/tags/security/ Recent content in Security on truegav Hugo en-us Sun, 10 May 2026 14:00:00 +0530 /posts/ai-slop-drowning-bug-bounty/ Sun, 10 May 2026 14:00:00 +0530 /posts/ai-slop-drowning-bug-bounty/ <h2 id="the-funeral-that-nobody-scheduled">The funeral that nobody scheduled</h2> <p>Bug bounty is dead. The industry has not scheduled the funeral because scheduling a funeral requires admitting a death occurred and admitting a death occurred is bad for the quarterly investor update.</p> <p>A researcher I work with delivered the autopsy in a single Discord message. Not a whitepaper. Not a 200-page industry analysis with infographics and a foreword from a partner who has never read a bug report. One sentence from someone who reads submissions every day:</p> /posts/audit-cost-more-than-my-net-worth/ Tue, 18 Feb 2025 14:00:00 +0530 /posts/audit-cost-more-than-my-net-worth/ <h2 id="the-three-stamps">The three stamps</h2> <p>Balancer V2 hired Trail of Bits. Then OpenZeppelin. Then Certora. These are the names you print on your pitch deck in 24-point bold to make the venture capital partner stop asking about security and start focusing on the token allocation table.</p> <p>Months of review. Hundreds of thousands of dollars in fees. Multiple remediation rounds. Multiple re-review rounds. Three firms whose combined brand reputation could convince a regulated bank to integrate a smart contract.</p> /posts/delegatecall-war-crime/ Mon, 15 Mar 2021 14:00:00 +0530 /posts/delegatecall-war-crime/ <h2 id="three-opcodes-and-two-want-you-dead">Three opcodes and two want you dead</h2> <p>The EVM provides three ways to invoke another contract.</p> <p><code>call</code> sends ETH and returns data. Civilized. Predictable. What a normal engineer would design.</p> <p><code>staticcall</code> is read-only and cannot modify state. Has never caused anyone harm.</p> <p><code>delegatecall</code> runs the target&rsquo;s bytecode inside your storage context. Your balance becomes their balance. Your identity becomes their identity. The target code reads your variables and writes to your slots using its own names. The EVM sits in the corner and allows this because the EVM was designed by people who considered this an acceptable tradeoff between code reuse and safety.</p>