Dan Ogurtsov (@danogurtsov) header
Dan Ogurtsov (@danogurtsov) profile picture

ex-Head of Audits @PashovAuditGrp prev: audits @mixbytes, research @P2Pvalidator, strategy @EYnews

Joined June 2018
Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)Photo by Dan Ogurtsov (@danogurtsov)
Dan Ogurtsov retweeted
i own a relatively new (2025) samsung tv. i kept getting weirdly targeted ads. i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic. zero days it is. root shell on new samsung TVs! discovered PRIVACY HORROR. write up?
724
3,875
659
36,780
4,825,496
Dan Ogurtsov retweeted
We (@nicochristie and I) turned Warcraft 3 Frozen Throne into a real RL env wc3env is a fast, concurrent, and deterministic environment for training and evaluating models/agents Frontier agents do ok in isolated battles but fall apart in full 1v1s due to limitations in spatial reasoning, intelligence, and speed Open source and writeup ↓
38
20
5
339
48,430
we will finally kill "stack too deep" the next @ethereum update brings both: 1) the ability to deploy larger contracts 2) lets compilers fix "stack too deep" eth dev is going to rip in Q4
46
87
30
507
87,923
Dan Ogurtsov retweeted
All Solidity devs know fuzzing rocks. But it's expensive, slow to do, requires experts - so it just gets pushed further away. No excuse to postpone fuzzing anymore - someone built a free, OS tool to generate ~80% fuzz testing coverage. Use the edge: github.com/pashov/skills
3
13
2
141
8,102
Dan Ogurtsov retweeted
Sealed by PAG. Back-to-back audits, more on the way...and not once disappointed. @PashovAuditGrp 's team is CRACKED. They catch what others miss. That's exactly what you want securing a protocol like RAAC. What's listed is half of what we've done. The rest is coming.
Every contract RAAC ships is reviewed by @PashovAuditGrp, the firm trusted by Aave, Uniswap, and Ethena. Here is what that work looks like in practice. 👇 blog.raac.io/posts/the-secur…
2
2
16
1,859
While attending @Morpho's incredible Vault Summit at NYSE 2 weeks ago, a LP with 10-fig allocation complained about how vaults today are mostly doing very similar & simple things: > lending against cbBTC, WETH, wstETH etc blue-chip assets > the top 12 markets on morpho accounts for >80% of total active loans In short, there's not much complex risk to curate. This LP is considering going directly to Moprho markets as lender I think the future of vaults is either to a) expand to more exotic trading strategies across cex, dex, options, perps, and options venues or b) if more public credits and yield-bearing collateral types take-off on-chain For crypto-backed loans there's little to curate
20
9
8
107
24,252
It takes real mental toughness to choose web3 security as your path in the current market. The fact that many people — even very experienced auditors — are finding it harder to get work is undeniable. For newcomers it's worse. Contests (if any) and bug bounties are flooded with AI submissions that drag judging out for weeks. And that's before the mental pressure of sitting in a contest with ~3k findings, where staying in the chair to the end is itself a test of resilience. You could justify all of this if protocols were getting safer and hacks were going down. The opposite is true. The field is in a transitional state — the mechanisms for working well alongside AI aren't built yet, and a lot of researchers are operating under pressure that does nothing for their actual output. So what can each researcher do individually? First, accept the rules of the game and decide honestly whether you're ready for them. The space is more competitive than it has ever been, and only genuinely effective work will be worth paying for. If that doesn't stop you, start doing something about it. Improve your audit workflow. Study harder things. Spend more hours sitting with the codebase. Do your maximum to be useful, because nothing less clears the bar anymore. None of this guarantees success. It only maximizes your chances of it. A 100% guarantee doesn't exist, and being at peace with that is part of the job.
4
8
125
3,785
Dan Ogurtsov retweeted
🤯An AI security tool has 1st-place performance on security contests from just 1yr ago. Solidity-auditor v3 is out, FREE & Open Source. Thousands of Solidity developers are using the tool already. Upgrade your security baseline, use the tool🫡 pashov.com/solidity-auditor-…
98
121
24
505
46,671
Dan Ogurtsov retweeted
Currently experimenting with a new type of web3 security contest. All web3 Projects will love this one. Trying many things and failing a lot right now, but learning fast. The existing solutions lost their glory a while ago, but the talent is still there - seeing an opportunity🙏
25
21
2
196
8,005
Secured by Pashov Audit Group.
4 out of 5 AMM liquidity providers lose money. Not bad luck. Structural loss. Helm changes that. LPs stay hedged in real time. Spot liquidity powered by Hyperliquid. Private beta soon. Follow and DM for access. Take the Helm.
2
27
1,478
Dan Ogurtsov retweeted
Many people have claimed that with AI-assisted bug finding, secure code (and hence trustless anything) will be impossible. I have a much more optimistic take, and AI-assisted formal verification is a major part of the reason why: vitalik.eth.limo/general/202…
448
390
147
2,526
477,603
Dan Ogurtsov retweeted
Every time I audit a protocol, I imagine a hacker somewhere crying. I have no evidence. I just like the mental image.
7
2
1
88
2,985
Dan Ogurtsov retweeted
Elite level security researcher who's mediocre with AI can crush it in web3 security, unlike an elite AI guy who's mediocre with security research. All of the skills you were building during these years were well worth it. Sprinkle some of the new magic tech on top & crush it🫡
6
12
189
6,206
Dan Ogurtsov retweeted
🚨🤯Someone built an AI tool that one-shots the threat model & invariants of your Solidity codebase. Companies used to charge >$20k for this. It's called X-ray, free and fully open-source. My security team will be using this. Check it out below👇 github.com/pashov/skills/tre…
11
31
3
293
20,613
Pashov Audit Group 🤝 @Polymarket VP of Engineering @devjoshstevens together with his talented team aims to bring elite security expertise to Polymarket's systems with our team. Excited to work with 11 figures company, coming with the big guns! Let us impress🫡
16
9
2
136
15,323
Dan Ogurtsov retweeted
Silence/Crickets so far. Web3 Security deserves this. Sick & tired of being ignored here, we've been securing hundreds of billions. It's time. If you are reading this, help us spread the quoted tweet - share it on Reddit/LinkedIn/Discord servers/Telegram communities etc.
Hey @AnthropicAI let's go toe to toe I bet $100,000 my agent finds more valid Critical/High/Medium total smart contract vulns than Mythos, 1 run each I'm a small boii here in web3 security, your "scary" agent wouldn't be afraid of mine, no? Serious bet. Tag anyone, I'm ready.
10
11
4
134
9,072
Dan Ogurtsov retweeted
Hey @AnthropicAI let's go toe to toe I bet $100,000 my agent finds more valid Critical/High/Medium total smart contract vulns than Mythos, 1 run each I'm a small boii here in web3 security, your "scary" agent wouldn't be afraid of mine, no? Serious bet. Tag anyone, I'm ready.
79
55
15
1,090
122,432
Dan Ogurtsov retweeted
Judging by my tl there is a growing gap in understanding of AI capability. The first issue I think is around recency and tier of use. I think a lot of people tried the free tier of ChatGPT somewhere last year and allowed it to inform their views on AI a little too much. This is a group of reactions laughing at various quirks of the models, hallucinations, etc. Yes I also saw the viral videos of OpenAI's Advanced Voice mode fumbling simple queries like "should I drive or walk to the carwash". The thing is that these free and old/deprecated models don't reflect the capability in the latest round of state of the art agentic models of this year, especially OpenAI Codex and Claude Code. But that brings me to the second issue. Even if people paid $200/month to use the state of the art models, a lot of the capabilities are relatively "peaky" in highly technical areas. Typical queries around search, writing, advice, etc. are *not* the domain that has made the most noticeable and dramatic strides in capability. Partly, this is due to the technical details of reinforcement learning and its use of verifiable rewards. But partly, it's also because these use cases are not sufficiently prioritized by the companies in their hillclimbing because they don't lead to as much $$$ value. The goldmines are elsewhere, and the focus comes along. So that brings me to the second group of people, who *both* 1) pay for and use the state of the art frontier agentic models (OpenAI Codex / Claude Code) and 2) do so professionally in technical domains like programming, math and research. This group of people is subject to the highest amount of "AI Psychosis" because the recent improvements in these domains as of this year have been nothing short of staggering. When you hand a computer terminal to one of these models, you can now watch them melt programming problems that you'd normally expect to take days/weeks of work. It's this second group of people that assigns a much greater gravity to the capabilities, their slope, and various cyber-related repercussions. TLDR the people in these two groups are speaking past each other. It really is simultaneously the case that OpenAI's free and I think slightly orphaned (?) "Advanced Voice Mode" will fumble the dumbest questions in your Instagram's reels and *at the same time*, OpenAI's highest-tier and paid Codex model will go off for 1 hour to coherently restructure an entire code base, or find and exploit vulnerabilities in computer systems. This part really works and has made dramatic strides because 2 properties: 1) these domains offer explicit reward functions that are verifiable meaning they are easily amenable to reinforcement learning training (e.g. unit tests passed yes or no, in contrast to writing, which is much harder to explicitly judge), but also 2) they are a lot more valuable in b2b settings, meaning that the biggest fraction of the team is focused on improving them. So here we are.
The degree to which you are awed by AI is perfectly correlated with how much you use AI to code.
1,262
2,698
715
22,750
7,478,809
Dan Ogurtsov retweeted
The space is getting really tough for SRs. Here are the details of the @KannAudits internship: 1. ~100 security researchers selected 2. Some have $30K+ rewards in contests 3. Only top 3 per week get ~$150(per SR) 4. The rest → no rewards And all of them are auditing the same protocols. This means: - Heavy competition among skilled auditors - Maximum coverage for protocols - Huge advantage for projects being audited Smart move from a firm’s perspective. Tough reality for SRs.
6
2
3
60
6,112
Dan Ogurtsov retweeted
I think this is the best post I've ever made.
Quantization can make an LLM 4x smaller and 2x faster, with barely any quality loss. But what *is* it? @samwhoo crafted a beautiful interactive essay explaining it from first principles, aimed at coders, not mathematicians. ngrok.com/blog/quantization
82
351
31
4,518
624,721