors raise a hand if this ever happened to you 🖐️ And protocols/founders please listen to your auditors

I hear this shit everyday > "We already engaged a firm" - Ok, which one? Ghosted > "We've conducted an internal review" - So you are not only developers, but auditors too? > "We'll keep you in mind for future reviews" - So you'll contact me when you get exploited? Take security seriously please

I've outreached to 10 teams that recently went live on @arc recently All live, all holding funds, 0 audits between them I connect with them and I ask, what's the timeline on a security review and if @EgisSec can help (even tho they are already live...) Their responses: > "We conducted one internally, an external audit isn't necessary" > "We already engaged a firm" (I followup by asking which firm and I get ghosted) > Seen I got kicked out of 1 tg group because I asked publicly and they didn't want me to cause "fud" People, if you are using a product that doesn't have a security review, you have no business using that product

Website redesign is 95% complete, stay tuned.

Same