Senior Independent Auditor | Lead Security Researcher @SpearbitDAO, See my work at https://nitter.gq/t.co/8oSflO2Pqa
Joined September 2013
- Tweets295
- Following348
- Followers627
- Likes589
Pinned Tweet
Security is a top priority for every #web3 project. While much is written about vulnerabilities, less focus is on practical steps for a secure lifecycle. Check out my guide, "The Complete Guide to Securing Smart Contracts," from design to deployment. github.com/optimumsec/comple…
Wild how hardware wallets normalized asking users to enter their seed phrase during firmware updates for years. No wonder scammers now copy it in phishing attacks. We deserve a better hardware wallet UX — current products honestly aren’t good enough.
If public blockchains ever power daily payments, merchants will see your wallet balance — and pricing models will change. Perfect info means perfect price discrimination. On-chain payments without privacy = a future where your net worth decides the price of your coffee.
In general I think the end game of blockchains will be to improve democracies. currencies and store of value is just the beginning.
The recent supply chain attack of that npm package emphasizes the importance of managing dependencies securely, especially pinning versions and auditing dependency's code, both for smart contracts and off-chain code,
for more info:
docs.optimumsec.xyz/coding/c…
Security is a top priority for every #web3 project. While much is written about vulnerabilities, less focus is on practical steps for a secure lifecycle. Check out my guide, "The Complete Guide to Securing Smart Contracts," from design to deployment. github.com/optimumsec/comple…
Oh gosh, the supply chain attack I was scared of for such a long time came true.
We still have a long long road 🫡
Least privilege isn’t just theory—it’s survival for smart contracts.
Learn how to strip power down to the minimum: docs.optimumsec.xyz/design/l…
DeFi & blockchain are still early — security isn’t solved yet.
To protect projects, we first need to map what can go wrong.
That’s where threat modeling comes in: start by identifying actors, their goals & attack paths.
Guide here 👉 docs.optimumsec.xyz/design/a…
Core/Periphery design finds the sweet spot between fully immutable and upgradeable contracts – secure core, flexible periphery.
📘 Read the full page: docs.optimumsec.xyz/design/c…
Been advocating for a while for web3 projects to have a head of security, got me thinking - how common is it for projects in our industry to have a head of AI?
Making smart contracts fully immutable from day one is risky. Keeping them fully mutable is risky too. The solution? A gradual path to immutability. Secure your protocol step by step:
docs.optimumsec.xyz/design/g…
Security is a top priority for every #web3 project. While much is written about vulnerabilities, less focus is on practical steps for a secure lifecycle. Check out my guide, "The Complete Guide to Securing Smart Contracts," from design to deployment. github.com/optimumsec/comple…
80 distinct pages already! check it out!
Security is a top priority for every #web3 project. While much is written about vulnerabilities, less focus is on practical steps for a secure lifecycle. Check out my guide, "The Complete Guide to Securing Smart Contracts," from design to deployment. github.com/optimumsec/comple…
Going to extend it soon to cover web2 subjects and ops security and many more, stay tuned!
Hey frens 👋 My smart contract security guide just got a glow-up — it’s now a GitBook 😎
docs.optimumsec.xyz/
8+ years in web3 have taught me many lessons. This is the first in a series I’ll share—covering building, investing, and maintaining long-term perspective in this space.
In the early days, the focus was on ideals.
Decentralization and immutability were considered essential. Projects that weren’t as decentralized as Ethereum were often dismissed.
Today, the biggest winners have been centralized exchanges and stablecoins.
Why? Because even centralized stablecoins provide enormous value. The legacy banking system is inefficient and slow. Simply giving people global, instant, 24/7 access to dollars is transformative.
Many early devs, myself included, didn’t fully anticipate this. We prioritized decentralization ideals without fully understanding the limitations and pain points of the existing financial system.
Lesson: pragmatism matters. Ideals are important, but listening to users and building products people will actually use is critical.
The same principle applies to security.
Early contracts were immutable by default. Devastating hacks showed us that bugs are inevitable and rigidity can be extremely costly.
That’s why upgradeable contracts have become almost the norm. Teams now incorporate pause functions, security councils, monitoring, and regulatory compliance.
More details here:
👉 docs.optimumsec.xyz/design/g…
Yes, some decentralization and immutability have been sacrificed. But at least transparency is preserved, and protocols are safer and adoption is wider. In my view, that tradeoff is worthwhile.
I remain very bullish on on-chain applications, but adoption takes time. UX and security challenges must be solved before these systems can reach broader use. Building something truly usable and secure is a long-term effort.
Lesson #1: Ideals inspire us, but pragmatism builds the future.
Future posts will cover lessons on investments, health, and navigating the long-term challenges of the crypto industry. Stay tuned.
Hey frens 👋 My smart contract security guide just got a glow-up — it’s now a GitBook 😎
docs.optimumsec.xyz/
Security is a top priority for every #web3 project. While much is written about vulnerabilities, less focus is on practical steps for a secure lifecycle. Check out my guide, "The Complete Guide to Securing Smart Contracts," from design to deployment. github.com/optimumsec/comple…
Updated guide on securing Web3 protocols! 📖 New section on contract deployment verification. Fresh from aiding a project’s launch (~$1B TVL in 2 weeks) Check it out: github.com/optimumsec/the-co…