Jay (@movebrah) header
Jay (@movebrah) profile picture

Move SR @spearbit | Ambassador @Walrusprotocol

Joined October 2023
Photo by Jay (@movebrah)Photo by Jay (@movebrah)Photo by Jay (@movebrah)Photo by Jay (@movebrah)Photo by Jay (@movebrah)Photo by Jay (@movebrah)Photo by Jay (@movebrah)Photo by Jay (@movebrah)Photo by Jay (@movebrah)Photo by Jay (@movebrah)
I am leaving Mysten Labs and joining Anthropic to work on defensive security research.
418
131
266
2,108
852,427
📢 Big news from @suidevelopers and @SuiNetwork! A new bounty target is live: Bella Ciao — next-generation Sui VM execution layer rewrite with enhanced performance and new Move capabilities — offers a wide range of bounties: Critical: $100,000 - $1,000,000 High: $10,000 - $50,000 Medium: $5,000 - $10,000 Low: $2,500 - $5,000 Start the #bugbounty hunt right now: hackenproof.com/programs/sui…
8
86
3,956
Jay retweeted
We are so back! Mark your calendars: Sui Basecamp 2026 📅 October 7-8 🇸🇬 Singapore ( @token2049 )
127
150
64
899
96,521
My 2025 Web3 Security Wrapped > Joined @spearbit as a Move SR > Audited Aave’s + LayerZero’s Move integration w/ some of the most goated auditors > Grew my formal verification skills in Move > Worked with some of the most respected web3 sec firms > Fully booked every month of the year > Began doing Rust audits > >90% of audits this year were in Move > Consistently hit high-5figs every month in Q4 > Was able to fund a trip for my friends to Bali + got a private client there > Earned more this year than I ever thought possible > Met and made friends with some of the best people in this industry Goals for 2026 > Tapping into fuzzing in Move > Double the amount of protocols I secure > Build out AI FV tool > Work with more protocols + firms > Contribute more to Move security knowledge > Work with more firms + new SRs I’m just incredibly proud of the work I put in this year. It was hard to close myself off to a single new and niche language for 2 years with no results but it’s paid off immensely this year. Only tip I have to offer: Study foresight and study conviction. See you all in 2026 🫡
10
2
120
3,840
In Bhutan’s remote valleys, our team tested how blockchain can function when the internet disappears. We explored offline signing, physical data movement, and onchain verification using Sui. Read the full story 👇 blog.sui.io/real-world-block…
38
111
20
636
59,480
⚠️ The full technical postmortem for the USPD exploit is now live. The root cause was not contract logic, but deployment atomicity. Our forensic analysis indicates this is an industrial-scale operation: we identified ~200 other proxies on mainnet infected by the same infrastructure. 👉 Read it here: uspd.io/blog/anatomy-of-a-ha… We deployed the proxy in one transaction and initialized it in another. In that brief window, an attacker installed a "shim" that forwarded calls to our legitimate code while retaining admin control. This allowed the protocol to function normally for 3 months, passing verification checks, until we attempted a routine upgrade. We break down the specific architectural decisions—specifically regarding deterministic addresses—that created the window for the CPIMP attack. Full analysis and data in the article. 👇 V2 architecture is already in motion, moving to strictly atomic deployments to eliminate this vector entirely. Simplified modular architecture, DeFi-compatible yield design, and more. We will share further details as we progress. Next steps: Recovery Tokens and closed group affected holders, protocol adjustments and re-launch preparation. 🤝 Special thanks to @SEAL_911 for their immediate assistance in helping us navigate the aftermath.
2
8
5
20
5,821
Things Everyone Gets Wrong About Move Move’s safety ≠ immunity from logic bugs. Move was built to stop structural failure. Every resource is linear. Every reference is tracked. Every move must resolve by the end of a function. That’s why you can’t double-spend, drop state, or reenter. The VM enforces it before code ever runs. But none of that says your logic is correct. You can mint twice without breaking linearity. You can bypass an access check without violating borrow rules. You can drain a pool while staying perfectly type-safe. The verifier’s job is to protect the machine, not the protocol. It guarantees the bytecode won’t corrupt global state, not that your math balances, or your supply stays constant. Even formal verification doesn’t fix that automatically. The Prover only checks what you write: > ensures > requires > invariant If you never describe system behavior in specs, it never questions it. Move gives you memory safety, type safety, and predictable state. But correctness is still human. The language keeps the chain safe. It’s your job to keep the protocol safe.
2
7
2
32
3,346
While it was fun while it lasted, reentrancy is now possible in Move. Aptos Move v2.2 now supports function values as first class functions which enables dynamic dispatch. It’s not possible across the board though. Dispatchable fungible assets remain protected. And Aptos Move has implemented two ways to control it: > A built-in reentrancy check that locks a module’s own resources during reentry. > #[module_lock] for fully blocking any reentry along the call path Read more about it here: aptos.dev/build/smart-contra…
8
10
2
54
6,468
Earning a Living as SR: T1 Employee (100k-$300k) or Independent Contractor (0-$500k+)? When you read CT it feels like everyone here is either making $100k on a slow month or is doing a boot-camp to be a plumber. I'd like to sketch a more realistic picture based on my own situation and my industry knowledge. Specifically the difference between being an employee of a top firm or going the independent contractor route (NOTE: you do need to be in the 1% for this to even apply). Independent Contractor: - Charge $5k-$20k a week - Beholding to No One - If you're in the 0,0001%, you print money Sounds awesome and there quite a few people going this route. Charging $10k/w is HALF a Million a year, which is life-changing money. But there are few caveats: - Asking $10k/w != Getting $10k/w - Being booked for 1w =! being booked for 52w It is very volatile and your earning capacity is strongly dependent on your niche and it's current popularity. If you're the first expert on a domain and it's hype season, you will be making bank (f.e. @movebrah). But if hype is gone and/or there many more people with the same niche expertise, you will be struggling. I know multiple people who were making insane money at the beginning of the year (50-75k/m) only to get zero work for multiple months, often forced to lower their rates substantially or join a company. Still, if you are one of the absolute best, it is a road to riches. Employee: - Stable Income (soft-cap 300k for audit firms) - Security and Benefits - You do have a Boss This is my route and I am honestly biased towards it. The main downside is naturally that your income is fixed and you won't reach those insane amounts. But at the same time there are many benefits (paid vacation) and having a company that backs you is important in our stressful occupation. Some examples: - Back from Londen trip with food poisoning & lung infection, in bed for an entire week (fu UK 💀) => "np we got you, rest up" - I want to go to a conference on vacation => "np, here's a conference budget" - I want to do a bootcamp => "np, off course we invest in your education" - Can I..... => "np, we got u" It's awesome to be part of such an organisation and from a skill development standpoint I honestly can't think of a better environment. It's still great money and riches will come in due time. So there you have it, two routes which are both honestly great. Personally I'm happy with the second but I'm also older with 3 children so my risk tolerance is quite a bit lower. P.S. Yes there are individual exceptions, like Ronaldo is an exception compared to champion league footballers. So unless you're him, exceptions don't apply.
Replying to @0xFlint_ @0xriptide
mmm how much of that is just the tradeoff between stable job rates vs one-off auditing rates?
13
3
1
103
8,940
guys can you stop posting your shitty takes on the balancer hack, none of you knew about it before it happened, and 99% of you aren't based enough to actually write a proper post-mortem, you all sound like complete idiots
7
2
62
4,037
YouTube is BANNING CRYPTO & NFTs starting November 17 But not fully. Youtube just changed its rules, and it’s going to DIRECTLY impact blockchain, NFT, and web3 gaming content across Youtube and Google YouTube now classifies “online gambling with digital goods that have monetary value” under its gambling policy : "This includes NFTs, tokens, skins, and in-game items that can be bought, sold, or traded for any monetary value or real money If your video depicts, promotes, or facilitates gameplay where players can win, lose, stake, or wager assets with real-world value, it’s now considered gambling content, expect takedowns, strikes, or age restrictions" They’re also tightening rules on social casino content, casino-style games like slots or roulette or any other gambling content will now be age-restricted, EVEN IF no real money is used This policy goes further though - Tutorials showing mints, wallet connections, or token purchases tied to assets with monetary value might get flagged - Sponsored content promoting token-based gameplay, drops, or marketplaces could violate ad and gambling rules So even if you’re not running a gambling site, your web3 integrations can trigger the same penalties; age restriction, removal and strikes In short ✅Gameplay = mostly safe ⚠️Anything that looks like staking, earning, or cashing out = high risk 💀Sponsored NFT/token videos = likely restricted or removed Tag a creator who should know about this ASAP
125
57
51
338
96,337
what’s going on in web3 security twitter? new format where we break down recent tweets from researchers. this one covers tweets from @0xriptide, @hrkrshnn, and @movebrah. full vid below:
3
1
2
27
3,279
We are now publishing our full post-mortem report on the October 15 TLP exploit. The report details the incident timeline, root cause analysis, an impact assessment of approx. $3.44M USD, and our response plan. We confirm that funds in our SAFU and DeFi Options Vaults were unaffected. We are committed to full transparency as we work to resolve this. Read the full report here: medium.com/@TypusFinance/typ…
14
18
14
97
62,833
Doing my first Solidity audit in months. Forgot how versatile Solidity is. 1 hr into the audit: this protocol is so dynamic! You couldn't build this in Move 1 crit 2 highs 4 meds later: jfc it's so dynamic, i'm fighting anyone who builds this in Move ngl I missed Solidity 😂
3
2
87
4,095
3 things I did to up my audit game Tbh, I was filled with a lot of self doubt when I started. Every line looked like gibberish, and I kept thinking I wasn’t good enough. But I stuck with it. 1. I understood the language Once I really got the language behind the contracts, everything started clicking. The logic made sense, and I could actually see what the devs were thinking. 2.I stopped “auditing” and started reading the code. Just sitting with it, seeing how things connect, i spent time soaking in the code. Understanding flow, structure, and intent made my findings way sharper. 3.I read audit papers from @movebrah, @MoveBit_, and @AsymptoticTech Seeing how the pros break things down changed everything. I learned how to spot patterns, structure reports, and think deeper. It’s crazy how much changes when you slow down and focus on understanding instead of proving something.
6
8
53
2,868
🚨NPM packages are compromised with malware Your dependencies could be infected right now without you knowing it. Check and scan your repo against 8200+ vulnerable dependencies containing malware from the recent and prior hacks. Scan your project repo in ~3 seconds : github.com/ValkyriSecurity/n… Protect your code. Share to help fellow devs!
8
87
8
394
46,058
Party Objects in Sui Move 🎉 Sui just introduced party objects: a new ownership model that addresses some limitations in how we handle objects. The Problem Today If you’ve worked with Sui ownership types, you know the constraints: - AddressOwner → single account, manually versioned, fast but rigid - ObjectOwner → delegated, but can’t be used as input - Shared → automatically versioned, but permanently global once shared - Immutable → fixed read-only state These options meant that “owner” conflated too many properties: authorization, versioning, and dissemination were bundled together. What Party Objects Change Party objects separate these concerns. They are single-owner for now, versioned automatically by consensus, and flexible enough to transfer between ownership types. They also avoid equivocation issues that could lock capability objects or non-gas coins for an entire epoch, and they don’t require object versions when used as transaction inputs. You can create them with the following functions in sui::transfer: - party_transfer → when you need a custom transfer policy - public_party_transfer → if the object has the store capability Ownership Lifecycle Party objects can: - Be added as dynamic fields - Transfer between ownership types - Become immutable Critical exception: once created, a party object cannot later be shared. As devs begin implementing this feature, I’ll be keeping my eye out for this in audits, since mishandling this rule is a potential vector for access control bugs. Why this matters Party objects decouple versioning from sharing, which is something Sui has needed for a while. They let you get consensus backed versioning without exposing objects globally. For capability objects, this gives us a cleaner, safer way to manage ownership going forward. For now, it's party of one. Live on mainnet today: docs.sui.io/concepts/object-…
2
6
1
35
2,671
You don't need to spend as much $ securing your protocol if security is built into the language itself. Sui Move is an excellent example of how to build security into the lang natively This post demonstrates how Move categorically eliminates an entire class of flashloan bugs
Historically, developers bore the burden of ensuring the security of flash loan repayment through runtime checks. We explored how Sui Move rethinks flash loan security with compiler-level guarantees.
2
12
4,346