Kenny

Another Cafe Cursor in the books. Happy to see so many new and old faces! Where should we host it next?

Cafe Cursor happening in Bangkok today @cursor_ai @cursorcommunity

Finally, an article writing about ”loop engineering” in a condensed format without overly glorifying the concept. It's a shift in workflow and methodology. That's it.

Sakana Fugu seems to be on par with Mythos and Fable. And a few days ago, we saw @OpenRouter writing about their Fusion layer. It seems like multi-agent orchestration is here to stay. Together is strong. That's actually kind of poetic.

Let’s go! To the next Cursor Cafe! ☕️

End of an era 😢. Thanks for helping me and so many SRs at the beginning of our journeys. Grateful for all the good you guys brought to the space 🙏

Hope to see you there! 🇹🇭

I guess this is now the new reality of contests.

I have to say, after competing in so many contests and joining a lot of escalations. My observation is that the protocol owners and admins are probably at a different level. Despite human errors still being one of the most common reasons for hacks, this obviously doesn’t apply to these admins. They can probably use one foot to jump through fire hoops blindfolded. So, configuring 10 steps to achieve the desired result in a broken protocol is most likely child’s play for them. If you want to hire some truly superhuman talent, go to any contest and ask for the admins in these protocols. They're simply amazing. Wow.

From my experience, this is unfortunately more common than not. The moment the contest reaches the judging phase, everyone, including the judges, is out to try to invalidate your issue. And the reasons for the invalidation have become increasingly brash over time. Unfortunately, this particular contest model is probably a walking zombie (soon to be dead). On the positive side, there's once again room for someone to make a legendary dent in this space.

On a daily basis, I'm seeing protocol hacks across the space. Protocols are reaching out to the hackers, asking for the funds back in return for 10% of the stolen assets as a "bounty". However, lately, I've been seeing even higher numbers, though, reaching 20% and sometimes even more. This suggests to me that the actual legal/enforcement leverage these protocols believe they have isn't enough to deter or reach a conclusion, so they're increasing their settlement point. At the same time, we're starting to see stricter and harsher rules in bug bounties/contests. More conditional pots, bureaucracy, and other frictions. I believe the industry needs to have a reckoning at some point: How do we reconcile the fact that black hat "bounties" are increasing while white hat bounties are starting to shrink?

A must-read for every SR by @OpenZeppelin: summary of 2025. Sad to see so many big protocols hacked. It's clear that we need to continue innovating. openzeppelin.com/news/web3-s…

The approach for private audits and contests is entirely different. Below, I've listed my approach as well as the approach taken by many other SRs in this space. Let me know if I have missed anything. For contests: - I will only submit issues I firmly believe are either Medium or High. If there are potential issues that I estimate to be Low or Informational, I'll not submit them, even if they would provide some value to the protocol. Don't wanna risk my ratio/ranking being affected. - If I don't have enough time, or I want to YOLO speedrun it, I will focus on parts I believe have the highest ROI. I won't even look at other parts of the code. Hope other SRs will look at those parts, but regardless, it is not my problem. - I am biased towards my own findings and sceptical toward other SRs' findings. I'll be harsher about the validity of those and often think it is a design choice, out of scope, or already covered as a known issue. Sometimes I'll argue for that as well, if I believe I have a chance of invalidating it. - How the protocol carries on in the future doesn't really concern me. Whether they have fared well or poorly, I'm already on the next audit. Don't know, don't really care. For private audits - I will submit all issues I believe are of value to the client. For issues estimated to be Low or Informational, I make sure to curate a shorter list of these issues (to avoid overwhelming the client). Always happy to go through the issues together as well. - It's a must to have a complete understanding of the codebase. In addition to manual reviews, coverage in the form of unit tests and fuzz tests is also a must. - When I work with other SRs, we'll talk deeply about the different issues we've come up with. It's not about "winning" over the other; we share a common goal of providing value to the client. We will try to consolidate our issues and see if we can get to the root of the problems. Maybe it's a structural or even architectural issue that would eliminate many of the vulnerabilities. - After the protocol has been deployed, I make sure to stay in contact with the team to make sure everything is as it should be. If there's a need for a follow-up audit or other feedback, I'll prioritise it.

Super happy to be part of a growing @cursor_ai community here in Bangkok. Exchanging ideas and making sure I'm refining my craft across the engineering domains, whether it's AI or blockchain security. Thanks, everyone, for coming out! 🙏

Who knew that the last boss of the contest would be the overlap between whether something is a design choice or a vulnerability?

I remember both @DevDacian and @VittoStack reaching out to the SRs to ask whether this feature would be valuable for SRs. Having only written a PoS (piece of shit) script and implemented it into my workflow, I was hoping the API would be released asap. And fast forward. The team listened and delivered. So excellent job, and shoutout to the team @cyfrin. I'll be writing a bit more over the coming days about how I'll use the Solodit API when auditing any protocol. Stay tuned! 🔥

Here's a small tip for auditing new protocols. 1. Go to your LLM of choice. 2. Ask it to generate a mermaid diagram of the user journey of said protocol. 3. Paste it into Excalidraw or any other visualising tool. 4. Get an excellent overview of how the code flows very fast. Below is a mermaid diagram generated for a recent contest.