Proof of Audits is a Web3 audit contest platform, and we turn static audit reports into live, verifiable Trust Passport. Join the Discord below
Joined June 2026
- Tweets270
- Following1
- Followers15
- Likes15
Was the oracle wrong—and who pays?
I built POA for #neatHack (Team POA): Claude checks a real Aave/Base liquidation and 6 price scenarios. No proven oracle fault? No payout recommended.
🎥 Demo attached
Repo: github.com/Proofofaudit/poa-…
@neatlogs @EntireHQ @arithecfo
I kept thinking about one thing while designing our audit model:
Imagine spending 10+ hours seriously reviewing code…
and earning $0 because you didn’t find the winning bug.
That never sat right with me.
So we added a base fee for auditors.
Find something serious? You should earn much more.
But good human review shouldn’t start at zero.
Curious if security researchers agree with this.
Around this time last year, I turned down a job offer.
Didn't have some perfect plan after that.
I just wanted to give security research a real shot.
Spent months finding bugs, doing contests, learning a lot and meeting some really good people in security.
A lot changed during that time. So did what I wanted to work on.
Eventually I started building something around a problem I kept thinking about.
That slowly turned into a company.
Still figuring it out.
But it's weird looking back at that job offer now.
At the time, I had no clue where saying no to it would take me.
YC apps are open and I have more ideas than I can build
so steal this one:
FIREEXIT
before depositing $10k into DeFi, actually simulate:
liquidity disappearing
oracle failing
protocol pausing
frontend dying
then tell me:
$10,000 deposited
$7,840 recoverable
$2,160 trapped
and give me the emergency exit txs before I ever deposit.
basically:
prove I can get out before I get in.
if you’d seriously build this with me, reply YES.
I’ll DM you.
or steal it and beat me to YC 😂
I was about to post something today and got told:
don’t post on Sunday
don’t post on Monday
don’t post on Tuesday
and now I’m curious how much of this x advice is actual data
and how much is just people repeating what someone else said 😭
it’s Sunday.
posting anyway.
if this dies, fair enough 😂
if it doesn’t… I have questions.
Building a startup is basically:
“this might actually work”
24 hours later:
“this is the worst idea I’ve ever had” 😂
I’m learning not to judge the company by one good day or one bad day.
Better question:
Did I learn something today that changes what I do tomorrow?
The weirdest thing about Web3 security:
A protocol gets audited.
Then the code changes.
Everyone still says:
“Yep, audited ”
But… audited what?
The old code or what users are actually interacting with today?
This gap is becoming one of my biggest obsessions while building Proof of Audits.
74 days is the crazy part.
users saw one asset.
underneath it, part of the backing depended on nBTC.
then unbacked nBTC got minted and apparently sat there unnoticed for 74 days.
the frontend can look totally normal while the actual risk is 3 layers underneath it.
that’s the part of Web3 security users almost never get to see.
Before I put money into a protocol, I can usually find this in seconds:
APY.
TVL.
“Audited.”
But finding out who can actually change the protocol?
That’s harder.
Who can upgrade it?
Pause it?
Change the oracle?
Move funds?
And if that access changed yesterday, would I even know?
That feels backwards.
We show users yield instantly.
But the people and keys with power over the protocol are still something they have to investigate themselves.
Why do we only ask “who had access?” after something goes wrong?
Okay… we actually built it 😂
Been building our version of a Web3 security contest for 2026 for a while now.
And ngl… I’m pretty happy with where it landed.
You don’t just throw 100 auditors at the same code and hope for the best.
You get coverage to own.
Good work actually follows your name.
And when the contest ends, the review doesn’t just become history.
So… auditors 👀
Would you actually join a contest run like this?
And yes, I kept scrolling 👀 @PUSH0audits @0xh2134 @windhustler @tom_eth_dev @kalyan__tr @S3v3ru5_ @0xdmanwalking @soligxbt
Last summons before I start sending contracts 😂 @0xBretzel @Aasif1552 @CMierez_ @Alicrali333 @panprog @hope_silver @0xArzzz
🧠 DAY 1 LESSON
I don’t need to explain our features better.
I need to explain what they actually do for the protocol.
Instead of saying:
→ 4× coverage
→ Audit Passport
→ Function-level attribution
→ Auditor reputation
→ Live-code verification
I need to say:
→ Which user funds are still exposed
→ Where audit money may have left gaps
→ Whether today’s live code is actually covered
→ What changed after the last audit
→ What needs reviewing before it becomes an expensive problem
Founders don’t care about the feature name.
They care about:
Keeping user money safe.
Avoiding another unnecessary full audit.
Protecting their treasury, users, and reputation.
That’s the pitch.
🎯 WHY WE'RE BUILDING THIS
I'm not trying to build another audit company.
I want to make it really damn hard for unaudited code to quietly reach user funds.
Tomorrow we go again.
Day 1/∞.
#BuildInPublic #Web3Security #DeFiSecurity
📨 THEN SALES HUMBLED ME 😂
Protocols contacted:
19
Replies:
1
The other 18 audited my ego for free.
No findings.
Just silence.
But those 18 non-replies taught me something important.
I was pitching:
→ 4× coverage
→ Audit Passport
→ Function-level attribution
→ Auditor reputation
→ Live-code verification
Cool features.
Wrong opening.
Because nobody wakes up thinking:
"Damn, I really need function-level auditor attribution today."
A founder has a much simpler question:
“I already paid for audits. What am I STILL exposed to?”
That is the question POA needs to answer first.
🐛 THEN WE FOUND SOMETHING
We went deeper into uncovered code from one protocol.
Found:
🚨 1 High
🟡 2 Lows
Keeping the protocol unnamed while disclosure is handled.
This was probably the biggest validation of Day 1.
The protocol already had security history.
But there was still live code outside the audit coverage we could actually prove.
Having audits ≠ every line running today was audited.
DAY #1 OF BUILDING PROOF OF AUDITS IN PUBLIC 🫡
Until DeFi attackers start protesting to get us shut down.
Today:
🔎 3 protocol gap reviews
📨 19 cold DMs
👋 1 reply
🐛 1 High + 2 Lows found
Not a bad first day.