Wolf (@recursiveAudit) profile picture

Security Researcher, DM for private audits - https://teapawt.net/t.co/TU9hL10mSC

Mountains
Joined September 2022
Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)Photo by Wolf (@recursiveAudit)
April 2026 was the worst month ever for DeFi exploits. ~$635M lost in total. 28 incidents in 30 days. Apr 1 → Drift → $285M Apr 3 → Silo V2 → $392K Apr 4 → TMM → $1.67M Apr 5 → Denaria Finance → $165K Apr 9 → Aethir → $423K Apr 12 → Hyperbridge → $2.5M Apr 12 → SubQuery → $60K Apr 13 → Dango → $410K Apr 13 → Mona → $61K Apr 14 → Zerion → $100K Apr 16 → Rhea Finance → $18.4M Apr 16 → Grinex → $15M Apr 18 → Kelp DAO → $293M Apr 20 → Juicebox V3 → $52K Apr 20 → Thetanuts Finance → $50K Apr 21 → Volo Protocol → $3.5M Apr 22 → Kipseli → $80K Apr 23 → Giddy Finance → $1.3M Apr 25 → PurrLend → $1.5M Apr 26 → Scallop → $150K Apr 27 → Singularity Finance → $413K Apr 27 → ZetaChain → $300K Apr 28 → JuDAO → $228K Apr 28 → Quant → $138K Apr 29 → Aftermath Perps → $1.14M Apr 29 → Sweat Foundation → $3.5M Apr 29 → Syndicate → $330K Apr 30 → Wasabi Protocol → $5M+ Two attacks (Drift + Kelp DAO) account for ~95% of the total. Both linked to admin-key compromises with no timelock or multisig. DeFi security is broken at the infrastructure layer. Bridges, deployer keys, and cross-chain messaging keep producing the largest single-incident losses. Stay safe. Revoke approvals. DYOR.
10
8
183
9,437
Security researchers, a new one just dropped. The @revertfinance x Cantina security competition is now live. With $50,000 on the line, you'll be reviewing the pricing engine built for stableswap pools on top of Uniswap v4. Start here: cantina.xyz/competitions/e55…
3
1
58
4,243
We're excited to welcome @recursiveAudit as our newest Cantina Apprentice! A passionate security researcher with an unwavering commitment to excellence. Let's dive into his story.
1
2
2
15
1,739
💎 What is the Digital Asset (DA) Standard on Aptos? Aptos redefines NFTs with Digital Assets, where every NFT/token is an Object with its own unique address. Let’s break it down! 🧵👇 🔹 1. Why is Aptos DA different? Unlike traditional NFTs, Aptos Digital Assets are not just tokens—they are on-chain objects with their own unique addresses. This brings: ✅ More efficient storage (no account clutter). ✅ True ownership & portability (each NFT is an independent entity). ✅ Customizability (update metadata, add new traits, and mutate NFTs). Aptos NFTs are smart, adaptable, and built for the future. 🚀 🏗 2. How are Digital Assets created? Aptos NFTs follow a structured approach with two main objects: 🔹 Collection → A group of NFTs with metadata (collection.move module). 🔹 Token → The actual NFT, which belongs to a collection and stores its own attributes (token.move module). Each NFT must be part of a Collection, but the Collection does not own the NFT—creators or users do. 📌 3. Collections: Fixed vs. Unlimited NFTs are grouped into Collections, which can be either: 1️⃣ Fixed Supply → A limited number of NFTs can be minted. 2️⃣ Unlimited Supply → No cap on minting; creators can add more anytime. Each collection contains metadata like name, creator, and URI. 🎨 4. How is NFT metadata stored? Each Aptos NFT stores its properties in a Property Map (property_map.move module), which includes: 🔹 Attribute names (like "rarity" or "power level"). 🔹 Data types (string, number, boolean, etc.). 🔹 Values (e.g., "Legendary", 100, true). This enables dynamic, customizable NFTs with rich metadata. 🚀 5. NFT Actions: Transfer, Burn, Mutate ✅ Transfer → Move NFTs seamlessly between wallets. ✅ Burn/Delete → Permanently remove NFTs from circulation. ✅ Modify Metadata → Update an NFT’s image, description, or attributes after minting. 💰 6. Royalties: How Creators Get Paid Royalties ensure that NFT creators earn a percentage of secondary sales. 📌 Not enforced on-chain → Since Aptos NFTs are objects, they can be transferred freely. 📌 Handled by marketplaces → Royalties are deducted when NFTs are sold through platforms that support them. 📌 Customizable settings → Creators can set royalties at minting and, in some cases, update them later. 🛠 7. Minting NFTs Easily The aptos_token module simplifies NFT creation by allowing users to: ✅ Mint transferable NFTs (with royalties). ✅ Create soulbound NFTs (non-transferable). ✅ Manage NFT properties without writing smart contracts. Perfect for creators who want plug-and-play NFT minting on Aptos. The Aptos Digital Asset standard isn’t just another NFT model—it’s a scalable, efficient, and customizable framework for Web3 creators. #Aptos
1
2
168
🔍 Fungible Asset Standard on Aptos The Fungible Asset (FA) on Aptos is a standard for creating and managing fungible tokens, similar to Ethereum's ERC-20. It enables developers to mint, burn, and transfer tokens securely and efficiently, leveraging Move's resource-oriented design. 📦Core modules to import: Unlike Ethereum, where you write a contract that inherits from the ERC-20 standard, Aptos lets you import prebuilt, battle-tested code for fungible tokens: - fungible_asset.move: for developers to create and manage tokens - primary_fungible_store.move: handles deposits, withdrawals, and transfers in user wallets. 🔑Key objects: The standard leverages Move Objects concept (they are more customizable and extensible). - Metadata Object: contains token information like name, symbol, decimals, and supply. This unique object identifies the token type. - FungibleStore Object: acts as the user’s wallet, storing balances of a specific token type. 🪙Token transfer: When tokens (e.g., 100 USDC) are transferred: - They're temporarily represented as FungibleAsset objects (just like cash). - FungibleAsset are transferred by removing them from one FungibleStore and adding them to another. ⚙️ How It Works: Creating a Token: Developers follow these steps to create and manage a fungible token: 1. Create Metadata Object - Use "object::create_named_object" with a signer to initialize a Metadata object for the token. 2. Call "primary_fungible_store::create_primary_store_enabled_fungible_asset" to set up the token with name, symbol, decimals, supply, URIs for the project and icon. 3. Use the ConstructorRef returned from the created object to generate Refs, which enable the token creator to perform key actions such as minting, burning, freezing, and transferring tokens.
1
2
200
🚀 Gas-efficient price comparison tip for developers: Compare prices without division by using cross-multiplication.
1
3
165
🏆 @ZivoeFinance Audit Contest Results 🏆 11. recursiveEth - $1,067.81 12. @WhyBhumii - $1,065.93 13. @DzordanTa1567 - $976.63 14. @MarsWhiteHacker - $901.05 15. lemonmon - $881.93 16. @int0x1catedCode - $701.50 17. @amarfares_ - $687.83
🚨 New contest: Zivoe @ZivoeFinance 🚨 Sign up here: audits.sherlock.xyz/contests… Total Rewards: 80,000 USDC nSLOC: 2908 Lead Senior Watson: @cergyk1337 Starts Monday, April 8th at 15:00 UTC Check it out!!
1
2
3
837
My first audit and I got this So exciting🚀
1
4
203
🏆 @jalaswap Audit Contest Results 🏆 Congrats to: 1. recursiveEth - $1,163.36🥇 2. @MahmudOloyede, den_sosnovskyi - $1,055.07🥈 bughuntoor made $7,000.00 fixed pay + $363.37 from the contest pot! $24,250.00 rewards ➡️ $6.9M+ paid out in rewards.
This quoted post is unavailable.
1
1
2
6
3,630
$3 million vulnerability just chilling in sherlock repo
2
2
1
22
3,175
Results from the poll show most believe AI will positively impact the security research ecosystem. Let’s see the negative side that’s less talked about 🧵
AI is becoming a common tool for auditors in their workflows. 🔍 Question: Is AI integration a net positive or negative for the security research ecosystem? I'll share my thoughts after the poll. Eager to see your votes!
73%Positive Impact
27%Negative Impact
30 votes • Final results
1
1
4
1,575
Here Is How To Conquer Any Codebase... Instead of just reading the code and trying to make sense of it in your mind, do this instead: Pick a flow and write out a test for it with your own hands. Don't take existing unit tests and mix and match them to create that test. WRITE IT YOURSELF. This will allow you to go through the whole setup needed for the flow to work. This can include calling priviliged functions, and setting up protocol params. You also want to HEAVILY use "console.log" in order to visualize how the state is being updated for each step. I typically like to log the storage before and after the function's effect. This allows me to map out the full effect of the flow on the protocol. Not only will you build a deep understanding, but you will also expand your attack surface. You will be able to ask questions that will later be developed into threats and exploits as you move deeper into the code. This is my go-to method when I'm dealing with a big and complex system. Just pick a flow and chip in.
2
5
44
2,555
The Most Important Skill For a SR...? HINT: It isn't being able to memorize dozens of different attack vectors It is the ability to look into a piece of code, and deeply understand how it works. That's it... Once you have a deep understanding of how something works, it is just a matter of time before you figure out how to break it down. There is no magical "methodology" or some hidden tool that top researchers use... They just keep staring at the freaking code until it makes sense for them. So just read the code bruh..
3
7
26
2,756
Welcome @Curvance to the @cantinaxyz as we kick off the 2nd largest competition of the year! 💰 $375,000 USDC 🗓️ February 26th, 20:00 PM UTC (6 Weeks) 📍 (Competition Link Provided Below) Loading... Need an invite? Details Below 💾🪐
136
11,234
120
11,878
124,472
It appears @Ripple was hacked for ~213M XRP ($112.5M) Source address rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm So far the stolen funds have been laundered through MEXC, Gate, Binance, Kraken, OKX, HTX, HitBTC, etc
676
1,170
726
4,829
2,660,871
Welcome to the largest competition in history with... @Blast_L2 🪐 💰 $1,200,000 USDC 🗓️ January 30th, 3:00 PM EST / 20:00 PM UTC 📍 cantina.xyz/competitions Invite only. Don't have one? Details below:
230
283
262
425
176,426
Awards have been announced for the $1.1m USDC @zksync Era audit 🎉 🎉 Top 5: 🥇 xuwinnie - $502,041.99 USDC 🥈 ChainLight - $157,696.85 USDC 🥉 Audittens - $140,480.81 USDC 🏅 minhtrng - $38,573.19 USDC 🏅 erebus - $25,342.88 USDC Read more at: code4rena.com/audits/2023-10…
22
34
58
378
226,173
Talented auditors are still in short supply. The fastest way to make money for a technical person is not to grow a following or "personal brand" but to compete in audit contests / bounties. Once you've got the auditing skills, there are endless possibilities, including growing a following.
4
6
98
6,375