Wolf retweeted
April 2026 was the worst month ever for DeFi exploits. ~$635M lost in total. 28 incidents in 30 days.
Apr 1 → Drift → $285M
Apr 3 → Silo V2 → $392K
Apr 4 → TMM → $1.67M
Apr 5 → Denaria Finance → $165K
Apr 9 → Aethir → $423K
Apr 12 → Hyperbridge → $2.5M
Apr 12 → SubQuery → $60K
Apr 13 → Dango → $410K
Apr 13 → Mona → $61K
Apr 14 → Zerion → $100K
Apr 16 → Rhea Finance → $18.4M
Apr 16 → Grinex → $15M
Apr 18 → Kelp DAO → $293M
Apr 20 → Juicebox V3 → $52K
Apr 20 → Thetanuts Finance → $50K
Apr 21 → Volo Protocol → $3.5M
Apr 22 → Kipseli → $80K
Apr 23 → Giddy Finance → $1.3M
Apr 25 → PurrLend → $1.5M
Apr 26 → Scallop → $150K
Apr 27 → Singularity Finance → $413K
Apr 27 → ZetaChain → $300K
Apr 28 → JuDAO → $228K
Apr 28 → Quant → $138K
Apr 29 → Aftermath Perps → $1.14M
Apr 29 → Sweat Foundation → $3.5M
Apr 29 → Syndicate → $330K
Apr 30 → Wasabi Protocol → $5M+
Two attacks (Drift + Kelp DAO) account for ~95% of the total. Both linked to admin-key compromises with no timelock or multisig.
DeFi security is broken at the infrastructure layer. Bridges, deployer keys, and cross-chain messaging keep producing the largest single-incident losses.
Stay safe. Revoke approvals. DYOR.
Wolf retweeted
Security researchers, a new one just dropped. The @revertfinance x Cantina security competition is now live.
With $50,000 on the line, you'll be reviewing the pricing engine built for stableswap pools on top of Uniswap v4.
Start here: cantina.xyz/competitions/e55…
Wolf retweeted
We're excited to welcome @recursiveAudit as our newest Cantina Apprentice! A passionate security researcher with an unwavering commitment to excellence.
Let's dive into his story.
Wolf retweeted
💎 What is the Digital Asset (DA) Standard on Aptos?
Aptos redefines NFTs with Digital Assets, where every NFT/token is an Object with its own unique address.
Let’s break it down! 🧵👇
🔹 1. Why is Aptos DA different?
Unlike traditional NFTs, Aptos Digital Assets are not just tokens—they are on-chain objects with their own unique addresses. This brings:
✅ More efficient storage (no account clutter).
✅ True ownership & portability (each NFT is an independent entity).
✅ Customizability (update metadata, add new traits, and mutate NFTs).
Aptos NFTs are smart, adaptable, and built for the future. 🚀
🏗 2. How are Digital Assets created?
Aptos NFTs follow a structured approach with two main objects:
🔹 Collection → A group of NFTs with metadata (collection.move module).
🔹 Token → The actual NFT, which belongs to a collection and stores its own attributes (token.move module).
Each NFT must be part of a Collection, but the Collection does not own the NFT—creators or users do.
📌 3. Collections: Fixed vs. Unlimited
NFTs are grouped into Collections, which can be either:
1️⃣ Fixed Supply → A limited number of NFTs can be minted.
2️⃣ Unlimited Supply → No cap on minting; creators can add more anytime.
Each collection contains metadata like name, creator, and URI.
🎨 4. How is NFT metadata stored?
Each Aptos NFT stores its properties in a Property Map (property_map.move module), which includes:
🔹 Attribute names (like "rarity" or "power level").
🔹 Data types (string, number, boolean, etc.).
🔹 Values (e.g., "Legendary", 100, true).
This enables dynamic, customizable NFTs with rich metadata.
🚀 5. NFT Actions: Transfer, Burn, Mutate
✅ Transfer → Move NFTs seamlessly between wallets.
✅ Burn/Delete → Permanently remove NFTs from circulation.
✅ Modify Metadata → Update an NFT’s image, description, or attributes after minting.
💰 6. Royalties: How Creators Get Paid
Royalties ensure that NFT creators earn a percentage of secondary sales.
📌 Not enforced on-chain → Since Aptos NFTs are objects, they can be transferred freely.
📌 Handled by marketplaces → Royalties are deducted when NFTs are sold through platforms that support them.
📌 Customizable settings → Creators can set royalties at minting and, in some cases, update them later.
🛠 7. Minting NFTs Easily
The aptos_token module simplifies NFT creation by allowing users to:
✅ Mint transferable NFTs (with royalties).
✅ Create soulbound NFTs (non-transferable).
✅ Manage NFT properties without writing smart contracts.
Perfect for creators who want plug-and-play NFT minting on Aptos.
The Aptos Digital Asset standard isn’t just another NFT model—it’s a scalable, efficient, and customizable framework for Web3 creators.
#Aptos
Wolf retweeted
🔍 Fungible Asset Standard on Aptos
The Fungible Asset (FA) on Aptos is a standard for creating and managing fungible tokens, similar to Ethereum's ERC-20. It enables developers to mint, burn, and transfer tokens securely and efficiently, leveraging Move's resource-oriented design.
📦Core modules to import:
Unlike Ethereum, where you write a contract that inherits from the ERC-20 standard, Aptos lets you import prebuilt, battle-tested code for fungible tokens:
- fungible_asset.move: for developers to create and manage tokens
- primary_fungible_store.move: handles deposits, withdrawals, and transfers in user wallets.
🔑Key objects:
The standard leverages Move Objects concept (they are more customizable and extensible).
- Metadata Object: contains token information like name, symbol, decimals, and supply. This unique object identifies the token type.
- FungibleStore Object: acts as the user’s wallet, storing balances of a specific token type.
🪙Token transfer:
When tokens (e.g., 100 USDC) are transferred:
- They're temporarily represented as FungibleAsset objects (just like cash).
- FungibleAsset are transferred by removing them from one FungibleStore and adding them to another.
⚙️ How It Works: Creating a Token:
Developers follow these steps to create and manage a fungible token:
1. Create Metadata Object - Use "object::create_named_object" with a signer to initialize a Metadata object for the token.
2. Call "primary_fungible_store::create_primary_store_enabled_fungible_asset" to set up the token with name, symbol, decimals, supply, URIs for the project and icon.
3. Use the ConstructorRef returned from the created object to generate Refs, which enable the token creator to perform key actions such as minting, burning, freezing, and transferring tokens.
Wolf retweeted
🚀 Gas-efficient price comparison tip for developers: Compare prices without division by using cross-multiplication.
Wolf retweeted
🏆 @ZivoeFinance Audit Contest Results 🏆
11. recursiveEth - $1,067.81
12. @WhyBhumii - $1,065.93
13. @DzordanTa1567 - $976.63
14. @MarsWhiteHacker - $901.05
15. lemonmon - $881.93
16. @int0x1catedCode - $701.50
17. @amarfares_ - $687.83
🚨 New contest: Zivoe @ZivoeFinance 🚨
Sign up here: audits.sherlock.xyz/contests…
Total Rewards: 80,000 USDC
nSLOC: 2908
Lead Senior Watson: @cergyk1337
Starts Monday, April 8th at 15:00 UTC
Check it out!!
Wolf retweeted
🏆 @jalaswap Audit Contest Results 🏆
Congrats to:
1. recursiveEth - $1,163.36🥇
2. @MahmudOloyede, den_sosnovskyi - $1,055.07🥈
bughuntoor made $7,000.00 fixed pay + $363.37 from the contest pot!
$24,250.00 rewards ➡️ $6.9M+ paid out in rewards.
This quoted post is unavailable.
Wolf retweeted
Results from the poll show most believe AI will positively impact the security research ecosystem.
Let’s see the negative side that’s less talked about 🧵
Wolf retweeted
Here Is How To Conquer Any Codebase...
Instead of just reading the code and trying to make sense of it in your mind, do this instead:
Pick a flow and write out a test for it with your own hands.
Don't take existing unit tests and mix and match them to create that test. WRITE IT YOURSELF.
This will allow you to go through the whole setup needed for the flow to work. This can include calling priviliged functions, and setting up protocol params.
You also want to HEAVILY use "console.log" in order to visualize how the state is being updated for each step.
I typically like to log the storage before and after the function's effect. This allows me to map out the full effect of the flow on the protocol.
Not only will you build a deep understanding, but you will also expand your attack surface.
You will be able to ask questions that will later be developed into threats and exploits as you move deeper into the code.
This is my go-to method when I'm dealing with a big and complex system. Just pick a flow and chip in.
Wolf retweeted
The Most Important Skill For a SR...?
HINT: It isn't being able to memorize dozens of different attack vectors
It is the ability to look into a piece of code, and deeply understand how it works.
That's it...
Once you have a deep understanding of how something works, it is just a matter of time before you figure out how to break it down.
There is no magical "methodology" or some hidden tool that top researchers use...
They just keep staring at the freaking code until it makes sense for them.
So just read the code bruh..
Wolf retweeted
Welcome @Curvance to the @cantinaxyz as we kick off the 2nd largest competition of the year!
💰 $375,000 USDC
🗓️ February 26th, 20:00 PM UTC (6 Weeks)
📍 (Competition Link Provided Below)
Loading...
Need an invite? Details Below 💾🪐
Wolf retweeted
4.0xCed3…Bc13
Protocol will not work with tokens that do not return bool value on approve calls #56
github.com/hats-finance/Blas…
5.@recursiveAudit
Vulnerability in pooledDeposit Function Enables Denial of Service (DoS) Attack #47
github.com/hats-finance/Blas…
...
5/11
Wolf retweeted
Welcome to the largest competition in history with... @Blast_L2 🪐
💰 $1,200,000 USDC
🗓️ January 30th, 3:00 PM EST / 20:00 PM UTC
📍 cantina.xyz/competitions
Invite only. Don't have one? Details below:
Wolf retweeted
Awards have been announced for the $1.1m USDC @zksync Era audit 🎉 🎉
Top 5:
🥇 xuwinnie - $502,041.99 USDC
🥈 ChainLight - $157,696.85 USDC
🥉 Audittens - $140,480.81 USDC
🏅 minhtrng - $38,573.19 USDC
🏅 erebus - $25,342.88 USDC
Read more at: code4rena.com/audits/2023-10…
Wolf retweeted
Talented auditors are still in short supply.
The fastest way to make money for a technical person is not to grow a following or "personal brand" but to compete in audit contests / bounties.
Once you've got the auditing skills, there are endless possibilities, including growing a following.





















