Independent Security Researcher | prev @GuardianAudits | $3B+ secured • 50+ audits • 15+ bounties
Portfolio & Contact →
Joined July 2022
- Tweets1K
- Following321
- Followers3.2K
- Likes3.4K
Kiki retweeted
You can't mark a valid High/Critical issue as a duplicate of an "invalid" bug that wasn't fixed.
That's a scam.
Kiki retweeted
1/2
We recently completed a security review for @GraniteBTC, a Bitcoin liquidity protocol built on @Stacks enabling users to borrow stablecoins against Bitcoin collateral through sBTC, developed by @trustmachinesco.
This engagement focused on reviewing fixes, hardening efforts, and protocol enhancements across the protocol’s lending system, covering changes across borrowing, liquidation flows, staking, governance, LP incentives, oracle integrations, withdrawal logic and related core functionality.
Granite combines Bitcoin-backed liquidity access with design choices such as isolated collateral, soft liquidations, and Bitcoin-native infrastructure.
Happy to support teams building BTCfi infrastructure. Always a pleasure working with security-oriented teams pushing the ecosystem forward.
Kiki retweeted
Two of my projects were selected for the @thedaofund Ethereum Security QF Round on @Giveth.
The round has a 500 ETH matching pool (roughly $1M+) backing around 100 Ethereum and L2 security projects.
It uses Quadratic Funding, which means $1 from 100 donors unlocks far more from the matching pool than $100 from 1 donor.
Voting is open until May 14. Here's what they do 🧵
Kiki retweeted
2/ The Ethereum Security Subsidy Program is proud to be launching with access to 20+ of the leading audit providers active in the Ethereum ecosystem:
@AdevarLabs, @bailsecurity, @BlockSecTeam, @Certora, @chain_security, @cyfrin, @dedaub, @GuardianAudits, @hackenclub, @HackenProof, @Hashlock_, @hexens, @immunefi, @LeastAuthority, @lethalspoons, @NethermindSec, @Quantstamp, @QuillAudits_AI, @rv_inc, @SecurityOak, @sherlockdefi, @spearbit, @statemindio, @zellic_io, and @zokyo_io.
These top-tier security providers make the program possible through their commitment to support Ethereum mainnet.
Kiki retweeted
1/2
One of the more detail oriented articles we've published, but the value it brings is significant.
As an auditor, it's interesting to see how one account can map to different addresses on Stacks, depending on whether you're on testnet or mainnet.
xitter.cf/CybaSecurity/status/20…
1/2
When we launched Cyba in February, we said to judge us by what we publish, how we review code, and the standards we hold ourselves to.
We're continuing on that path by publishing security content that benefits the ecosystem.
We're starting with a deep dive into Stacks principal (address) derivation and standard network checks.
For those who may not know, @Stacks is the leading Bitcoin L2, where we have extensive experience securing protocols.
Kiki retweeted
Cross-chain bridges remain critical infrastructure, proof verification is the core of their security model.
New disclosure on our research page: a vulnerability in the Polygon Plasma bridge that allowed transaction proofs to be forged.
At the time of discovery, $800M in POL was at risk, exploitable in a single transaction with no prerequisites.
The research covers how the proof verification breaks, how the exploit was built, and what it means for bridge security.
Full technical deep-dive: hexens.io/research/polygon-b…
Kiki retweeted
Solid work by @silverologist, @czm_alex and myself.
Always good to work on systems at this level with @AccountableData.
xitter.cf/CybaSecurity/status/20…
We've completed our security audit for @AccountableData, reviewing an extension to their DeFi credit vault infrastructure.
Accountable is a key player operating at the intersection of DeFi and TradFi.
Their vault-based credit layer programmatically allocates capital across lending strategies, with over $160M deployed to generate risk-adjusted yield.
They are also building the Data Verification Network (DVN), a privacy-preserving infrastructure that verifies financial data directly at the source. It already secures $1B+ in assets across partners like Galaxy, Amber Group, and K3 Capital, positioning Accountable at the intersection of onchain finance and institutional reporting.
Security at this scale is never a one-off.
Kiki retweeted
1/2
Thanks @web3sec_news for the shout-out🙏
We currently provide EVM and @Stacks (Clarity) security reviews, with scope and capabilities expanding over time.
xitter.cf/web3sec_news/status/20…
For specialized security reviews of EVM or stack-based Bitcoin L2 based projects, check out @CybaSecurity. Hit them up if you are building.
Kiki retweeted
First look at the list of (fictional) BBPs and Bug Types for Web3 SR Life Sim 🕹️!
There will be 5 different difficulty groups of BBP as well as bugs that correspond to each type of protocol.
*all completely fictional, any similarity to real life entities is purely coincidental
Kiki retweeted
Anyone can learn Smart Contract Security for free.
Resources:
@CodeHawks first flights are free
@SoloditOfficial findings are free
@trailofbits publications are free
@CyfrinUpdraft courses are free
@RareSkills_io articles are free
@immunefi write-ups are free
@OpenZeppelin docs are free
@pashov findings are public
@CryptoZombiesHQ is free
@TheSecureum is free
@RektHQ is free
Just learn, practice, and find bugs.
Kiki retweeted
@MitchellAmador accurately sums up the frustration that whitehats are feeling at the lack of respect and courtesy for the service they are providing.
youtu.be/atuLSv3KTPY
@summit_defi
Kiki retweeted
Runes v1.1.0, now supporting Medusa test generation, will be released next Monday
Current version: github.com/Enigma-Dark/runes
This is no longer true. Medusa has improved a lot, no more tooling or major coverage issues. (after 6 months of using it in @EnigmadarkLabs engagements)
try short Medusa runs for coverage checks while building your suite, the feedback loop is faster than Echidna's, anon
Kiki retweeted
You can be a successful security researcher without knowing much about math. But if you want to see the matrix, you need to get math-pilled. medium.com/p/the-security-re…
Kiki retweeted
After 4 years of bug bounties and private audits, I'm excited to finally create my security company @birdseye_sec
The reviews are still top and the findings are insane, but now we got a cool bird logo.
SRs hmu with your portfolio if you think you'd be a good fit. TG in bio
Kiki retweeted
Our quotes are always 100% exact and fair.
We never try to overcharge our clients. But 6 months ago, we had 2 cases where our teams completed audits earlier than estimated. We informed the partners ourselves and sent partial refunds back, several thousand dollars each. They were stunned by the honesty.
BailSec stands for: 100% transparency, quality, and trust in Web3.
@CryptoAlgebra
@lista_dao
Kiki retweeted
🔦 Auditor Spotlight is LIVE! 🔦
This week, we're featuring @DadeKuma, a top-tier Rust & Solana security expert who has earned over six figures from audit competitions.
In this thread, we’ll break down:
🤯 The @GMX_SOL arbitrage bug he found
🏆 His #1 tip to become "the guy" in a niche
💰 How he built a 5-figure monthly income from audits
Bookmark this for your own security journey. 👇
Kiki retweeted
Continuing our founder series, meet @alix40.
An OSCP-certified expert who has secured major institutions in Web2, he saw the next great challenge in Web3. When he pivoted, his expertise brought immediate results: within his first 6 months, he was securing multiple 5-figure payouts from audit contests.
Here’s his story 🧵👇
