Apparently, the @spillways10 staking contract was hacked, and funds have been draining for the last 200 days. I was approached by a stakeholder to investigate the hack and I happily agreed. A thread:

One year ago "how-to" was a valuable skill. Now with Claude code, "how-to" is cheap and has barely any value. Now, "what-to" is the important skill.

Crypto Drainers using React CVE-2025-55182 We are observing a big uptick in drainers uploaded to legitimate (crypto) websites through exploitation of the recent React CVE. All websites should review front-end code for any suspicious assets NOW.

So well deserved

Here is one of the latest audits I've done, for @iMacroMillions. The most interesting issue is [C1]. Not because it is critical, but because it is a small edge case magnified to the point of breaking the entire protocol. The team response was great, and they fixed all essential issues. github.com/JacoboLansac/audi… See my complete audit portfolio: github.com/JacoboLansac/audi…

Legendary stats of a legendary engineer. Looking forward to seeing what you do next

Audits are really expensive, but you already knew that? Yet you still do nothing to minimize the cost of your audits... You're throwing money at the problem and hoping it'll magically solve everything... A lot of elite teams do a simple trick that saves them thousands and it's called "internal reviews". This is when the developers audit their code. This is not them casually looking around for anything interesting during development - this is a dedicated, structured process they schedule. Here is how they do it: Before the actual audit set a reasonable time frame (50% of what the auditors quote you for as the devs already know the code). During that time only review the code, don't add new logic, don't add new mechanics, only focus on security and reducing complexity/unnecessary code. This might seem trivial, but will actually save you a ton, especially if your code is littered with bugs. Here are the benefits: 1. Your reports will look better, as they will have fewer bugs 2. You will catch most simple bugs allowing auditors to focus on the more complex parts 3. Audits will be faster as there will be fewer fixes, allowing you to launch sooner 4. You may only need 1 audit, whereas without this prep you might need multiple

I wish I had known this audit hack earlier: Type `ctrl shift <` in VScode to jump between function declarations. It also tells you if it is a view/internal/public/pure function with a small icon. Note: it requires the Solidity Visual Developer extension by @ConsensysAudits, which is a must anyway.

Every single article I've read from @RareSkills_io was a good investment of my time. Truly impressive and inspiring. Very rarely we see such high quality/quantity ratio. Very Rare.

Try F11 before ADHD medication

Shill me your best Rust-based cli (for Linux)

This is one of the most frightening attacks I've seen. To see if your proxy is currently hijacked, paste a tx hash to your contract into @TenderlyApp TX simulator, and see if delegates twice to reach your impl contract (more details in the article). Legendary work by @deeberiroz for discovering it, and @dedaub & @pcaversaccio for coordinating such a multi protocol mitigation. dedaub.com/blog/the-cpimp-at…

This is so true for any aspect of life that compounds. Sports, knowledge, learning a new skill, programming, auditing... Perhaps we should measure our progress in a log scale

Business logic errors will be the last category to be automated because of being project-specific.

Even if you don't implement invariant tests as part of your audits, you MUST think in invariant terms. Force yourself to think about system properties to be beyond line by line auditing.

I'm trying @envio_indexer and it is just lightyears better than TheGraph. Blazing fast, super easy to get started, great docs, great local testing framework and great deployment process. RIP TheGraph. Thanks @PaulRBerg for the recommendation.

AI won't replace you. A version of you who knows how to use AI will replace the version who doesn't.