Pavlo Midvel 🇺🇦

Test smart contracts as you have a black box. Disregard what you know about the code and work as QA based on requirements knowledge - that will help you find all edgecases and potential vulnerabilities. As vulnerabilities start from bugs, and bugs are deviations from requirements

It's been a while since I posted smth on twitter. But last few weeks were so packed with events and breaches, that I felt an urge to return to investigations and researches in cybersec and web3 sec. Could not imagine axios npm compromise, solana dex hack, balancer compromise and row of other events packed so closely.

It was a fun event on PQC (post quantum cryptography) migration. Thanks to @billatnapier and guests for that youtu.be/W6uSo3uohmU?si=3X5f…

Currently attending another webinar - on modern approach to cybersecurity. And the framing thought resonates a lot within me: ‼️Cybersecurity is about risk management, and risk management is about money (loss). The one should never underestimate the necessity of security budget

Another point from event - live demonstration of PQC readiness assessment by automated tools. Example shown on panel - analysis of TrustWallet core repo. That was ... well ... impactful to see how web3 industry is still in procrastination phase for PQC (even from single example)

Another thought why PQC awareness matters - even now principle works ❗️Harvest Now, Decrypt Later❗️ Adversaries harvest data, waiting around for quantum computer to crack it later. Even if you have strong confidentiality, encrypted data breach is still a breach (just delayed)

Another thought I liked from the discussion - that while PQC expects certain technical and hardware updates, it is still heavily based on crypto-hygiene, awareness and understanding of foundations of integrity and confidentiality.

One of points which I liked in PQC discussion - that blockchain is an actual technology reviewed to become a component of PQC frameworks Maybe it will finally achieve its initial technological goal.

Great event on post-quantum cryptography, organized by @billatnapier The framing thought ❗️it is not a sci-fi, but a real threat - just delayed in time ❗️ It is good the world already started work on compliance and migration planning, but we are still procrastinating this.

Great read on the newly discovered supply chain vulnerability. It brings several important topics: ❗️why decentralization matters - even in zero-trust systems ❗️why cryptography and zk particularly matters ❗️why SRs should have damn good qualification infosecwriteups.com/the-god-…

Being gone for a while - inspected closely how governance works on one of the lending protocols. Not to say that it is slow, but I'd say that close monitoring of proposals expiration and renewal dates is a must have for any protocol. Just in case, to avoid highjacking.

You can tell how secure the protocol is based on the quality of tests, and ratio of scenarios/edgecases vs isolated unit tests.

One more tweet about necessity of proper testing strategy from day 1 of development. You can't just have bunch of isolated unit tests to "get the coverage". Work with actual scenarios on how users and admins may behave.

⚠️Vibe coding is the high-interest loan of software development. ❗️Never trust, always verify. ✅️ Build skills, not shortcuts. Good piece on dangers of incorrect overusing of AI in development. hackernoon.com/vibe-coding-i…

Weeks #33-36 in my web3 sec Abandoned this thread for a while, got quite a lot into the bag: - lending protocol advising on (!) accuracy loss and overflows: nasty bugs with a lot of headache to find them - fullstack audit for RWA protocol Just 2 things, but quite enormous in size

Security starts before the development start: you need to understand precisely what your protocol should do - and think on exact parameters limit and exact behavior. Security starts from understanding your requirements.

Web3 security is about risks analysis. And that requires structured creativity, to put the whole protocol into your mind and imagine all possible flaws and risks. Key part here is "creativity" - you can analyze only what you can imagine. So, boost your creativity- and have fun 😎

That is why most important topics in web3 are educating users, account abstraction and zk login.