🕵️ Security Researching | @SpearbitDAO ⚙️ Engineering & coffee ☕ 🛠️ Built @AuditorToolbox
Joined December 2018
- Tweets1.9K
- Following829
- Followers1.1K
- Likes7.1K
Pinned Tweet
🚀 Launching first beta release of the Auditor-Toolbox - Your all-in-one solution for auditing tools!
🔧 Public repo with diverse tools & one-click installs.
📚 Read about it:
Preferably here: hackmd.io/@Deivitto/The-Audi…
💻 Dive into the code & contribute: github.com/Deivitto/auditor-…
Ðeivitto retweeted
Amazed by the attacks happening in the space. Good to have learned about CPIMP backdoor attack. Due to this, always ensure that your proxy deployment + initialization happens in one transaction.
hackmd.io/@Deivitto/Skf6Ps-G… (h/t @Deivitto )
Video from DSS youtube.com/watch?v=RShnWs0V…
Another amazing talk I had the pleasure of seeing. Valuable til the very end
34 Auditing Tips to crush it in 2026
- Think in bets
- Constraint behaviour
- If it's hard for you it's hard for everyone
- Seek truth
- Understand it first, then break it
- Building is harder than breaking
- Tools are substitutes for thinking
- A fully understood Low is better than an untested fix
- If it's not tested, it's broken
- AI is a brainstorming tool
- Work with Progressive Escalation
- Understand the meaning of being average
- Formally verify stateless libraries to extract constraints
- There are no easy paths, you have to get better
- Understand when to clamp and when not to
- Rewrite it your way and compare notes
- Peak experiences are like a wave.
- Most Contest winners have a brutal track record
- There's no rush in writing a report and POC
- it's always a very serious deal or just don't bother
- Start with the end in mind
- Read the code until you can't anymore, then try something else
- You don't understand the intensity of reviewing code, until you've seen it
- If you're done before the end of the engagement, you're probably wrong
- Understand your edge and use it to your advantage
- There is no overnight success, only the world catching up to you
- The path to mastery is simple, do the thing with 100% of intention, review the results, learn
- Model people that inspire you
- Forge your own path
- Read about common bugs
- Create your own category defining bugs
- Resting is work
- Be careful about your own biases
- The only constant is you
Got nerd-sniped this morning by the USPD CPIMP incident with @0xGianfranco, so I turned our rabbit hole conversation into a write-up
🧬 how CPIMP sneaks a proxy in the middle of your proxy
👁 how Etherscan UX can trick you
🔗hackmd.io/@Deivitto/Skf6Ps-G…
Now link to the medium post too: medium.com/@Deivitto/the-cpi…
Link to the hackmd analysis: hackmd.io/@Deivitto/Skf6Ps-G…
Link to the @USPD_io exploit announcement: nitter.gq/USPD_io/status/1996711…:
Ðeivitto retweeted
15 hours is all it's taken since I sent a link to the hack announcement tweet on our group chat to having a comprehensive technical write-up 😂😂😂
Ðeivitto retweeted
web 3’s publishing of reports and expectation that reports are published are a big reason there has not been more hacks
Just some legends on the stage @Montyly @zigtur @GalloDaSballo @AliceAndB0b
At the Ultimate Security Games! @RareSkills_io
Ðeivitto retweeted
The Balancer v2 exploit highlights how complex protocol evolutions can introduce new risks.
OpenZeppelin audited earlier versions of the v2 codebase, prior to the introduction of the attack vector that was later exploited.
Our analysis and lessons for the community ↓
openzeppelin.com/news/unders…
Ðeivitto retweeted
Mark your calendars, November 20th is Season 1 of Ultimate Security Games, live in Argentina.
Watch smart contracts get hacked in real time as three teams race to be first to steal the funds.
We're grateful to the sponsors who made this happen:
@monad
@coinbase
@immunefi
@sigp_io
@PashovAuditGrp
Get your tickets for the in-person event -- link in the reply.
Ðeivitto retweeted
The security vulnerability we found in Perplexity’s Comet browser this summer is not an isolated issue.
Indirect prompt injections are a systemic problem facing Comet and other AI-powered browsers.
Today we’re publishing details on more security vulnerabilities we uncovered.
Ðeivitto retweeted
🚀 Spent last week giving some love to one of most impactful Web3 Sec learning resources: The Ethernaut.
Here’s what’s new 👇
🎮 4 New Levels:
Bet House 🎰
Elliptic Token 🔁
Cashback 💶
Impersonator Two 🎭
🌍 2 New Languages
🇺🇦 Ukrainian
🇰🇷 Korean
📚 70+ New Level Translations across multiple languages 🎉
Let’s dive in 🧵👇 🧵
Ðeivitto retweeted
imo the future of creating AI apps will start with @figma
at the high level. with User Interfaces. UX designers > engineers.
when i was doing UX research we were given a problem statement and had to:
- go on the ground to the exact place where the problem is
- interview stakeholders, do academic research and data mining
- analyze behavior, create psychological profiles, make personas
- understand business objectives and limitations
- create journeys, prototype solutions, execute, get feedback and iterate
- ship
it was all about empathizing and understanding the user. we worked with government institutions, big tech companies, schools, local companies, non-profits... we used figma A LOT, and every single prototype of an app we built to solve a problem was done on figma, and backed by strong research.
many of my colleagues were great designers and problem solvers but did not want to code professionally or did no have the time/resources to implement the solution themselves (we worked with engineering directly).
i say this because right now, UX and UI designers are the closest to understanding user needs, and if you give them AI tools to do the coding they could not do, they will start shipping things that people NEED like crazy.
here is a small story of one of those tasks. if i had good AI at that time in 2021, it could have been a million dollar product
🇪🇺 EU regulations are slowing down growth more than you know... but the real enemy is the anti-tech narrative. i'll tell you a little story of how i experienced this first hand.
🧵 in 2021 i worked on a month long applied research project sponsored by a dutch manufacturer specialized in farm robotics to fully automate farm management using Artificial Intelligence. see app concept demo:
Ðeivitto retweeted
A breach exposing 16 billion credentials has been confirmed. The dataset includes sensitive access details from Apple, Google, Facebook, GitHub, and other major platforms.
This constitutes a direct threat to operational and personal security.
Recommended actions:
• Rotate all credentials
• Enforce multi-factor authentication
• Conduct a full access audit
Continuous security posture assessment remains essential.
Source: forbes.com/sites/daveywinder…
