Perimeter (@perimeter_sec) header
Perimeter (@perimeter_sec) profile picture

Perimeter

@perimeter_sec

Industry leading security services specialized in fuzzing, securing DeFi's largest protocols

perimetersec.io
Joined January 2024
  • Tweets71
  • Following7
  • Followers489
25Media
Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)Photo by Perimeter (@perimeter_sec)
Saving $69M at Risk: Unlimited Unbacked Cross Chain Asset Minting in Top Cross-Chain Ecosystem

Saving $69M at Risk: Unlimited Unbacked Cross Chain Asset Minting in Top Cross-Chain Ecosystem

Article · @perimeter_sec
4
2
38
6,407
Three fuzzing engagements with @monad. Monocle: e2e fuzzing by replaying mainnet & testnet against invariants tx-fuzz: RPC and execution client fuzzed under load Native C++ fuzzers: execution client and compiler fuzzed directly, checked against evmone Big credit to @monad.
Image from Perimeter (@perimeter_sec)
3
1
2
20
1,274
Reports: github.com/perimetersec/reso… github.com/perimetersec/reso… github.com/perimetersec/reso…
resources/reports/Monad Fuzzing Part 1 Report Public.pdf at main · perimetersec/resources

resources/reports/Monad Fuzzing Part 1 Report Public.pdf at main · perimetersec/resources

Public resources on fuzzing services, methodologies, and benefits for protocol security. - perimetersec/resources

github.com
3
93
Perimeter retweeted
pashov (@pashov) profile picture
pashov
@pashovJul 24
Awesome resource for EVM Fuzzing, every Solidity developer should study this, do not skip your fuzz testing Tens of tools and solutions, Fizz from pashov/skills also mentioned🙏Thank you for compiling this list and the contribution @rappie_eth 🫡 github.com/perimetersec/evm-…
GitHub - perimetersec/evm-fuzzing-resources: A curated collection of tools, articles, research, and...

GitHub - perimetersec/evm-fuzzing-resources: A curated collection of tools, articles, research, and...

A curated collection of tools, articles, research, and guides for fuzzing smart contracts on the Ethereum Virtual Machine (EVM). - perimetersec/evm-fuzzing-resources

github.com
6
29
216
9,818
Shout out to @rappie_eth with @perimeter_sec for finding the above example. He's been fuzzing behavior differences in various solidity compilers. 3/3
1
2
21
1,375
Perimeter retweeted
Rappie (@rappie_eth) profile picture
Rappie
@rappie_ethJun 26
Found this through differential fuzzing and first thought it was critical. Turns out --via-ir can change a function's behavior, as documented among the breaking changes (link below). Sharing this because it surprised me, and will probably surprise others as well.
Daniel Von Fange (@danielvf) profile pictureDaniel Von Fange
@danielvfJun 25
Most people don't know that the --via-ir flag makes changes in the Solidity language. If using it to compile with, your code can do different things from compiling without it. If using it, here's some things you should do: 1/3
Image from Daniel Von Fange (@danielvf)
1
4
25
1,789
Perimeter retweeted
Perimeter (@perimeter_sec) profile picture
Perimeter
@perimeter_secJun 15
Saving $69M at Risk: Unlimited Unbacked Cross Chain Asset Minting in Top Cross-Chain Ecosystem

Saving $69M at Risk: Unlimited Unbacked Cross Chain Asset Minting in Top Cross-Chain Ecosystem

Article · @perimeter_sec
4
2
38
6,407
We are donating $100 to each of these public goods on @Giveth QF Round 16. Most of them are tools we actually use in our fuzzing work. The rest are important for the ecosystem we operate in. All open source, zero revenue. Going one by one 👇
Image from Perimeter (@perimeter_sec)
7
6
3
25
2,168
more replies
SEAL 911. Hopefully you never need them but if you do, they are there 24/7, doing the invisible work saving millions. qf.giveth.io/project/seal-91…
Image from Perimeter (@perimeter_sec)
1
1
185
The round has less than 4 days left. If these matter to you, contributions have outsized impact. Appreciate the teams behind all of them!
Image from Perimeter (@perimeter_sec)
3
146
🛡️ $69 Million TVL Saved Our very own @gbrigandi reported a critical vulnerability, saving $69,000,000 in TVL for @Polkadot. We’re proud to strengthen the ecosystem through responsible disclosure and proactive security research. Blog post coming soon! PS: Found with fuzzing
Image from Perimeter (@perimeter_sec)
6
2
7
47
17,995
Polkadot public disclosure and postmortem forum.polkadot.network/t/pos…
Postmortem: XCM InitiateTransfer Origin Leak

Postmortem: XCM InitiateTransfer Origin Leak

Summary An XCM issue was reported via the bug bounty program. The issue allowed any account to act as any chain via XCM. In Asset Hub it means root access for many chains. In general it gives them...

forum.polkadot.network
10
1,314
Built the tools. Found the bugs. We’re excited to welcome Gianluca Brigandi (@gbrigandi) to Perimeter as Tooling Specialist. • Author of Traverse, Tameshi, and ThalIR • Multiple confirmed bounties
Image from Perimeter (@perimeter_sec)
2
2
2
12
1,508
more replies
No generic workflow. Codebase-specific tooling. His approach: • Custom tooling for each codebase • Combine static analysis, fuzzing, compiler methods + more • Fine-tuned to target the system Result: • Deep, novel bugs • Confirmed bounties
1
4
188
More to come. One particularly compelling piece of Gianluca’s work will be public soon.
4
177
Load more