ByteFable @ByteFable

Embedded Software Engineer | Smart Contract Auditor London Joined April 2010

Tweets

690
Followers

257
Following

1K
Likes

938

Sanford @0xiSanford

6 days ago

1/6 🧵 Just secured a $25,000 bounty for finding a critical bug using formal verification! on a newly deployed contract Thanks to @gegul_'s BugChain.xyz The bug was so subtle that traditional testing has missed it completely. This is why @CertoraInc method is changer

9 7 116 7K 74

Jeffrey Scholz @Jeyffre

4 weeks ago

It’s well known that most people who try to learn how to code fail, but what are the reasons for this beyond giving up too soon? Having sat down with people new to coding and trying to teach them, here’s my analysis: Programming is hard to learn because traditional education…

5 16 120 9K 86

ByteFable @ByteFable

4 weeks ago

Great catch and writeup by @giovannidisiena 👏The overflow behaves unexpectedly with uint8. While the byte itself wraps around, the upper byte(s) on the stack aren't zeroed out as you'd expect. This leads to subtle inconsistencies, which become apparent upon inspecting the stack.

Giovanni Di Siena @giovannidisiena

a month ago

6 16 162 9K 101

Download Image

1 0 2 184 0

Download Image

ByteFable @ByteFable

a month ago

Great to see @HackenProof restructuring their reward system to mitigate Sybil attacks 👏 docs.hackenproof.com/crowdsourced-a… They’ve also got the most active contests running right now! dailywarden.com

1 0 4 92 1

Kankodu @kankodu

5 months ago

How to drain an entire lending protocol when a new asset is accepted as collateral 🧵 And no, it’s not just another Compound fork.

5 10 165 13K 178

Download Image

0xGondar @0xGondarxyz

a month ago

How do you read code? I don't read it line by line, by flow by flow. Especially facing a complex codebase, I follow a certain flow, and ignore any other noise until I get that flow right, then I move to the parallel scenario and read the sections I skipped.

2 2 43 2K 8

Plamen Tsanev @p_tsanev

2 months ago

Shoutout to @DevDacian for 1 hour of PURE AUDITING ALPHA: - crystal clear vulnerability explanations - real world examples - personal auditing setup - auditing tips, how to correctly tag your code to make even the complex bugs more noticeable Lock in🫡 youtube.com/watch?v=AiNneU…

1 11 108 9K 128

chrisdior.eth @chrisdior777

2 months ago

Just stumbled across this, decided to spread it around. INSANE collection of ~180 Math resources: - Probability & Stats - Linear Algebra - Real Analysis - Calculus & Differential Equations and many more. github.com/valeman/Awesom…

7 88 449 26K 774

Download Image

pashov @pashovkrum

2 months ago

This is the biggest ERC4626 checklist that I've ever seen. More than 350 direct vulnerabilities, many pitfalls, integration errors and more. Every security researcher should know these and it can easily be fed into AI. Great work @DevDacian 🫡 github.com/devdacian/ai-a…

8 66 453 27K 613

Arsen @arsen_bt

2 months ago

7 cheat codes to break codebase 230% faster

3 8 65 5K 62

OpenSense ₿ @opensensepw

2 months ago

Tests are nice, but what if you could prove your contract won’t break? We’re firing up Halmos wtih @zokyo_io and @shanzson and going all in writing specs, catching real bugs, and tearing through a vault backdoor. Just raw code, broken invariants, and receipts.…

2 6 64 2K 8

Download Image

guhu @Guhu95

2 months ago

You can measure how vulnerable the code is after a contest. This can help: - Projects and users to estimate hack risk - Bug hunters to scope targets - Ecosystem to track what works best - Platforms to manage reputation risk TL;DR: More solo findings -> more hidden bugs. This…

9 10 107 9K 64

Download Image

Tigran Piliposyan @tpiliposian

2 months ago

I’m doing philosophy again, but I’m 1000% sure this 1-2 min read will help you. This is something that works everywhere, in web3 security, in development, in sports, in life. Yesterday during the morning BJJ session, a white belt guy showed up. i remembered him from about 2…

12 9 113 5K 42

Kris RenZo @KrisRenzo

2 months ago

This shouldn’t be a hot take, but I’ll say it anyway — the worse audit contests get, the more hacks we’ll see. 1. Fewer eyes are reviewing codes before they go live. 2. We’ve trained so many skilled hackers and failed to create enough legitimate opportunities for them. Guess…

CharlesWang @0xCharlesWang

2 months ago

2 0 15 7K 0

4 13 78 9K 9

Arsen @arsen_bt

2 months ago

If you want to understand how Uniswap V4 works open this:

2 8 88 7K 132

@bytes032.xyz @bytes032

3 months ago

I'm convinced this is an emerging industry with a massive TAM - we're talking tens of billions here. I've been thinking about this a lot lately because the amount of personal and work stuff I've automated over the past 6 months with Claude Code one-shotting stuff is…

Adam D'Angelo @adamdangelo

3 months ago

207 214 3K 1.5M 2K

Download Image

11 6 70 10K 40

lukasschor.eth @SchorLukas

3 months ago

100 ETH were assumed lost but could eventually be recovered. Here's what happened, how it became a happy ending and what's needed to prevent this from happening again. Context A user of Safe{Wallet} wanted to bridge 100 ETH from Mainnet to Base. But then they realized that they…

khalo @khalo_0x

3 months ago

415 194 3K 834K 748

186 210 1K 409K 365

Radcipher @radcipher

3 months ago

People think spotting bugs is about being a genius. It’s not. It’s pattern recognition + reps. From knowing almost nothing to competing in @code4rena, @CodeHawks, @sherlockdefi & @cantinaxyz, here’s the #1 thing that helped us catch real bugs in top contests 👇

5 17 142 9K 102

pashov @pashovkrum

4 months ago

All security auditors and companies have missed Critical/High severity vulnerabilities. Here is one of these cases, which happened with a review we did. It was a strong and hard audit, with a ton of vulnerabilities - actually one of our most favorite audit reports. Still, it's…

7 5 127 7K 44

hexens @hexensio

4 months ago

A DeFi edge-case exploit just drained $300k from Impermax V3. It involved flash loans, mispriced uncollected fees, and a clever tick manipulation to wreck collateral valuations. Here’s a full technical breakdown of how it happened: