3DOↃ Security @3DOCsec

@muellerberndt OpenAI very much agrees with you @muellerberndt x.com/0xkarmacoma/st…

karma @0xkarmacoma

7 months ago

wrapped up an amazing run at @a16z with the all-star research and eng team. I am excited to share that I am starting a new chapter today in engineering acceleration at @OpenAI. Let's go!

56 2 275 27K 18

@eloufirjawad You are absolutely right. Let’s also not forget our brain, otherwise it’s shoveling low cost poop for someone else’s brain’s forced consumption

LLMs are bringing security research to the next level. Yesterday, they made up non-existing bugs. Today, they make up non-existing code, and report bugs on it. Tomorrow, they'll reply to this post saying how game-changing their model is over the ones I'm talking about

@muellerberndt @cantinaxyz A tough one, respect!

You can measure how vulnerable the code is after a contest. This can help: - Projects and users to estimate hack risk - Bug hunters to scope targets - Ecosystem to track what works best - Platforms to manage reputation risk TL;DR: More solo findings -> more hidden bugs. This works for most formats: flat pot, conditionals, invitationals, reserved auditors. As long as duplicates are allowed. ### Recent examples: - Cork exploit: last private contest had 4 solo mediums (out of 4 total mediums). "Chao 1 bias-corrected" estimates 6 unfound bugs. Jackknife 8 more bugs. - BeraBorrow's Recon's recent post about a critical: private contest had 8 solo mediums (out of 15 mediums), 6 doubletons (doubletons = found by two auditors). Chao 1: 4.5 more bugs, Jackknife: 9 more bugs. ### The science of capture-recapture There are many disciplines that use this approach: software engineering, quality control, biology & ecology, epidemiology, criminology, linguistics. Similarly, there are many estimator formulas: Lincoln-Petersen, Chapman, Schnabel, Schumacher–Eschmeyer, Jolly–Seber, Chao 1 & 2, ACE, ICE, Jackknife 1 & 2, Bootstrap, Zelterman, Good–Turing, etc. Will post some links below. Two simple examples are Jackknife 1 & 2, Chao 1 & 2 which roughly say : - Jackknife 2 (second-order, simplified): `unfound = 2 * uniques - doubletons`. Jackknife is more popular in software-inspection studies. - Chao 1: `unfound = (uniques^2) / (2 * doubletons)`. (A slightly different version for no doubletons) Specifics don't matter really - pick your favorite from the long list. What's important is they all say: more unique findings -> more hidden bugs. ### Intuitions Math is not always intuitive, so here are some intuitions. 1. Parallel worlds: If a bug is unique to one finder, there’s a parallel world where it stayed hidden because he got sick, or was booked on an audit, or just missed it. Maybe you're in that parallel world. In contrast, if there are many duplicates - in most worlds the same bugs are found. 2. Serial auditing: If you imagine auditors working in sequence, the contest is just a stopping point for the sequence. The contest with uniques stopped when new bugs were still being found, so more like these remain. In contrast, the contest with only duplicates stopped after finding most bugs of similar rarity. ### What can we do?! 1. Measure: what platforms, pot sizes, contest formats give the best coverage? 2. Educate clients on the more secure formats with data. 3. If you're a project, check if your contest was weak. ### No solo findings = code is safe? No. It's possible whole classes of niche bugs (e.g. cryptography) or higher complexity bugs were not found because pot was too low. That's always a risk. This rule doesn't tell as what's safe, but it tells us what's LIKELY still vulnerable. --------- See next tweet for links and statistical nitpicking

@jack__sanford @0xcastle_chain some replies here won't age well. mine included 👴

Code4rena will run audit contests for free, as public goods. 100% of funds from sponsors will go directly to auditors and judges. We won't take any cut. Why? 1. Competitions are commodities. They're CRUD apps. Why should builders pay premium for a website just to submit bugs? Especially smaller teams without VC funding. 2. Everyone deserves competitions. We tell all our clients to get a competition after their audit. That's because competitions simulate real world conditions, where there's thousands of eyes on a protocol. We want to make competitions as affordable as possible so everyone can get one. 3. It benefits our wardens. In 2021, we invented the competition format. We're still the platform with the largest auditor pool (10,000+ registered). Not only should builders have access to the best security talent, we believe auditors should have opportunities to work with great projects. Opening up our platform benefits our wardens. How will you afford this? Zellic is a profitable business. We make money doing traditional private audits through Zellic and Zenith. This benefits us because: (1) our clients are more secure after they run contests, and (2) Code4rena is a talent pipeline for Zenith. Will you stop maintaining the platform? Of course not. Since we acquired Code4rena, we've shipped several features and have several more already underway. C4 has a dedicated dev team that we're fully committed to. Besides, many of our clients at Zellic use C4. We're incentivized to make sure the platform works well. It's just that now we're allowing everyone to benefit from our investments in Code4rena. In conclusion: Run a contest on Code4rena! We won't take a cut, your prizes will go directly to wardens and judges. For full details, check out our blog post here: zellic.io/blog/code4rena…

Straight to bookmarks 💯

Zellic @zellic_io

a year ago

We retrieved every contract on Ethereum. Along the way, we found the exact date when 16,000 unique contracts were deployed (the most in one day), the EOA with the most deployed contracts (2.9M), and much more. This is how we did it.🧵 (Spoiler: It’s 69,788,231 contracts!)

21 62 506 70K 325

@GalloDaSballo if foundry is where you need it, you could just use this guy -> book.getfoundry.sh/cheatcodes/etch

BOUNTYHUNT3RZ Episode 12: w/ @tpiliposian @0xriptide Bringing out the AUDITOOOR We discuss how auditors and bounty hunters differ, @hexens audit model, what the @certora prover actually does, what devs should do prior to deploying, RED FLAGS to look for when looking at a project to bounty hunt on, why everyone misses bugs, getting your money's worth as a protocol dev with audits and contests, and much, much, more ... podcast, discord, substack -> linktr.ee/bountyhunt3rz

@danielvf this TG channel can reliably tell you when you should panic or can rush to the new emojis t.me/AppleActivelyE…

👀 Hacker mindset but white hat, passionate, dedicated, attention to detail, you wanna work with us? ➡️📩@PabloSabbatella @opsek_io

Pablo Sabbatella @PabloSabbatella

a year ago

Opsek is growing: we are looking for the best talent obsessed with Cybersecurity and blockchain technology. If you are, drop me a dm. btw, we don't work with anons, camera always on.

12 7 72 16K 8

@Stacks if this is not a severe security issue for you guys, I literally don’t know what would. For the record: are you guys really swiping it under the carpet? Why?

100proof.org @1_00_proof

a year ago

Last year, @neumoXX and I (hunting as Pai Mei & Gandalf) discovered and disclosed a very plausible phishing attack on the most common NFT contract in the @Stacks ecosystem. At its heart, it's due to the way authentication is commonly implemented in Clarity contracts. But it

3 9 60 4K 21

@0xGreed_ Ouch that is less fun. But the bright side is that it could become a nice gag for a new date 😅

Kicked from Immunefi for not paying? Hold my beer.

0xDjango @0xDjangoOnChain

2 years ago

In November, I submitted a critical bug to Cronos (@cronosapp) which they downplayed and have since been kicked off Immunefi. Here's some info about the bug and an example of how projects can simply not pay a fair amount. Report: gist.github.com/fatherGoose1/6… tl;dr: - It's a

42 63 383 92K 131

@bernd_eth @code4rena 🐐

The best time to start writing searchable notes about design and gotchas of the protocols I work on was a couple of years ago. The second best time is now 🎧@bountyhunt3rz

Certora is now open source! What’s your excuse now for not securing your protocol, anon?

Lesson #2: developers fix the bugs they see, so those left for SRs to find are those they don't see - our job is to clear blind spots, not inheriting them

Well, it turned out to be an H finding just minutes into the audit. Lesson #1: the one and only reason to abandon a lead is "to know why it's not a problem" 2/3

Alpha for SRs Last week I asked about a function during a kick-off code walkthrough call. Got replied it was standard and not problematic, so I decided to ramp up with knowledge of the codebase by trying to understand why exactly it's this way 1/3