Half of auditing is reading code. The other half is reading assumptions.

You’re not competing with everyone. You’re competing with the ones who don’t quit when it gets hard. That’s a much smaller group.

You’re not hunting bugs. You’re interrogating assumptions.

Every ‘should never happen’ path is just an exploit with better branding.

It’s not about breaking the contract. It’s about understanding what already breaks it.

Top 5 Code4rena. Didn’t hit what I aimed for. Still in the game. On to the next.

Every “should be fine” in your head is a critical waiting for the wrong input.

First time at Immunefi. It’s not much, but it’s honest work.

The contract didn’t break. It just finally ran the path no one reviewed.

A good audit doesn’t only find what’s broken. It finds what was never understood.

If it relies on humans doing the right thing, it’s already wrong.

The risk isn’t in what’s written. It’s in what was assumed.

You don’t audit for what the code does. You audit for what it lets happen.

Every protocol has a happy path. Exploits live outside of it.

You’re not competing with everyone. You’re competing with the ones who don’t disappear after a few losses.

Every “should never happen” in your code is a quiet invitation to someone who’ll make it happen.

You don’t audit code to prove it works. You audit it to prove it won’t break. And those are not the same thing.

“That branch should never execute.” – reality: it executed, with $3M on the line

Hot takes that I think shouldn’t be hot, and should be “the default” 1. The contest platform is ultimately responsible for the payout. It is the contest platform that promises payout, so if a platform doesn’t pay out, no matter the drama, it is the platform’s fault. 2. The

The premier launchpad on Sei is now live. Glad to have consulted Symphony Exchange on safe & efficient smart contract architecture. Great to see it live - time to compose your token. 🫡