Resident & Security Researcher @cantinasecurity | Request an audit 📝 @ https://xitter.cf/t.co/i51slFowVa
Joined July 2017
- Tweets298
- Following94
- Followers136
- Likes2.5K
kodyvim retweeted
Three new queries approved.
@0xangky lags liquidation executed without health factor validation, allowing unsafe position closures.
@kodyvim_ flags contract logic that updates state via memory copy, creating silent data corruption risks.
@baptonic3 flags missing message origin validation in LayerZero V2 LZCompose, enabling cross-chain message spoofing.
Queries below:
Found a vuln in a BSC voting contract
(0xC06e39FdC14DbBcdDdDB72cE5903f359D89b9813 – HftVote)
Spotted using @xyz_remedy’s Glider during the contest.
Core flaw: live balance voting
flash loans = manipulated voting power
token transfers = double voting
👇
Glider tore through on-chain data in seconds and flagged it instantly.
Massive for spotting vulnerabilities across chain or deployments.
Huge props to the @xyz_remedy team for building such a powerful free tool for researchers.
Phase 2 of the contest is live, no end date. LFG Anon! r.xyz/
kodyvim retweeted
Smart contract audits are expensive. Audit firms cost 20k-40k per week, often more.
I'm starting an initiative to offer subsidized audits through @birdseye_sec for bootstrapped and lightly-funded projects that don't have a huge budget for security.
DM me if you have a project that needs a security review but can't afford to pay market rates. My TG is in my bio.
No contract should be deployed un-audited. Please share with any projects you know that could benefit from this program.
kodyvim retweeted
Building a secure protocol is not that complicated… you just need to:
- Incorporate security from the design
- Discuss and address every edge case
- Build a strong test case
- Get the code audited by strong auditors (preferably multiple times)
- Formally verify your code
- Develop an extra safe frontend
- Build a comprehensive and detailed emergency plan
- Carefully build a deploy script (and ideally get it audited too)
- Set up and manage a bug bounty program (including for the frontend)
- Closely monitor the contracts immediately after launch to ensure the configs are correct and the deployment hasn’t been attacked
- Perform a staged rollout, progressively increasing the limits
- Monitor the chain for suspicious activity
- Monitor every dependency that could break your protocol
- Maintain an external safe failure mode (e.g. pausing guardians)
- Properly manage governance
- Properly manage signer keys
And some other things
kodyvim retweeted
kodyvim retweeted
Welcome back to Sherlock’s Vulnerability Spotlight, where we highlight an impactful vulnerability uncovered during a Sherlock audit.
This week, we have a Multisig Duplication Vulnerability.
It was uncovered by @0xShoonya, @thongtrungtran, @kodyvim_,
@captsparrowjac, @ZanyBonzy, @AmanKakar12, @boredpukar,
@bughuntoor, @shanb1605, @IlloySci, @jasonxiale, @dejiolaniyannn, @Rsam_eth, @hope_silver, @alkarin_, @MissKeishaSheFD and @zxriptor
on the @Mellowprotocol Flexible Vaults Contest 🧵
kodyvim retweeted
Cantina security researchers keep winning!
The Monad Airdrop Claim Portal is live
Claim your MON here: claim.monad.xyz
claim.monad.xyz
Excited to be part of this program.
Thanks @cantinaxyz for the opportunity!!
The Cantina Fellowship has opened its doors to a seasoned security expert — our newest Apprentice, @kodyvim_! 🪐
His journey into cybersecurity began over five years ago, when he discovered his talent for uncovering what others miss. A passion for identifying vulnerabilities that threaten digital ecosystems led him to dedicate himself to strengthening defenses across web applications, smart contracts, and complex protocols.
