Research Writer @QuillAudits_AI | @rektoff_xyz C6 | Building @pocarena | Prev - @Kleros_io
🇮🇳
Joined December 2021
- Tweets385
- Following1.2K
- Followers248
- Likes684
sherlockvarm retweeted
You own the token. Do you own the asset?
Tomorrow, we’re talking about what ownership means when assets move onchain.
Can you redeem your tokens? Is there a buyer when you want out? What happens if something breaks?
Join “Tokenisation Goes Mainstream” with:
@constant_fi
@rohitonchain_
@Yas_MoonUp
@Alex_Khailuk
@Iv4n_Ko
@dewip979
@changis_k
Hosted by Anmol (@SherlockVarm), Security Researcher at QuillAudits, with more guests on the panel.
🗓️ Thursday, 29 October
🕝 2:30 to 4:00 PM UTC | 8:00 to 9:30 PM IST
🎙️ Live on @QuillAudits_AI
What’s one question you wish more RWA projects would answer? Drop it below and bring it to the Space.
Stay tuned for the reminder link.
sherlockvarm retweeted
Our Smart Contract Auditor @kalp_eth is speaking at the @summit_defi!
The Proof Lied: DeFi's Invisible Circuit Exploits
He’ll break down a critical ZK bug where every proof verifies, yet a missing circuit constraint creates a silent exploit. Learn how to detect and prevent these invisible failures.
2 Nov · 02:30PM IST · Amber session
Don’t miss it 🥷
sherlockvarm retweeted
In Mumbai for Devcon?
Join QuillAudits, @0xPolygon and @zothdotio for a private dinner on tokenization, stablecoins & security.
Tokenized U.S. Treasury funds represent $14.59B in distributed value, according to @RWA_xyz .
More money is moving onchain. How do we make sure it’s protected once it gets there?
That’s what we’re bringing to The Institutional Table.
21 seats. One table. No panel, no pitch deck.
🗓️ 2 November
🕢 7:30 to 10:30 PM IST
📍 BKC, Mumbai
Request a seat: luma.com/quilla-vmnc
Attendance requires host approval. Venue details will be shared with confirmed guests.
sherlockvarm retweeted
You own the token. Do you own the asset?
Can you redeem it? Who buys when you want out?
Tokenisation Goes Mainstream
A live QuillAudits X Space.
📍29 Oct • 2:30–4:00 PM UTC
Bring your questions. Stay tuned for the lineup and joining details.
sherlockvarm retweeted
quillshield just crossed 100 users in beta.
it's our multi-agent ai auditor, running on the best cyber models, including claude mythos 5.1.
recently it found a working exploit path in a live defi lending contract that a human auditor had ruled out:
xitter.gq/QuillAudits_AI/status/…
opening 5 free slots
reply "shield" and i'll dm you a code.
QuillShield, our multi-agent AI auditor, independently discovered and wrote a working exploit for a bug in a live lending contract, after a 12-agent AI pass had found the bug and a human auditor had stopped at the safeguard.
The auditor later rebuilt the exploit on a mainnet fork and proved it works.
The auditor is @Harvesto12, a security researcher.
His 12-agent pass had already flagged the bug. He tested one attack path, a compensating safeguard elsewhere in the system blocked it, so he filed the bug as refuted and moved on.
QuillShield found the same bug on its own, but it came at it from a different path, one the safeguard did not cover, and then wrote its own exploit test for it.
Then he took that exploit test and rebuilt it himself on a Foundry mainnet fork, with a fresh account and no injected state, so nothing was staged. It went through.
The rest of the run, in his numbers
• 8 findings, 4 of them his pass had not caught
• 3 of the 8 exploit tests it wrote and ran passed
• severity on the bug went Medium from QuillShield, Critical from him
4 reviewers, and not one of them disputed that the bug is real.
His explanation for why it got through where he hadn't is the part I keep thinking about. He had tested one path and assumed the safeguard handled the rest. QuillShield had no such assumption, so it worked through the other paths until one went past it.
That's the point of building QuillShield: to keep challenging the code when one blocked attack makes it look safe.
sherlockvarm retweeted
everyone's been talking about AI agents finding a way past what was supposed to stop them, and here's a smart contract version of it:
harvesto ran a few AI audit agents on a contract he'd already reviewed, quillshield included ( @QuillAudits_AI multi-agent auditor )
• the root bug was found, but he'd ruled it out because a safeguard blocked his attack
• quillshield didn't stop at that safeguard, it kept trying other paths and found one that got around it
• it wrote its own exploit test, and he rebuilt it himself on a mainnet fork and it held up
the part I care about most is a tool that keeps trying after everyone else has moved on
sherlockvarm retweeted
Abhinav Sharma · DSS 2026
“Quantum-Safe Is Not Just Post-Quantum Signatures: The Five Other Layers Quantum Actually Breaks in Blockchains”
See the session:
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Abhinav Sharma: Quantum-Safe Is Not Just Post-Quantum Signatures: The Five Other Layers Quantum Actually Breaks in Blockchains.
sherlockvarm retweeted
Coming to Mumbai for Devcon next week? 🇮🇳
Don’t just attend Devcon. Get out, explore Mumbai, and hit the side events happening across the city!
I’ve curated them all in one interactive map 🗺️ event timings, live traffic, estimated travel times, public transport routes, and more.
Organizing a Devcon side event? DM me and I’ll add it to the map!
Make the most of Mumbai. 🌴
devcon8.space/
sherlockvarm retweeted
Our auditor @cryptanu is taking the stage at @summit_defi in Mumbai!
Damn Vulnerable Daml: live CTF-style challenges built from real bugs he found on the Canton network while reviewing Daml code. Inspired by Ethernaut and Damn Vulnerable DeFi.
1st Nov, 02:30PM IST, Amber room
Save it to your agenda: defisecuritysummit.org/2026/…
See you there. 🛡️
Thanks to AI, cybersecurity is becoming one of the hottest topics across every industry.
As AI expands the capabilities of black-hat hackers, we need to leverage it to empower white-hat hackers and penetration testers with equally powerful tools. The goal is to stay one step ahead of attackers by identifying and mitigating vulnerabilities before they can exploit them.
Scan your smart contracts before attackers do.
We are opening beta access to QuillShield, our multi-agent auditor for EVM smart contracts, for the first 50 teams.
October has made it clear that waiting is no longer an option. In the last few days alone:
• PHP: pre-auth remote code execution, CVSS 9.2
• GitLab: CVSS 10, self-hosted servers back to 2014
• Node.js: 10 CVEs in one release
• Railway: customer secrets accessed
• LiteLLM: credential stealer shipped on PyPI
AI helped find some of these bugs, and attackers have the same tools.
A bug in a deployed smart contract can drain funds in a single transaction, so we built QuillShield to find them first. Here's what it has done so far:
> 25 Critical or High vulnerabilities caught across 155 projects
> 497 findings, with 85% of auditor-reviewed ones confirmed valid
> 350,000+ lines of Solidity reviewed
> 83.8% on EVMBench, against 45.6% for the best published model
Here's the beta link: shield.quillaudits.com/
sherlockvarm retweeted
Scan your smart contracts before attackers do.
We are opening beta access to QuillShield, our multi-agent auditor for EVM smart contracts, for the first 50 teams.
October has made it clear that waiting is no longer an option. In the last few days alone:
• PHP: pre-auth remote code execution, CVSS 9.2
• GitLab: CVSS 10, self-hosted servers back to 2014
• Node.js: 10 CVEs in one release
• Railway: customer secrets accessed
• LiteLLM: credential stealer shipped on PyPI
AI helped find some of these bugs, and attackers have the same tools.
A bug in a deployed smart contract can drain funds in a single transaction, so we built QuillShield to find them first. Here's what it has done so far:
> 25 Critical or High vulnerabilities caught across 155 projects
> 497 findings, with 85% of auditor-reviewed ones confirmed valid
> 350,000+ lines of Solidity reviewed
> 83.8% on EVMBench, against 45.6% for the best published model
Here's the beta link: shield.quillaudits.com/
sherlockvarm retweeted
php2shell does not touch a single smart contract, and it can still drain your users.
The most serious PHP bug in over a decade. CVSS 9.2. No login needed.
It is made up of two memory-safety bugs in the PHP runtime itself rather than in WordPress, Laravel or any plugin, which is why it reaches so far.
Every PHP version from 5.4 through 8.5.11 is affected.
HOW IT WORKS :
PHP is designed so that every request starts with a clean state. When a request crashes during parsing, most often by exceeding memory_limit, PHP frees that request's memory while some internal pointers still reference it. The next request handled by the same worker then inherits that stale state.
This gives an attacker two options. The first is remote code execution before any application code runs. The second is pulling leftover server memory back out Heartbleed-style, inside an ordinary PHPSESSID cookie, even on applications that never use sessions. The leak is the harder one to catch, because it leaves no shell and no file on disk.
Every common web setup is affected, including PHP-FPM, Apache mod_php, CGI, FrankenPHP and LiteSpeed, with mod_php the most exposed.
WHAT THIS MEANS FOR WEB3 Apps:
Contracts live onchain and PHP never touches them, but the page that asks your user to sign comes from a web server, and a lot of those run PHP. The WordPress or Laravel page serving your connect wallet button can be swapped for a drainer, and users lose funds while the contract behaves exactly as audited.
The exchange admin panel, the KYC portal and the payment gateway that quietly run PHP can get a stranger inside. Whatever those servers held in memory, including RPC keys, exchange API keys and session tokens, can leak.
Patching stops new leaks. Anything already read stays read.
Fixes are out in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older have no official release, only source backports. Exploit details are public and attack traffic has already been observed.
WHAT TO DO TONIGHT :
1. Upgrade PHP, then restart every worker and rebuild every container so the old code is actually gone.
2. Rotate every key that sat on a PHP server exposed before you patched.
3. Map which parts of your web stack actually run PHP, because most teams do not know.
4. If you cannot patch yet, disable session.upload_progress, cap memory at the pool level, and take the server off the internet.
5. Ignore any token or "exploit checker" riding the php2shell name.
If you are not sure where PHP sits in your stack, our DMs are open today and we are happy to help on an urgent basis.
sherlockvarm retweeted
🚨DEFCON 1🚨
In a few hours, a critical vulnerability that affects ~70% of web sites will be disclosed. It allows an attacker to upload and execute arbitrary code.
It's probably best if you stop browsing the internet for the rest of the week.
xitter.gq/ThePHPF/status/2112633…
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Readers added context they thought people might want to know
These are server-side PHP RCE vulnerabilities for which web hosts/admins should prepare to patch per official notice; general users face no direct need to stop browsing. PHP detected on ~69% of sites with known server-side language.
php.net/archive/2026.p…
w3techs.com/technologies/d…
cert.europa.eu/publications/s…
sansec.io/research/php2s…
arstechnica.com/security/2026/…
sherlockvarm retweeted
$50M+ lost in RWA perps in 2026. Zero smart contract bugs.
Ostium: $23.75M drained via a compromised price signer pushing future-dated reports.
AFX Trade: $24.15M via custody bridge keys. Trading engine untouched.
RWA perps let you trade Nvidia, gold, or Nasdaq with USDC 24/7.
The asset never touches the chain. Only the price does.
Whoever controls the price controls the vault.
Typical audits stop at the perp contract.
The real attack surface is the full pipeline:
data source → signer → keeper → vault → custody bridge.
I just joined the @Bevor_io waitlist — get early access and skip the queue: bevor.io/waitlist?ref=ACT7z9…
sherlockvarm retweeted
🔐 QuillAudits at DeFi Security Summit!
We’re excited to have @kalp_eth, @cryptanu and @turvec_dev representing QuillAudits at @summit_defi.
From invisible circuit exploits and quantum-safe blockchain security to Damn Vulnerable Daml, our auditors are bringing real-world security insights to the stage.
See you at DSS, Nov 1–2. 🛡️
#DSS #DeFiSecurity #QuillAudits
sherlockvarm retweeted
One table. Good company. Plenty to discuss.
Thank you to everyone who joined QuillAudits at The Institutional Table in Singapore, our private dinner on tokenization, stablecoins and institutional security.
No slides or pitch decks. Just room for conversation.
Let’s stay connected.
