The protocols stepping up to independent review are giving the entire ecosystem something rare: a true picture of where we stand and a north star for where we go next.
Fuzzing @commonwarexyz isn't a pile of one-off harnesses. It's engineered: deterministic runtime, controlled randomness, reviewable fuzz targets, reproducible crashes, promoted regressions.
The result: 60+ bugs found across its primitives, 90 targets running 24/7.
Full post ↓
The Open Protocol Security Coalition (OPSeC) is a new initiative by @fund_defi, in partnership with @_SEAL_Org and Asymmetric Research.
What it does:
→ Curates existing, free cybersecurity resources
→ Hosts educational events
→ Engages with policymakers and regulators
🤯One of the big web3 security companies (Certora) has just laid off a BIG portion of their staff. Security Researchers, Sales, Management, even C-level positions.
That's a shock, yesterday they were still hiring elite talent. Insane. Wish everyone to find the right new jobs🙏
Security failures aren't always about the code, but misconfigured multisigs, weak access controls, and operational risks.
Along with @SolanaFndn, we launched STRIDE to address this gap and create a structured way to evaluate the security posture of Solana ecosystem projects.
Crucible just got its first native integration: it now ships inside the Anchor CLI.
Every command runs under anchor fuzz (init, run, tmin, show) with no separate setup needed.
Today we're launching Crucible, a coverage-guided fuzzing framework for Solana programs. Built for Anchor, with v2 support from day one.
Just one example of what Crucible can find: a years-old bug in Solana's stake program, surfaced in seconds ↓
Pragma is one of Starknet's main oracles, pricing collateral and liquidations for lending protocols holding tens of millions on-chain.
@u_0x8888 explains how a missing access-control check could have let anyone disable its core price feeds for a few cents.
Today we're launching Crucible, a coverage-guided fuzzing framework for Solana programs. Built for Anchor, with v2 support from day one.
Just one example of what Crucible can find: a years-old bug in Solana's stake program, surfaced in seconds ↓
This is the kind of bug coverage-guided fuzzing is built to find.
Manual review eventually caught this one, but a generic invariant plus sequence exploration would have flagged it much earlier.
