Byte | yoursaudit

The best takeaway from Smart Contracts is that once a contract is fully known, you build on top of it. It will be the same for all other software. Immutable primitives that we will all audit, improve and share and then build on top.

If you're starting out today, I would not recommend web3 nor offensive cybersecurity. Not because there's no money to be made or a lack of work. There's plenty. But these are both highly skilled specialisations within the broader field of cybersecurity. Most who have success today have grinded for years on code with often a solid background in broader IT. F.e. myself: - 2 years DevOps - 3 years DevSecOps/Sec Engineer - 3 years Offensive Web3 If you're starting from zero, you're not competing for success. You're just day dreaming. What is possible and realistic is a basic role in Infra and/or blue team cyber. There's 100x the demand since every medium/large company needs security people. Even if it's only to configure MS AD. Cybersecurity is hot today. It's a great evergreen field. Endless opportunities and growth. But keep your feet on the ground. Make your goal what is achievable. Then move upward one step at the time.

🚨 Defimon detected another exploit on Avalanche. @fence_finance lost around $1M due to a logic bug in an unverified contract. Fence's Avalanche USDC pool runs several lending tranches inside one contract. In each tranche, lenders deposit and a borrower draws. On every call, the caller passes in the tranche's configuration (borrower/admin, hook contract, asset, parameters), and the pool checks it only against a stored hash. Creating a tranche only requires the caller to be the admin named in the configuration it supplies, so anyone can open a tranche and be its borrower. At 23:56 UTC on Oct 27, the attacker's contract flash-loaned 1,013,353.61 USDC from Aave V3 and opened tranche #1 with itself as admin and hook, so every hook check returned true. As lender, it deposited the loan. As admin, it scheduled a 1,013,353.61 USDC principal repayment, due at 00:00 UTC Oct 28. As borrower, it drew the whole deposit back out and repaid Aave, paying about $507 in fees. The amount matched tranche #0's idle cash exactly: its lenders had deposited 3M and its borrower had drawn 1.986M. At 00:00:03 UTC the attacker drew again. Because the day had rolled over, the pool found the repayment due that day and booked the 1.013M as repaid, taking it off the tranche's outstanding debt, even though the attacker never paid anything back. The draw function caps borrowing at deposits minus outstanding debt. It ignores principal that fell due unpaid, which the lender-withdrawal check does subtract, so the full 1.013M borrow limit reopened. Every tranche is paid from one shared balance, so the pool sent the attacker the 1.013M belonging to tranche #0's lenders and was left empty. Setup TX: snowtrace.io/tx/0x19ab145e7f… Exploit TX: snowtrace.io/tx/0x3f6b23292a… Attacker: snowtrace.io/address/0x6ff1c… Victim: snowtrace.io/address/0xe25cb… Subscribe for real-time alerts at defimon.xyz

Formal Verification is going to be so hot in April 2027

The most brutal reality of bug bounties is that you may do everything right and still fail. You need to be able to know how well you’re doing even when you don’t get the results you want.

DeepSeek Harness cybersecurity red-team tool (dsh-purge) Work:

learning how to build secure, access-controlled, and governed agentic systems is going to be extremely important over the next decade if you're in cybersecurity learning about AI is crucial, its no longer a choice