Secured $200M+ TVL auditing DeFi contracts. Lead dev at @LivoPad. Slow is good.
Joined September 2014
- Tweets961
- Following274
- Followers465
- Likes4.2K
Pinned Tweet
Apparently, the @spillways10 staking contract was hacked, and funds have been draining for the last 200 days. I was approached by a stakeholder to investigate the hack and I happily agreed. A thread:
Simple but effective flow for reviewing code with claude models:
- Opus: /review
- Fable: validate the list of issues. Drop what is not real, fix what is trivial, and report back only what is important but not trivial to fix
Only spend your brainpower on the tricky ones
You can reference other claude code sessions by name, and let them communicate
- use "/rename" to rename a session into "cool-feature"
- tell another session to wait for "cool-feature" session to wait before taking action
Quite useful for queuing work between repos
Before writing an eval, ask the model: "what does this code assume that nothing checks?" Write the eval against the answer.
An eval testing the wrong assumption is worse than no eval. It passes, and you stop looking.
When was the last time you went through the excruciating pain of writing down ideas on paper without the help of an LLM?
AI tools allow you to build anything you want, and that can be a problem, because you may be focusing your efforts on the wrong thing. We'd be better off skipping a task or a requirement rather than tell AI to build it for us, cos then we have to review and maintain it
The number nobody publishes: minutes spent patching the output. Every CLI comparison is quota burned and prompts spent. I asked someone who'd just switched which tool costs him less review time. The answer was "depends how much you care about quality." 😅
Opus invents expressions. I set the output style to concise to fix it and it started inventing shorter ones. It picks the exact right vector in latent space to represent the concept. It is just not English 🤣
Who would have thought that despite auditors losing their jobs to AI, the most important skill in the new AI world would be precisely "auditing" 😅
Anyone who trusts AI blindly will be outperformed by those able to distrust and critique it
One year ago "how-to" was a valuable skill.
Now with Claude code, "how-to" is cheap and has barely any value.
Now, "what-to" is the important skill.
Jacopod retweeted
Crypto Drainers using React CVE-2025-55182
We are observing a big uptick in drainers uploaded to legitimate (crypto) websites through exploitation of the recent React CVE.
All websites should review front-end code for any suspicious assets NOW.
So well deserved
Crossed $150M TVL today🎉
Honestly so proud of what our team has built at @origami_fi over the past year
>$108M TVL in hOHM (attracting almost 1/3rd of the gOHM supply!)
>$15M+ in oriBGT (50% of all staked iBGT!)
>$13M in incredibly well-loved @InfraredFinance LP auto-compounders and auto-stakers
>The #1 place for $SKY staking and the best risk-adjusted $USDS yields
>Most hyped Boyco vault attracting $69M USDC
Crazy to think the next 12mos may just be even bigger and better
The paper has been creased
Still early🌱
Here is one of the latest audits I've done, for @iMacroMillions.
The most interesting issue is [C1]. Not because it is critical, but because it is a small edge case magnified to the point of breaking the entire protocol. The team response was great, and they fixed all essential issues.
github.com/JacoboLansac/audi…
See my complete audit portfolio: github.com/JacoboLansac/audi…
Legendary stats of a legendary engineer. Looking forward to seeing what you do next
Jacopod retweeted
Audits are really expensive, but you already knew that?
Yet you still do nothing to minimize the cost of your audits...
You're throwing money at the problem and hoping it'll magically solve everything...
A lot of elite teams do a simple trick that saves them thousands and it's called "internal reviews".
This is when the developers audit their code. This is not them casually looking around for anything interesting during development - this is a dedicated, structured process they schedule.
Here is how they do it:
Before the actual audit set a reasonable time frame (50% of what the auditors quote you for as the devs already know the code).
During that time only review the code, don't add new logic, don't add new mechanics, only focus on security and reducing complexity/unnecessary code.
This might seem trivial, but will actually save you a ton, especially if your code is littered with bugs.
Here are the benefits:
1. Your reports will look better, as they will have fewer bugs
2. You will catch most simple bugs allowing auditors to focus on the more complex parts
3. Audits will be faster as there will be fewer fixes, allowing you to launch sooner
4. You may only need 1 audit, whereas without this prep you might need multiple
I wish I had known this audit hack earlier:
Type `ctrl + shift + <` in VScode to jump between function declarations. It also tells you if it is a view/internal/public/pure function with a small icon.
Note: it requires the Solidity Visual Developer extension by @ConsensysAudits, which is a must anyway.
Every single article I've read from @RareSkills_io was a good investment of my time. Truly impressive and inspiring. Very rarely we see such high quality/quantity ratio. Very Rare.
The next Uniswap V3 article that comes out is going to blow peoples’ minds.
This isn’t just because the animations are cool, but because what would normally be scary math feels extremely digestible.
This is one thing that makes RareSkills incredible as a publishing company.
We don’t just re-hash existing documentation or tutorials and make them slightly more oriented towards a certain audience.
We re-work the underlying concepts from first principles and discover the best concept-map representation of the subject, then turn it into an article.
When existing derivations aren’t good enough, we don’t make them better. We scrap them and re-derive them ourselves.