Find all bugs. Make no mistakes. AI security for the future of finance on Solana.
Joined February 2026
- Tweets96
- Following83
- Followers455
- Likes295
hackhack retweeted
our smart contracts passed the audit.
@hackhackai @SuperteamGEO
BP26-VIBHU now works on hackhack.
20% off an audit credit until Breakpoint, to celebrate our @colosseum hackathon submission.
Thanks for the marketing, @vibhu.
hackhack retweeted
if you're a @solana project stressing about audits, consider using @hackhackai
built by @r0bre and @HenronEldini, they bring autonomous pre audits & full audits together -- with the cost of your pre audit credited toward the full @accretion_xyz audit
what this means is that it gets you most of the way there before the full audit starts -- so less time wasted, and a full audit that can go deeper -- saving you time, money & energy
huack huack
We're pushing over 90% recall on higher severity issues on most audits now. We get close to 100% on very small codebases, while big, complex codebases mostly benefit from our speed, rather than full coverage. There are still issues that AI misses and this was one of them. Was.
Last year, we found a critical bug during @lightprotocol's Anchor-to-Pinocchio upgrade. While backtesting AI auditors, they kept missing this specific issue. But why?
hackhack retweeted
Last year, we found a critical bug during @lightprotocol's Anchor-to-Pinocchio upgrade. While backtesting AI auditors, they kept missing this specific issue. But why?
hackhack retweeted
Tbilisi, let’s talk Solana security.
Cohosts: @hackhackai + @accretion_xyz
Join us this Thursday ↓
we're hosing an event in Tbilisi, Georgia, Thursday this week together with @hackhackai and @SuperteamGEO
Come by if you're interested in Solana security, AI security, audits, Solana in general, or just want to meet up!
Sign up on Luma: luma.com/d4jnttiq
hackhack retweeted
we're hosing an event in Tbilisi, Georgia, Thursday this week together with @hackhackai and @SuperteamGEO
Come by if you're interested in Solana security, AI security, audits, Solana in general, or just want to meet up!
Sign up on Luma: luma.com/d4jnttiq
hackhack retweeted
🚨 @hackhackai by @r0bre and @accretion_xyz was added to pashov/ai-web3-security.
Solana bug finders list is growing📈
We are at almost 90 ai-web3-security tools now, people are workmaxxxing🫡
github.com/pashov/ai-web3-se…
hackhack retweeted
AI audits will be more common as the machine doesn't have the limited time and focus humans have. Its like an intern that can spot, chain and reproduce known patterns ran in a infinite simulation
@hackhackai is doing awesome stuff. make no mistakes
We ran four full AI audits of our tranching vaults protocol with @hackhackai — ~31K lines of Rust code.
It changed our view of what a serious smart-contract review can look like. Full write-up:
hackhack retweeted
AI audits is an incredible tool all protocols should embrace.
Thank you for the amazing work @hackhackai!
We ran four full AI audits of our tranching vaults protocol with @hackhackai — ~31K lines of Rust code.
It changed our view of what a serious smart-contract review can look like. Full write-up:
Kormos has been an early customer for @hackhackai and we're really proud that we could deliver such value to them.
We've found that our AI tool can be really strong for large codebases like this where 30k lines of code simply overwhelm a human auditor and would require weeks of deep work to start surfacing issues.
While we don't claim that our AI tool is better than a human auditor with weeks or months of time to real all this code and find all the bugs, the big advantage is that we can start delivering real bugs within hours.
This means that the team can go to start fixing issues within days instead of weeks or months, and while a human auditor is still reading v1 of the code, we can do another AI run on v2, v3 and v4, making the codebase better step by step!
We ran four full AI audits of our tranching vaults protocol with @hackhackai — ~31K lines of Rust code.
It changed our view of what a serious smart-contract review can look like. Full write-up:
A few weeks ago, our autoresearch agent flagged an issue in SIMD-0376, a @Solana proposal that had been approved and was being implemented, but wasn’t active on mainnet yet.
The SIMD changes how validators verify Ed25519 transaction signatures. The goal is good: adopt the ZIP-215 rules used by Zcash’s ed25519-zebra verifier, making it possible to batch signature checks and verify transactions faster.
Our agent found a dangerous edge case. Under the proposed rules, a 64-byte all-zero signature would be accepted for any message when paired with the all-zero public key.
On Solana, the all-zero key has special meaning. It is displayed as 11111111111111111111111111111111, the System Program ID, and is also commonly used as a sentinel value for “no authority,” “immutable,” or “uninitialized.”
Programs often therefore set an authority to zero with the assumption that nobody can ever sign for it. If SIMD-0376 had been activated unchanged, that assumption would no longer hold.
Metaplex gave us a concrete example. We found 433 mutable metadata accounts whose update authority was set to the zero key. The proposed verifier could have made those disabled authorities signable again. We reported the issue to Anza before activation. A fix has been prepared, and the SIMD is being amended to reject these weak keys while keeping the performance benefits.
Full writeup: hackhack.ai/autoresearch/sim…
