Admin keys are an existential risk disguised as convenience. If one EOA can pause, upgrade, or drain a protocol, the "decentralized" app has a single point of failure. Thread ↓

Happy 10th birthday, @ethereum! Stay safe.

We have lift off for @Solana's first universal liquid staking account. No more idle tokens. Only energized assets. @wattprotocol is live:

Learning security after the first audit is like learning to swim after jumping in the ocean. The best developers build security intuition alongside their coding skills, not after deploying to mainnet when real funds are at stake.

How did attackers drain $42M from @GMX_IO? Through cross-contract reentrancy that bypassed every safety check. We reproduced the attack using @WakeFramework. Let's break it down ↓

Safe v1.5.0 is here 🟢 @V_Seehausen (DevRel at SafeLabs) and @NLordello (Lead Research Engineer, Safe Research) break down the key features: ✅ Module Guards - Enhanced security for module transactions ✅ Extensible Fallback Handler - Better composability ✅ @zkSync native support - Consistent addresses across networks ✅ Improved developer experience and MORE WATCH 👇

Ackee has recently completed the second audit of @vfat_io and the report is now public. All issues have been either fixed or acknowledged. Read the report details below ↓

Last week, southern Italy got serious about smart contract security. At @NapulETH, our auditor Dmytro presented Wake – our Python framework for smart contract testing, debugging, and vulnerability detection.

Web3 protocol complexity has accelerated exponentially, creating attack surfaces that scale non-linearly with system complexity. Traditional vulnerabilities now compound with cross-chain bridge exploits, account abstraction bypasses, and ZK proof manipulation.

Most crypto projects approach security backwards: they build first, secure second. Let's dive into what and why every project should implement BEFORE getting an audit, using a security pyramid analogy.