Director of Engineering - Smart Contracts @maplefinance
~
Joined January 2018
- Tweets562
- Following1K
- Followers436
- Likes3.5K
Farhaan retweeted
Software is going to become less secure, month by month.
At a certain point, we will turn the corner, and new software will be more secure than any written in human history.
But crossing that chasm will suck.
Farhaan retweeted
look the foundational problem with ethereum protocol design is that most of the people designing the protocol don't actually use ethereum themselves. you can't fix the right things if you don't use your own fucking product. you don't have enough skin in the game if you don't personally depend on the system you're designing & stand to lose money when it breaks. i understand, everything looks great from an ivory tower lol. things look very different when you're actually on the ground dealing with the consequences. if you don't use ethereum yourself but still think you're qualified to design its protocol, you're playing god with a system you don't have to live with and whose consequences you don't have to suffer.
Farhaan retweeted
syrupUSDG, the fastest Maple product to reach $300M in TVL.
Fintechs are bringing the next wave of stablecoins onchain, and Maple is in prime position to power their yield.
syrupUSDG just surpassed $320M in AuM, making it the fastest @maplefinance product to cross the $300M milestone.
With ~5% in 30-day APY, it has already become a core allocation in the vault powering Robinhood Earn.
Institutional credit yield, denominated in a regulated stablecoin, distributed through a fintech app.
Onwards.
Farhaan retweeted
Maple is expanding into the Robinhood ecosystem, with syrupUSDG and syrupUSDC now live on Robinhood Chain.
Steakhouse approved Maple’s syrupUSDG as collateral for the vault used in Robinhood Earn, the first decentralized lending product available within the Robinhood app.
Now live on Ethereum and Robinhood Chain.
Farhaan retweeted
(1/7) Update from Maple
Maple has no active DeFi positions. We assessed risk exposure across DeFi and proactively removed all allocations. Through active risk management, Lenders have no exposure to rsETH or other indirect exposures, and the Maple platform operated as expected.
Excited to finally be a member 🧡
NEW MEMBER: @0xfarhaan
Leading the Smart Contracts team @maplefinance defining Onchain Asset Management. Designing and securing code holding over 4 Billion USD in value.
Off-duty: BBQs, F1, Macro Larp-ing
This is a must read for all developers building and securing smart contracts, great contribution to the space @0xasp_ !
Announcing the Solidity Testing Handbook ✨
Fully free, one-stop resource for Solidity developers and security researchers.
Resources are currently scattered across blogs, docs, and forums. I found it difficult to keep track of everything in one place.
This handbook aggregates all testing patterns from basic unit tests to advanced mutation tests into a single, well-organized guide for quick reference.
It’s built from my own learnings and best practices observed in popular codebases.
soliditytestingbook.com/
Farhaan retweeted
"Vibe coded contract gets hacked" sounds good for a headline
but as @moo9000 points out, the issue is easy for both humans and AI to miss without digging deeper
reminds me of the infamous Nomad PR that introduced the bug that got the bridge hacked
the PR lived at a higher level of abstraction, which makes the issue hard to catch in human or AI review (unless you’re explicitly hunting for it). it also lacked key integration context, just like the Nomad PR
this is a process failure, not an AI/human failure: missing checks like forked integration tests that query all oracles and verify on-chain state
designing the security process—deciding which checks and defenses each change or upgrade needs—is still a human job
AI is just a tool, and like human-written code it needs review in critical systems
use AI, but don’t assume it won’t make mistakes. build defenses that catch both human and AI error
"Claude wrote vulnerable code" raised my eyebrows because it doesn't feel right 🤨
So I investigated it with Claude and asked what is the wrong with this PR.
It indeed looks like an AI agent made a mistake here. However, the same mistake could have been made by a human.
The prompt: "Inspect this pull request and changes and check what oracle address is incorrect and why, causing the ETH rate to be wrong"
Claude also gives a good post-mortem analysis; see the screenshots.
Also this was not a code vulnerability error, but a configuration error, just to be accurate.
Regardless of whether the code is written by an AI or by a human, these kinds of errors are caught in an automated integration test suite. You can ask Claude to generate the test cases regardless of whether you write the code yourself or just autocomplete it. In this case, tests existed, but there was no test case for price sanity, not in the tests, not in the production itself (which I would also recommend: have DAO controlled safe price range).
As a human deployer, you will also perform manual checks when deploying changes like this, as part of the DAO process or similar.
Farhaan retweeted
Introducing EVMbench—a new benchmark that measures how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities. openai.com/index/introducing…
Farhaan retweeted
Expect this one to be good, top project payout means multiple audits and reviews and still had a critical
What are the implications? most projects need guard rails and design in a way to expect bugs to be present
current design is not fault tolerant on this space
Security researcher ily2 has just earned a staggering $3,000,000 from submitting a critical smart contract bug via Immunefi.
That's the largest single payout in web3 security in recent memory.
In total, he's submitted 3 reports. All 3 were paid. 100% accuracy.
His leaderboard update is coming soon, but you can pledge IMU to him now and earn when he finds the next one:
immunefi.com/pledge/ily2
Farhaan retweeted
My main takeaway from the recent rounding hacks is that every incorrect rounding needs to be considered a bug
Most of them are not exploitable, or not even vulnerabilities, but they are still bugs
Think of it as: bug → vulnerability → exploit. Every exploit starts from a vulnerability, and every vulnerability starts from a bug. Exploitability of rounding is often tricky because it depends on the system’s conditions, which will evolve
The relation between bugs and exploitability is more common in web2, but we don’t see it as often in web3
The nuance means that:
- If you develop a protocol, you need to be explicit about every rounding decision (cover all bugs)
- If you do a code review, you need to flag every incorrect rounding that can have a security impact (cover all vulnerabilities)
- If you do a bug bounty or contest, you need to focus on exploitable rounding (cover all exploits)
For code reviews: flagging every rounding doesn’t mean creating 100 issues; you can create one issue listing similar risks. But you do need to raise awareness of the risks
For bug bounties/contests: I wouldn’t be surprised to see future exploits that combine multiple rounding or other vulnerabilities (as we often see in web2). It’s something to keep in mind
Farhaan retweeted
syrupUSDT by @maplefinance is live on the Aave @plasma market.
The $150 million supply cap was reached in minutes.
Higher.
Farhaan retweeted
Pending governance approval, two @maplefinance assets (syrupUSDT and syrupUSDC) will soon be onboarded to Aave.
This introduces new institutional-grade collateral, backed by a consistent and trusted yield, to borrowers.
The next era of DeFi starts today.
@Aave and Maple are establishing a strategic partnership that brings institutional assets to the largest onchain lending market.
