We keep your project secure, so you can build and innovate with confidence
Joined February 2026
- Tweets199
- Following603
- Followers629
- Likes3K
Valves Security retweeted
Was not too hard. Happy to share this!
The @ValvesSec AI security tooling just got a major update 🫣
We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models.
Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work.
We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming.
anthropic.com/news/cyber-ver…
Valves Security retweeted
🥪 The fee payer controlled how cheaply the protocol could sell its own cut.
A liquidity manager compounded the trading fees earned by a user's position. It took a percentage of those fee tokens, sold that cut for USDC to pay the protocol, and reinvested the remaining tokens for the owner.
The owner supplied the slippage tolerance for that fee sale too.
Illustrative numbers for one non-USDC fee token, with no bot fee: 100 earned TOKEN leave 90 for reinvestment after a 10 TOKEN protocol cut. If those 10 TOKEN sell for 80 USDC instead of 100, the owner still gives up 10 TOKEN. The protocol receives 20 USDC less.
⚔️ Attack path:
1. The owner targets a compound where the remaining tokens match the position's required ratio at execution, so reinvestment needs no rebalance swap. They choose a permissive slippage tolerance.
2. Front-run: the owner sells TOKEN into the market used by the fee sale, pushing its price down.
3. Compound: their transaction sells the protocol's fixed token cut at the worsened price. The loose tolerance allows the reduced USDC output, and the remaining tokens proceed to reinvestment without a rebalance swap.
4. Back-run: the owner buys TOKEN back after the compound, seeking to unwind the first trade at a lower price.
💥 Impact:
The protocol receives less USDC from the same fee-token charge. The owner can potentially recover part of that fee through the surrounding trades.
Skipping the rebalance matters: a rebalance swap could also expose the owner's remaining tokens to the manipulated price. Liquidity addition and any dust conversions still occur and affect the economics.
🔎 Root cause:
The fee payer chose the allowed execution loss on the sale funding the protocol's payout. Worse execution reduced that payout without increasing the predetermined fee-token charge.
🛠️ Fix:
Enforce a protocol-set slippage cap on fee conversions while honoring a stricter user tolerance.
Valves Security retweeted
For every protocol, we build a custom security team that brings together different strengths: auditors who find uncommon bugs and those who consistently deliver high coverage.
We know that every protocol is different, and we put together the right team for your needs 🤝
Valves Security retweeted
We at @ValvesSec keep finding basic issues in protocols that have already been audited by firms with thousands of audits behind them.
This isn’t serious...
There are plenty of elite security researchers available now, and AI tools that can cover codebases better than some of these companies do.
Founders are paying for real protection - not just a badge on their website. They deserve better.
Do it right. We can all do better. 🛡️
Valves Security retweeted
Read more about it here: valvessecurity.com/solidity-…
Valves Security retweeted
Let’s give a minute of silence to all the bugs killed by @ValvesSec 😶
Valves Security retweeted
@ValvesSec has started the security audit of Lunya.
We chose Valves for their record: their researchers placed first in Code4rena's Panoptic audit.
We'll share the report once it's done.
Valves Security retweeted
It is amazing to see something this big happening. Security audit firms now have to compete at an institutional level.
It is interesting to see which direction @OpenZeppelin will go from here, and whether things will get better or worse for the company.
We all have to get better now!
At @ValvesSec, we are improving every day, after every audit, after every obstacle. We are going to make everything we do better, faster, and more precise!
One thing will never change: the effort, the motivation, and the vision for complete smart contract security! 🛡️
To simply say that I am excited would be a massive understatement! 🫡
Today we are announcing that S&P Global has entered an agreement to acquire OpenZeppelin.
Onchain finance is growing from an emerging market into core financial infrastructure, and the standards and rails our team and community built are becoming the rails of global finance. OpenZeppelin smart contracts facilitated over $37 trillion in value transferred, with the vast majority of the largest DeFi protocols, blockchain networks, stablecoins and tokenized funds relying on them.
With S&P Global, we expect to accelerate the impact of onchain finance, backed by more than a century of trust in global markets, benchmarks, and risk frameworks.
To our clients and to all the users of OpenZeppelin open source tools:
• OpenZeppelin Contracts and all our open source applications and tools remain open source, free, and publicly maintained on GitHub. Building open source standards stays a core priority.
• Audits, engineering work, and ecosystem programs continue with the same team, brand, quality, and customer experience, with what will be the added benefit of S&P Global's research capacity, market data, and institutional reach.
For the last decade, OpenZeppelin has set the security standard for onchain finance. Today begins a new chapter for that mission, together with one of the most trusted names in global markets.
Read the full announcement: openzeppelin.com/news/spglob…
Valves Security retweeted
🚨Free for anyone who wants to get better at Web3 security!!!
Most researchers struggle with:
• Too much passive reading
• Not enough real-world attacker pattern recognition
That’s exactly what we’re fixing with the Valves Security Training Hub. 📚
Instead of just theory, you will train on how attackers actually think, so you can spot vulnerabilities faster and with confidence.
If you’re serious about improving, this is for you.
Start training 👇
training.valvessecurity.com
Valves Security retweeted
Important Read from my Actual Business Partner here on @CantonNetwork Mr. @Vesko_210 with @ValvesSec
Give my partner and friend a follow along with our other security partner @nowitnesslabs
Mahalo 🙏
Valves Security retweeted
Alex, yes we have neem audited by 3rd party also -
MaxFi has been audited by Valves Security, with the full audit report available directly on our website and Valves.
Valves is one of the leading security audit firms in the industry, with audits that can cost five figures.
Even better, members of the Vales founding team use MaxFi themselves. That says a lot.
🔐 Independent security audit
📄 Full report publicly available
🏆 Top-tier audit firm
🤝 Their own team uses the platform.
Security isn’t an afterthought at MaxFi, it’s built into the product from day one. You can see Valves X page here - @ValvesSec
Also have No Swap technology has removed most attack vectors, Alex our dev took a security first mindset to the platform.
Valves Security retweeted
Just a Friendly Reminder to Everybody that @nowitnesslabs & @ValvesSec security are now Team Yessah Blessah
We have a Direct Partnership together so if you are a Builder, Developer, or even just curious about the security of your Featured App.
DM any one of us to learn more!
**We are creating content right now to strengthen and integrate this collaboration
@nowitnesslabs🤝@YessahBlessahCC 🤝@ValvesSec
Dear algorithm,
Please show this to all entrepreneurs and projects building on Canton.
We’re specializing in DAML development and security audits.
Please reach out if you need any kind of support at [email protected]
Valves Security retweeted
Relentless Audits Forge Resilient Protocols 🔥
Thinking like a Blackhat...🤔
Defending like a Whitehat...💪
@ValvesSec🤝@nowitnesslabs🤝@YessahBlessahCC
*Security Audits / DAML / EVM Security Specialists*
Battle-Tested with Proven Results: 👌
Competed on @sherlockdefi and @code4rena ranking in the Top 3 across multiple audit competitions with over 3500 combined participants!
Multi-Chain Expertise: 👇
Specialized in Solidity, Rust, and Go. Covering EVM protocols, Cosmos chains, and Rust systems.
Transparent Process: 👇
Every finding is well documented with a clear, remediation steps.
valvessecurity.com/
Attention @CantonNetwork Builders / Developers / Apps / Featured Apps
There is a good possibility you have a BUG 🐛 in your code and I’m not joking one bit!
Just ask Valves Security and @nowitnesslabs !👇🏽👇🏽
@ValvesSec is a specialized Web3 security team founded by Veselin and Valeri.
“With deep experience across Canton as well as EVM-based protocols, Cosmos (Go) chains, and Rust systems, we help projects identify and eliminate critical vulnerabilities before they reach mainnet.”
@nowitnesslabs 🤝 @ValvesSec
Mission is to raise the security baseline of the Canton ecosystem through careful manual and top-tier AI code review.
2 powerhouse Security Audit Firms here on @CantonNetwork teaming up with Yessah Blessah so we can help keep our money safe in all of our various DeFi protocols 🔥🔥🫡
I’ll bet you 100 canton-network:native you got a 🐛 in your Code!
No worries…😉👇🏽👇🏽
nowitnesslabs.com/
valvessecurity.com/
Valves Security retweeted
Had a great chat with a really cool guy yesterday. He shared an audit report from a well-known security firm that audited a @CantonNetwork / DAML project.
Afterward, I found another public DAML audit from the same firm and used both audit scopes to test our @ValvesSec security tool.
The results were very encouraging:
• It identified 10 of the 12 validated issues reported across both audits.
• The two missed findings had been downgraded by our tool because they were assessed as informational ones.
• It also flagged 50+ additional potential issues that we're currently validating.
Teams most likely paid significant amounts for audits like these. If you're building on Canton/DAML, we'd love to help.
Valves Security retweeted
MaxFi is now the 8th largest project on Robinhood Chain. Security is non-negotiable.
We're proud to have Valves Security as our auditing partner, helping review and strengthen the MaxFi protocol.
Working with one of the industry's leading security firms gives our community greater confidence as we continue to build the future of LP management. 🚀
Valves Security retweeted
Not great for just one year... 😤
We should all do much better!
At @ValvesSec we’re stepping up. We are going to save millions in exploits over the next 365 days.
You should do the same.
Let’s secure this whole space together. 🔥
