DeFi Security | Tier-1 Security Audit Firm | Top-2 in @Paradigm and @OpenZeppelin CTF | Public audits: https://xitter.cf/t.co/CqYGRNibvj
Joined October 2011
- Tweets361
- Following73
- Followers3.6K
- Likes111
Decurity retweeted
DeFi exploit odds are now tradeable on @Trueo_.
Want to know about the hack before CT does?
Shhh… you didn't hear it from us 🤫
defimon.xyz
You can now trade protocol revenue and exploit odds. We're partnering with Trueo to launch new prediction markets that settle based on DefiLlama data.
Revenue Markets
If you follow the revenue meta, you can now trade that directly on Trueo. We launched markets for Hyperliquid, Pump, Aero, Uniswap, Collector Crypt, and Papertrade revenue.
Exploit Markets
Hedge against exploit risk by trading the odds of total DeFi hacks and exploits of specific protocols. We have markets for whether there will be exploits of Aave and Morpho this month. We also have weekly and monthly markets for the size of the largest hack.
Other Onchain Metrics
Robinhood Chain RWA mcap, Robinhood Chain DEX volume, and whether Solana or Base ends the week with higher TVL.
defillama.com/predictions
Another area was calldata handling.
Aqua and SwapVM make extensive use of low-level Solidity and Yul, where offsets and lengths need to be handled carefully.
Our reviews covered bounds checks, malformed inputs, and edge cases in calldata parsing.
The audits were iterative: we identified issues, the 1inch team addressed them, and we reviewed the updated code.
We repeated this process until the remaining issues were exhausted and subsequent reviews produced no new findings.
Glad to have worked with the @1inch team on Aqua.
Audit reports:
decurity.io/audits/1inch
Decurity retweeted
Projects accepted to the program will have access to a group of leading auditing firms, including:
- @ack3ai
- @Certora
- @cyfrin
- @DecurityHQ
- @GuardianAudits
- @hexens
- @Nethermind
- @SecurityOak
- @OpenZeppelin
- @0xorio
- @PashovAuditGrp
- @sherlockdefi
- @trailofbits
Projects will be matched based on their requests, audit scope, technical requirements, and auditor availability
Decurity retweeted
Built jevscan - a Chrome extension to detect malicious addresses and transactions on @etherscan in real-time using Jev from @typesafeai.
Decurity retweeted
Have you heard about ERC-7715? It allows a dApp to request human-readable permissions from a user's smart account to act on their behalf. E.g. stream fixed amounts of tokens or revoke approvals.
So it made me thinking what if it could allow a watcher service like @DefimonAlerts to withdraw a position from your wallet if a threat is detected? Operational 24/7 on its own, without a hurry to open your wallet to submit a withdraw tx.
The only wallet that supports this kinda experimental tech is @MetaMask (new users get 7710 smart accounts by default). However MetaMask supports only a limited set of permissions that do not allow fixed calldata (which makes sense).
That's why I decided to expand the allowed permissions with `erc20-token-swap` which allows to swap your DeFi positions into safe stablecoins in the event of a protocol hack. PR: github.com/MetaMask/snap-771…
Inspired by revoke.delegate by @ayushbherwani ethglobal.com/showcase/revok…
🆕 verifyoor: an agent loop to verify a Solidity smart contract from EVM runtime bytecode alone - reconstruct source + compiler settings that recompile to byte-identical bytecode.
demo: etherscan.io/address/0xbdd07…
source:
github.com/Decurity/verifyoo…
Decurity retweeted
Yesterday we reported a governance attack to @ZKPanther which drained 5.12M base:0x0a776c1c22b8b8e7eab346744daa33722b80fda4.
Attacker submitted a governance proposal named "zkp-reexploit" to upgrade each ZKP proxy to the drainer impl. Then they posted a "yes" answer with the 0.5 ETH bond. No honest party counter-bonded a "no" within the 12h timeout + 8h cooldown. The answer finalized and the module dutifully executed the drain.
We do our best and always try to contact the affected team. However it's impossible to contact every DeFi protocol, especially with the number of AI hacks accelerating each day.
So, teams: our real-time feed is just one prompt away from integrating into your incident response pipeline. You can filter contracts by your scope and send immediate alerts to Slack/PagerDuty.
defimon.xyz
Decurity retweeted
📢 We post all verified alerts to Defimon Signals Telegram channel. Some may be big hacks like the recent Ostium $20M loss and some are small sub-10k drains. Since it's not our job to decide which alerts are useful to a particular user, we post all of them.
If you need to respond to certain alerts and deprioritize others, the best way is to do this is to subscribe to our Websocket API and receive full raw feed of all our alerts (including non-verified) in real time.
The cost is only $200/month, ~20 times cheaper than Hypernative or other providers!
What's included:
— Defimon Signals Telegram subscription,
— API access to the signals (confirmed attacks)
— API access to all raw alerts (instant events before LLM verification)
— 1 key to all 8 supported chains.
Subscribe on the website defimon.xyz/subscribe or using the bot t.me/defimon_subscription_bo…
Decurity retweeted
Btw, we wrote a kick-ass article about the vulnerability. A very interesting read:
hexens.io/research/aptos-hij…
We’ve lost count at this point. 😅 @dan_fronts back at #1, maybe @HackenProof should just reserve the top spot for him. Proud of you. 🥇🔥
Top 3 researchers this week:
🥇 @dan_fronts
🥈 Holl0w
🥉 @GladKing0x01
Keep it up! 🔥
Want your handle here? Join active programs: hackenproof.com/programs
Decurity retweeted
ℹ️ We've launched a WebSockets subscription to the onchain attack alerts.
DeFi teams can wire our streams into their agents for an automatic incident response:
`/ws/attacks` - a raw stream of zero-delay alerts with minimal false positives
`/ws/confirmed_attacks` - LLM reviewed alerts with confirmed attacks
Docs: defimon.xyz/docs/websocket_a…
Get access: @DecurityHQ
We warned about @dxsale rug pull risk 3 years ago: blog.decurity.io/dx-protocol…
A 2021 @dxsale locker, an unprotected admin key, $7.3 million gone. @DecurityHQ flagged the risk in 2023 for $500. Two compromised contracts holding $15.5 million remain untouched, for now.
rekt.news/dxsale-rekt
Decurity retweeted
⛑️ Defimon caught a live CPIMP-style backdoor on a production protocol, alerted the team, and the funds were locked down before the attacker could fire.
Previously the exploiters who front-run initialize() call set several known implementation slots automatically. After @etherscan added ">1 implementation" label, such attempts were easily exposed.
The exploiters are more stealthy now. They overwrite impl slot precisely, emit fake "Upgraded" events and even verify a copy of the real impl with their backdoor. In this case the backdoor was hidden inside what looks like a stock OpenZeppelin file: Initializable.sol.
The exploiter was definitely waiting for more funds to drain, so our timely alert helped to neutralize the threat before they could activate the backdoor.
4/ Balancer V2 reached 54% of funds-at-risk in minute one, 93% by minute five.
Even at that speed, @BitFinding's whitehat bot intercepted the attacker in the very next block - 12 seconds after the first malicious tx. ~$1M returned to Balancer DAO.
Full research: per-tx timelines, recovery breakdowns and more.
rescue-window.decurity.io
@DefimonAlerts - real-time detection and incident response for DeFi protocols. $2.5M rescued to date.
defimon.xyz