web3 security researcher | web2 cyber consultant | BSc Ethical Hacking | @NovaContracts | Launched @atomopjb @harvmcmblocks @morthirnft
Joined January 2022
- Tweets1.3K
- Following352
- Followers2.1K
- Likes4.1K
JoshJ retweeted
Pashov Audit Group security researcher internship coming soon. Learn by doing, 100% practice. Real audits, real projects.
Like/RT this post if you'd be interested in this. There will be lots of slots, I've thought of a scalable model to do this right, full announcement soon🫡
JoshJ retweeted
✅ 5 things I wish I knew before starting out with web3 security:
1️⃣ Go through @PatrickAlphaC course and try to understand as much as you can of what he is saying;
2️⃣ Try contests ASAP… focus mainly on understanding the given codebase even if that seems hard;
3️⃣ Don’t let FOMO hit you and focus on one contest at a time;
4️⃣ Change means progress… try out different techniques in making your mind find vulnerabilities (e.g. asking yourself how you can break a given function);
5️⃣ Don’t skip Rust!
What would you include in that list?
JoshJ retweeted
Things to Consider Before Reaching Out to Me or Another Security Firm for an Audit:
When preparing your code for an audit—especially if you're working with a novel protocol—finalizing the following elements is crucial. These steps can drastically improve the efficiency, depth, and quality of the audit 🧵
JoshJ retweeted
~ Simplest path to web3 security ~ 🧵
I first heard about web3 security sometime in July/2024. Therefore, this is not an expert view, only what has worked for me so far!
My path was the following:
1. Speedrun learning: I first learned how to read solidity (Jul - Aug / 2024) by speedrunning @PatrickAlphaC course
2. Audit: then, I audited
3. Feedback loop: simultaneously, I run a feedback loop where I understand the real knowledge gaps I face while auditing and study to fill them
I am now repeating steps 2 and 3 and will continue to do just that for the foreseeable future
It is as simple as that
More on all that below:
JoshJ retweeted
Live a life of self-development. Be the best version of yourself.
Read books, workout, build a business, challenge yourself to talk to that one person, always walk the extra mile in whatever you do, significant or not.
You can never pour from an empty cup. Develop yourself.
JoshJ retweeted
my 2025 crypto developer thesis
as a developer in 2025, you have 3 options
- SVM
- EVM
- Move
EVM will be by far the most competitive: Hyperliquid, Monad, Berachain, Base, Megaeth, and many new EVM L2s
SVM will be predominantly Solana and a few other L2s (Eclipse and Atlas most notable) + perhaps one SVM L1 fork akin to Pythnet
Move will be Sui, Aptos, and Move L2s
few consequences of this:
i) EVM teams will be more mobile. If their existing EVM ecosystem is not meeting their needs, they'll be able to move to a newer EVM ecosystem quickly and with little friction
meaning I expect all EVM ecosystems to compete against each other hard this year — and since the dev experiences will be relatively similar, the moat will have to come from other avenues (ecosystem support, liquidity, and "community")
you could also cross-deploy on multiple EVM environments of course and some will, but this becomes complex to manage and your product generally suffers in focus
ii) SVM and Move will have an edge for developer stickiness and talent density because those devs won't have many options to choose from, they will have a stronger incentive to stick it out
this is also why back in the day I spammed "only possible on solana" (OPOS) — the reason is that the platform can give you a head-start edge since copy/pasting EVM forks won't work in either direction
iii) however, since there are many more EVM ecosystems, I would expect the EVM dev tooling to advance more rapidly, generate more data for LLMs, and overall offer a better developer experience due to the abundance of educational resources
iv) at the same time, since the EVM is more mature in years, I suspect there are fewer low-hanging fruit for progress and progress might be slower, relatively
v) which brings me to my main point: the SVM and Move ecosystems have an inherent technical edge in 2025 due to lessened competition, higher talent density, and stronger incentives for devs
BUT, this will be entirely dependent on one key factor: how fast the SVM and Move ecosystems advance their respective developer experiences — contract-level, read-level, and core protocol-level
meaning, for example, if Solana can improve its developer experience 2-5x in 2025, its growth for the year could very well be 10x relative to others
but if it doesn't, this will be a huge setback — there can not be another "congestion" episode
as a result, @heliuslabs will focus 100% of our efforts on improving the SVM developer experience without a single day off in 2025 — if you're curious about building on Solana or other SVM L2s, give me a shout
let the dev tools arms race begin
JoshJ retweeted
"If I could even make $500 from contests, I'd quit my 9-to-5 and go all-in on Web3 Security".
- That was the promise I made to myself at the start of 2024
To wrap up 2024 properly, I want to reflect on where it all began -July of 2023, when I decided to learn Solidity and Web3 Security.
With absolutely zero technical knowledge/background, and my previous experiences revolving around different managerial roles, I dove into deep waters.
Balancing learning with my then demanding job wasn't easy, but I was dedicating 20+ hours per week and by early 2024 I was ready to enter my first contests.
To my surprise, results came quickly - in early February.
The first two contests I did, I managed to place in the Top 5 in both of them, earning around $5K cumulatively.
With this, the promise to myself had to be kept, and I gave my 2 months' notice. My last working day was the 30th of April, which meant that from May onwards I was all in.
- Since then, I've placed among the top 5 in numerous contests, engaged in multiple private audits, and collaborated with top researchers from all over the world.
- I've audited codebases written in Solidity, Go, PyTeal, and Rust.
- Convinced 3 people (that I know of) to get into Web3 Security, and mentored them (to the best of my abilities).
2024 has been filled with challenges and growth. As all great beginnings go, it hasn’t been easy—but it has been worth it.
Here’s to even bigger things in 2025🥂
JoshJ retweeted
Once i became full time web3 security researcher, i didn't pay much attention on it.
But, Sunday is the most powerful day in the week for the security researcher 🔥
If you want to grow, you must do it on Sunday: 👇🏻
- Analyse the work that you've done (what did you learn, find)
- Write the list of "knowledge gaps" to have a clear picture
- Make a study / work plan for the future week.
However, it is one more habit that can help you dramatically
"Every Sunday study one complex exploit"
JoshJ retweeted
T-RIZE Group secures a $300M deal to tokenize and decarbonize the construction of 960 new residential units in Canada! Advancing its $2B global pipeline, T-RIZE tackles the housing crisis with faster, greener, and lower-cost financing.
Integrating @Chainlink's CCIP for secure cross-chain interoperability and PoR for enhanced transparency, T-RIZE ensures verifiable tokenized carbon credit tracking and seamless transfers of tokenized assets and RIZE tokens across @base and @avax.
JoshJ retweeted
@MorthirNFT @harvmcm
Max Mint + a few secondary buys.
The attention to detail on each piece is truly amazing.
Every trait within MORTHIR is hand drawn on paper with ink pen, there is over 700 traits.
Excited to burn the 1/1 I got for the physical piece. #morthirnft
JoshJ retweeted
If you were thinking about minting @MorthirNFT, public mint is open and it’s now down to just 55 LEFT!
Supply is dropping fast. 👀
JoshJ retweeted
only 21 pieces left from me and @joshjnft's project @MorthirNFT! All the art is hand drawn by my dad it's crazy, appreciate all the support shown so far
mintmorthir.io
