QUORUM @runQuorum

One of the hacks was run blind. We replayed four real 2026 incidents to the amount stolen: Unistreet, Sandbox, Squid, and GaslessReservoir. The last one was a hack the operator had never read. No walkthrough. No head start. The tool had to get there on its own. We also publish the number most security writeups leave out. Quorum catches roughly 2 in 3 known bugs. The misses stay next to the hits. We keep improving and adding updates Prove it or drop it runquorum.site

@soligxbt @SnarksPad Dev cooking as always

Last week updates. We rebuilt Quorum because a flag was too easy to believe. A bug is not real NOW until the tool writes the attack, runs it on a fork of live state, and watches the money move. If the money does not move, it stays off the report. You give it a chain, an address, a block, and a one-line hypothesis. PROVEN if it pays. UNPROVEN if it does not, with a reason. It still does not watch the room. A compromised laptop or a hot wallet drained by a third-party tool stays outside the report. Bitget was that case. Quorum would not have caught it. An empty report is not a certificate of safety. It is the tool refusing to guess. Prove it or drop it. runquorum.site

Your scanner found 20 issues. How many would you actually trust? That's something we've been thinking about while building Quorum. A scanner can flag something suspicious, but that doesn't automatically make it a bug. So we built Quorum to be stricter. It has 6 independent lenses. one can't report a bug on its own. two have to agree, for different reasons. Sometimes, nothing makes it into the report. We'd rather have a finding earn its place than give you another thing to investigate for no good reason. still building. still testing. more to share as we go. runquorum.site

Another day to inform you that Quorum does not start with a verdict. It starts with a guess you have to write down. Give it a chain, an address, a block, and a one-line hypothesis. It will try to make that hypothesis pay on a fork of live state. If the money moves, the result is PROVEN. If it does not, the result is UNPROVEN, with a reason. A checker having a feeling is no longer the report. The report is what survived the attempt.

What Quorum does not do: it does not watch the room. It reads the contract. It will not see a compromised laptop. It will not catch a hot wallet drained by a third-party tool. The recent Bitget incident is a good example. The loss was not in the contract our scanner reads, so Quorum would not have caught it. An empty report there would have been the honest one. You may still open a report and find nothing in it. That does not mean the checkers sat still. Some of them may have noticed something but none of them are allowed to publish it alone. Two have to agree, from different evidence, before a finding exists. If they do not, the page stays empty. If the loss never lived in the contract, it stays empty for a second reason. An empty report is not a certificate of safety. It is a scanner with a strict rule. The rebuild made that rule harder. A bug is not called real until the tool writes the attack, runs it on a fork of live state, and watches the money move.

We rebuilt Quorum because the old reports were too easy to believe. A checker could flag something, and that was enough to call it a bug. Some of those flags were undeserving. Now a finding has to survive a harder test. Quorum writes the attack and runs it on a fork of the live chain. If the money does not move, it stays off the report. An empty result is better than a bug not shown. Test your own contract: runquorum.site

the latest on @runQuorum , so many major changes have been made since launch! it’s now a fully open-source security tool here to serve the community

QUORUM @runQuorum

6 days ago

We rebuilt Quorum from the ground up The old version guessed. The new one won’t call a bug real until it writes the attack, runs it against a fork of the live chain, and watches the money actually move. 🧵

6 10 18 1K 4

@soligxbt Dev ships

Do you want to test your own contract? Give Quorum a chain, an address, the block, and a one-line hypothesis. It returns PROVEN with the exploit that pays, or UNPROVEN with the reason. Now live on Arbitrum and Robinhood Chain. runquorum.site

In our latest run, we pointed Quorum at the 20 largest money-holding contracts on Robinhood Chain, representing $400M+. The honest result so far, we have found no bug we could prove. Mostly standard, well-built code. We’re working down the list and publishing whatever we find.

We rebuilt Quorum from the ground up The old version guessed. The new one won’t call a bug real until it writes the attack, runs it against a fork of the live chain, and watches the money actually move. 🧵

QUORUM @runQuorum

a week ago

With Quorum, prove it or drop it

6 9 19 1K 4

With Quorum, prove it or drop it