rick rubin of blockchain web3 security building Bittersteel
Joined July 2019
- Tweets1.1K
- Following1K
- Followers169
- Likes3.2K
If you’re building your own AI system for web3 sec, I put together some notes from building mine:
-> how to move beyond low-hanging fruit
-> keep investigations on track
-> tell whether the system is actually improving
The new SLOTNUM opcode in Glamsterdam can tell a smart contract it's slot 100 while the chain is already in slot 103.
It's intentional. But I'm not sure everyone building on it knows that.
EIP-8198, 8272, 8205 and 7793 all plan to use SLOTNUM and all want the block's slot.
LUCID (EIP-8184, encrypted mempool) is different (deliberately wants a past slot).
Bittersteel investigations run as a loop:
DECIDE -> selects the next evidence-producing question
EXECUTE -> assigns that task to the appropriate research process and tools
INCORPORATE -> validates the result and adds the durable claims, evidence, gaps, and follow-up tasks
Most cycles move the investigation forward. But progress can also create tunnel vision: every new task inherits the previous framing, assumptions, and evidence.
So I've added an extra RECONSTRUCT step.
My friends at Intent Computing just shipped two tools for AI-assisted security, and they’re looking for feedback from security researchers.
Intent Check: AI review that checks code against what it was meant to do.
KIT: real formal verification (KEVM) driven by your agent.
> search broadly
> give credible uncertainty durable ownership
> accumulate complexity through cycles (based on changing evidence)
> adapt from observed failures
> human involvement at strategic boundaries
Two problems when building AI systems for web3sec.
1. Constrain agents too much and they inherit your assumptions. They stay precise, but only within the boundaries you defined.
2. Keep the task too broad and they drift into shallow theories that never become real findings.