bitmay.eth

I'm building in crypto/Web3 and always looking to meet more people who are serious about shipping. If you're building something or looking for your next opportunity in the crypto/Web3, drop a reply with what you're working on or what you're looking for. let's build together 🤝

Testing Solidity directly in browser with @SolidityREPL. Import files from any public Git repository.

Solidity experiments should take seconds. I wrote about why I built @SolidityREPL, its replay-based execution model, EVM inspection, and why it complements tools like Foundry instead of replacing them.

I got tired of creating a Foundry project just to answer one stupid Solidity question. So I built @SolidityREPL. Browser-based. No install. No setup. Write Solidity. Run it instantly. Fork any EVM-compatible chain. Inspect storage, calls, logs, reverts, and opcodes. solidity-repl.dev/

A future EVM primitive I'd love to see: `EXECUTE codeHash WITH { storage: allowed, value: forbidden, selfdestruct: forbidden, externalCalls: allowed }` Contracts could safely execute code supplied via calldata under explicit capability restrictions.

I really like the direction Glamsterdam is taking. Making state access more explicit and paving the way for better parallel execution. The future of Ethereum shouldn't just be "more gas." It should be a smarter, more parallel, more efficient EVM.

New Log4j RCE. This is a silent RCE caused by unsafe deserialization, but exploitation requires the target to already be processing a serialized LogEvent through FilteredObjectInputStream, with a usable gadget present on the classpath.

Been pretty inactive over the past month. Took some time away, but I'm still here and still building. I'll try to be more active again, share more of what I'm working on, and post more often.

Old attack vectors keep resurfacing with better branding. AI agents become permissions. RWAs become custody assumptions. Restaking becomes correlated risk. L2 growth becomes cross-chain complexity.

AI makes everything look instant. But knowing what is wrong, what is missing, and what should be improved still requires real knowledge.

Building EVM Chronicle keeps reminding me how much of Ethereum is still hidden beneath the surface. Code is visible. Transactions are visible. But state is where many of the real stories live.

New exploit on Ethereum: TrustedVolumes lost around $5.87M in WETH, USDT, WBTC, and USDC. The exploit appears to involve a TrustedVolumes-controlled custom RFQ swap proxy: 0xeEeEEe53033F7227d488ae83a27Bc9A9D5051756 Victim contract / resolver: 0x9bA0CF1588E1DFA905eC948F7FE5104dD40EDa31 Exploiter: 0xC3EBDdEa4f69df717a8f5c89e7cF20C1c0389100 Trace exploit transaction: evmchronicle.io/tx/0xc5c61b3… See image below for the interesting things I found on this exploit.