ex-Head of Audits @PashovAuditGrp prev: audits @mixbytes, research @P2Pvalidator, strategy @EYnews
Joined June 2018
- Tweets256
- Following289
- Followers530
- Likes236
Pinned Tweet
After 2 years and 500+ security audits, today is my last day as Head of Audits at @PashovAuditGrp .
Huge thanks to @pashov and the whole team for an incredible ride 🙏
I got to build something I'm genuinely proud of: a machine that automated our processes end to end, led every single audit, and coordinated hundreds of auditors and dozens of clients in parallel. A lot of audit firms never even hit that monthly volume - we did, and I don't remember it breaking once.
Now it's time for new horizons.
A bit about me and what I bring:
- Auditing DeFi since the early Code4rena days back in 2022
- Led the DeFi research team at @P2Pvalidator, specialized in on-chain data (I know this world inside out)
- 2 years as a hands-on auditor at @MixBytes on some of the biggest protocols out there - Aave, Curve, Yearn and more
- At @PashovAuditGrp: processes and management (big Lean fan - minimal necessary comms, transparent, data-driven) and AI - I built the stack of internal products and pipelines PAG runs on
(Plus a finance backbone - an economics and finance education toward investment banking and strategy consulting, 2 years of CFO-level financial management, and CFA exams.)
I'm a battle-tested. I ship projects, I'm good with people, I go deep on tech, can write code, manage team, and I can research literally anything. The harder and messier the problem, the more I want it.
So I'm open to new ideas and offers.
Got the hardest problem in the room? Send it.
DMs open
Dan Ogurtsov retweeted
i own a relatively new (2025) samsung tv.
i kept getting weirdly targeted ads.
i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.
zero days it is. root shell on new samsung TVs!
discovered PRIVACY HORROR. write up?
Dan Ogurtsov retweeted
We (@nicochristie and I) turned Warcraft 3 Frozen Throne into a real RL env
wc3env is a fast, concurrent, and deterministic environment for training and evaluating models/agents
Frontier agents do ok in isolated battles but fall apart in full 1v1s due to limitations in spatial reasoning, intelligence, and speed
Open source and writeup ↓
Dan Ogurtsov retweeted
we will finally kill "stack too deep"
the next @ethereum update brings both:
1) the ability to deploy larger contracts
2) lets compilers fix "stack too deep"
eth dev is going to rip in Q4
Auditors - if you dropped audits tomorrow and just built, what would you build? Not the smart market bet, the thing you'd have fun with. A protocol, some infra, a tool, a mobile app, anything.
What's the one you'd want to make?
Just wrapped up at @PashovAuditGrp, so I finally have some free time again.
Quick exercise: pretend you just left your job too.
I went and listened to Neuromancer - the book that basically started cyberpunk (Not that I was waiting to quit to do this... but it lined up nicely)
Fun detail: the story opens with Case - a former top-tier freelancer who specialized in breaking into information security systems, now jobless and living a sad, washed-up existence. A little too relatable lol. I'm already on his side.
And I didn't just read it - it's a full Radio Drama on YouTube, free. Sound effects, voice acting, accents, the whole vibe. Way more fun than a dry audiobook.
(will drop in Replies)
If you're in web3 you've been into cyberpunk for years I think - games, anime, the whole aesthetic. But be honest, almost none of us read the original. Gibson wrote it in 1984. On a typewriter. Everything cool came from here.
And to my fellow auditors surviving this market: close your VS Code and Claude, go touch grass, read a good fiction, nothing work-related.
Your brain will thank you.
And here is the link
youtube.com/playlist?list=PL…
Dan Ogurtsov retweeted
All Solidity devs know fuzzing rocks. But it's expensive, slow to do, requires experts - so it just gets pushed further away.
No excuse to postpone fuzzing anymore - someone built a free, OS tool to generate ~80% fuzz testing coverage. Use the edge: github.com/pashov/skills
Dan Ogurtsov retweeted
Sealed by PAG.
Back-to-back audits, more on the way...and not once disappointed.
@PashovAuditGrp 's team is CRACKED. They catch what others miss. That's exactly what you want securing a protocol like RAAC.
What's listed is half of what we've done. The rest is coming.
Every contract RAAC ships is reviewed by @PashovAuditGrp, the firm trusted by Aave, Uniswap, and Ethena.
Here is what that work looks like in practice. 👇
blog.raac.io/posts/the-secur…
Dan Ogurtsov retweeted
While attending @Morpho's incredible Vault Summit at NYSE 2 weeks ago, a LP with 10-fig allocation complained about how vaults today are mostly doing very similar & simple things:
> lending against cbBTC, WETH, wstETH etc blue-chip assets
> the top 12 markets on morpho accounts for >80% of total active loans
In short, there's not much complex risk to curate. This LP is considering going directly to Moprho markets as lender
I think the future of vaults is either to
a) expand to more exotic trading strategies across cex, dex, options, perps, and options venues or
b) if more public credits and yield-bearing collateral types take-off on-chain
For crypto-backed loans there's little to curate
Dan Ogurtsov retweeted
It takes real mental toughness to choose web3 security as your path in the current market.
The fact that many people — even very experienced auditors — are finding it harder to get work is undeniable.
For newcomers it's worse. Contests (if any) and bug bounties are flooded with AI submissions that drag judging out for weeks. And that's before the mental pressure of sitting in a contest with ~3k findings, where staying in the chair to the end is itself a test of resilience.
You could justify all of this if protocols were getting safer and hacks were going down. The opposite is true. The field is in a transitional state — the mechanisms for working well alongside AI aren't built yet, and a lot of researchers are operating under pressure that does nothing for their actual output.
So what can each researcher do individually? First, accept the rules of the game and decide honestly whether you're ready for them. The space is more competitive than it has ever been, and only genuinely effective work will be worth paying for.
If that doesn't stop you, start doing something about it. Improve your audit workflow. Study harder things. Spend more hours sitting with the codebase. Do your maximum to be useful, because nothing less clears the bar anymore.
None of this guarantees success. It only maximizes your chances of it. A 100% guarantee doesn't exist, and being at peace with that is part of the job.
Dan Ogurtsov retweeted
🤯An AI security tool has 1st-place performance on security contests from just 1yr ago. Solidity-auditor v3 is out, FREE & Open Source.
Thousands of Solidity developers are using the tool already. Upgrade your security baseline, use the tool🫡
pashov.com/solidity-auditor-…
Dan Ogurtsov retweeted
Currently experimenting with a new type of web3 security contest. All web3 Projects will love this one.
Trying many things and failing a lot right now, but learning fast. The existing solutions lost their glory a while ago, but the talent is still there - seeing an opportunity🙏
📍New region
Black Sea Central and East (Trabzon), Türkiye 🇹🇷
Regions: 132 / 1,353 (+1)
UN: 43 / 193
UN+: 47 / 265
TCC: 53 / 330
(map: NomadMania)
