A thread of my journey in web3 security in 2022. From noob to security engineer in 1 year.
1.
Discovered the world of web3 security in January with damn vulnerable defi
Want to find your first high severity issue on
@code4rena
to get +backstage role? This is one of the most common and easy to spot bug on c4.
What is the problem here?
4 years ago I was working a helpdesk job at a MSP making 30k per year.
While working there, I got exposed to and started gravitating towards security and studied various cyber security certs after work.
1 year into the job there was an opportunity to do a security assessment
Now that I am a father I have been thinking a lot about education and how that plays a part in a child's future.
For me, I did not do well in the public education system where I was disinterested and did not fit in, which resulted in me wasting my teens and twenties and not
Interview with
@trust__90
is here. 🙂
We talk about his experience as an exploit dev at NSO Group and his transition into web3 security, and of course tons of details around his methodology and mindset around smart contract auditing.
Interview with top auditor
@0xDjangoOnChain
on how he transitioned from data engineer to full time bounty hunter, earning over 400k this year on
@code4rena
and
@immunefi
combined.
Just recorded an incredible episode, 2 hours of
@trust__90
dropping alpha auditing tips and talking about his insane background developing IOS zero days at NSO Group.
Will try to get this episode out in the next 1-2 days
Frankly, I joined web3 security because it paid higher than web2 sec. Last year I was telling everyone to switch due to the opportunities and growth in this industry.
However with the job market tight and competition fierce in audit contests, it is no longer the case for the
How to go from intermediate level auditor to advanced?
@0xleastwood
- Spearbit LSR, shares his story and auditing alpha in this latest interview!
Linked below👇🎥
Before having kid I was neutral to whether I wanted kids or not. Now on the other side I want more and wish I started sooner.
For all the new dads out there, the first year was incredibly difficult, the baby's needs came first and nothing else mattered. With the sleep
I talk to
@zachobront
about his audit process, how he collaborates with other top auditors to find unique bugs and his recent success on
@immunefi
and
@sherlockdefi
.
@PatrickAlphaC
is coming over to security! 👀
In this interview we talk about Patrick's decision to leave Chainlink to focus on security and his advice for new auditors and engineers in web3.
btw Patrick is also hiring auditors! Link below 📺👇
Spearbit lead security researcher and code4rena judge
@0xleastwood
will be joining me for an interview to share his alpha this weekend. What do you want me to ask him?
When learning something new, bouncing between different learning resources is a good way to progress when you hit a difficult topic that is hard to understand.
You might come across a blog or article that explains things at just the right difficulty level to make things click.
DeFi gets rekt so often that as an auditor I still don’t use it.
Even after 1000s of bugs crushed through audit contests, solo audits, bug bounties etc, it doesn’t feel like it has gotten much better.
Degens will accept this risk for the chance of profit, but how can we
I am convinced that writing a lot of PoCs and test coverage is THE best way to up-skill as a security auditor.
I remember asking
@0xleastwood
(who previously worked at
@sigp_io
) in an interview about how he went from intermediate to advanced. He wasn’t sure the reason and said
We're firm believers in crafting our own tests during security reviews 🧪
Why? It not only helps us discover more vulnerabilities but also grants us a deeper comprehension of the target.
You may notice the test suites that accompanies our reports aren't just PoCs, but offer
Everyone wants to be a solo auditor, while working at an audit firm is highly underrated.
With a newborn I have not been able to grind as hard as I did last year, but just passively upskilling daily by doing your job is a pretty sweet deal.
Consistant progress compounds over
Video coming soon!
Just had an amazing conversation with 100proof over the weekend about how he took home a 150k bounty on
@immunefi
.
We talked for over 2.5 hours about topics ranging from bounty hunting,
@code4rena
, computer science, web3 salaries and his massive payday.
1/ Late last night we received a notification through Immunefi of a vulnerability in the Notional smart contracts.
The vulnerable code was disabled immediately and no user funds are at risk.
User functionality is fully operational and you can continue to use Notional as normal.
My estimate and breakdown for the number of people who can consistently make more than 10k per month in web3 security as an independent security researcher.
spearbit has all the good independent researchers roughly ~100 onboarded. Lets say SRs and LSRs make more than 10k per
With all the talk of companies forcing their employees to come back to the office, it is awesome to be working in an industry that is truly 100% remote
Video is here!
@pashovkrum
joins me in this interview to share his latest auditing and business alpha around private audits and building industry connections
Link below 👇
Just finished my interview with
@andyfeili
and I can give you a pro-tip on those - never do them when you are underslept😂
All jokes aside, I did give some alpha on my solo auditing experience and all-things-web3-security as well. When is it coming out? Soon™️
This was a special one to be a part of. My first review as lead, in addition to having a few “ah ha” moments which helped improve my overall auditing process. Really interesting codebase, fantastic project.
We have just released the review for Lyra Finance V2 Smart Contracts.
4 criticals, 2 highs and 4 mediums all resolved by the
@lyrafinance
team. 🎉
Check out the report here:
If AI goes rogue it will start to introduce backdoors in the software that it writes for us.
This means we will always need security researchers performing code reviews 🫠
@1_00_proof
will be joining me in another podcast episode soon talking about his massive 7-figure bug bounty from discovering a very unique concentrated liquidity protocol bug, which put over 100m funds at risk.
What questions do you want me to ask him?
Try this next time you are learning something new
Give your brain time to absorb the information. Pull up various articles/videos on the topic, and instead of reading them all at once, read them over several weeks, a month or longer.
Spaced repetition is god tier
It is amazing to see how many people successfully made the switch to web3 security this year (many with no prior tech experience) thanks to
@code4rena
.
Securing the ecosystem while also providing the opportunity to upskill the next generation of security practitioners. 👏
What a year it’s been! In 2022, the C4 community:
- Received over $9.5M in rewards
- Made 10k+ unique findings
- Worked with Sponsors to run 135 comps
- Grew the Warden pack to 2.3k+
None of this would’ve been possible without your support, so thank you frens. Here’s to 2023 🎉
Found the tweet last year that got me into web3 security 😇
The timing was really good, found myself thinking - "hey what else am I going to do over the Christmas break, lets check out this CTF!"
Damn Vulnerable DeFi is the wargame to learn offensive security of DeFi smart contracts. Throughout numerous challenges you will build the skills to become a bug hunter or security auditor in the space, and yeah Merry Christmas🎄
#blockchain
Doing an interview answering stuff about my smart contract security journey next week. Any cool questions you'd like to hear answered from me?
P.S. Posting my two previous interviews as a comment under this, we will try to not repeat the questions from there much
If you enjoyed my recent interview with
@0xDjangoOnChain
on his success on
@immunefi
.
Make sure to also check out the video I did with
@1_00_proof
last month were he tells the full story of his 150k bounty.
Here is the clip in case you missed it.
In this episode
@BowTiedDravee
joins me and talks about his journey - learning smart contract auditing from scratch.
He shares auditing advice and his report automation process he used to rank 1st in gas optimisations in the $1M OpenSea contest.
2022 was life-changing. I quit my web2 DevOps job
+ Ranked 22nd on
@code4rena
(n°2 in sheer nb of findings) & became a Scout
+ Met a lot of awesome people at TrustX
+ Did 2 audits as a SR at
@SpearbitDAO
+ Was in
@yAcademyDAO
's 4th cohort
+ Made lots of frens 😄
LFG rock 2023!!!
The unfortunate truth is that DeFi does not fulfil the promise conducting finance without trusted intermediaries.
Majority protocols definitely *can* rug you if they wanted to, even if the code is audited/immutable etc etc
7/
I made a beginner roadmap video providing a bit more info on the above
I am documenting my web3 journey on my YouTube channel - follow for more web3 hacking content
📢 We're in the midst of reviewing applications for our Blockchain Security Internship! 📢
Haven't applied yet? Good news - applications remain open for the next 2 weeks.
Dive into the world of web3 security with Sigma Prime. Details below. ⬇️
Appreciate the overwhelming interest in joining our team!
Over 140 applications have come in for the Blockchain Security Intern position, with some truly outstanding candidates.
We will be evaluating and setting up interviews soon. 🙌
3/
learn solidity with
@PatrickAlphaC
's 32 hour solidity course
you don't need to go through everything, just pick up on the basics of solidity and web3
The biggest ever Code4rena audit is incoming, thanks to
@zksync
🤝
Find a valid vulnerability and take home a slice of the $1.1M prize pool.
Get yourselves ready Wardens 🫡