Securing Web3 Discovered 500+ High/Medium Severity Bugs Multiple 1st Place Winner & 30+ Top Finishes in Public Security Contests Tier 1 LSW at Sherlock
Request an audit 👉
Joined January 2023
- Tweets1.3K
- Following249
- Followers4.6K
- Likes903
Kupia Security retweeted
Capital efficiency is one of the central ideas behind decentralized lending.
JustLend’s Supply and Borrow Market V1 uses a cross-collateral structure that allows eligible supplied assets to contribute toward an account’s borrowing capacity.
This creates an interconnected lending experience.
Instead of evaluating every collateral position entirely in isolation, the protocol can calculate borrowing capacity across enabled collateral markets according to their individual risk parameters.
The advantage is flexibility.
Users with multiple supported assets may be able to utilize their eligible collateral collectively when accessing liquidity.
However, this flexibility also creates interconnected exposure.
Changes in the value of one collateral asset can influence the overall health of a borrowing account.
This makes collateral management especially important.
The V1 model demonstrates how decentralized lending can improve capital utilization through pooled markets and cross-collateral functionality.
But capital efficiency should always be balanced with responsible risk management.
More borrowing capacity is not automatically better if it creates excessive liquidation exposure.
@justinsuntron #TRONEcoStar
@DeFi_JUST
Kupia Security retweeted
Base just cut its block time from 2 seconds to 200 milliseconds.
Denim is live on mainnet. That's five full blocks every second, each a real block rather than a preview.
Flashblocks is retired. Apps now read the live chain on that faster cadence instead of a separate pending stream.
Contracts also get BaseTime, so they can measure time down to the millisecond.
It's Base's fourth upgrade this year. Faster blocks don't change Ethereum finality, but they do change how often DeFi can react.
ALT Weekend batch: Base Denim 200ms blocks 2026-11-06
Kupia Security retweeted
Project of the Week: @KaminoFinance
Kamino is helping shape the next phase of Solana DeFi.
What started as a liquidity and lending protocol has expanded into a broader financial ecosystem spanning automated vaults, borrowing markets, fixed-rate products, and tokenized asset collateral.
With over $1.26B in TVL, $823M in active loans, and an AUTO market that surpassed $170M in deposits, Kamino is becoming a major part of Solana's onchain financial infrastructure.
Kupia Security retweeted
Nibiru v2.23 is live on mainnet as of height 49,224,746
We expect to see block propagation speed up as much as 3x, with instant finality over the next few days after more testing.
This launch brings Nibiru BFT to mainnet and crucially improves on some Cosmos SDK modules to replace them with simpler and safer Wasm contracts.
Release notes: github.com/NibiruChain/nibir…
Kupia Security retweeted
A stablecoin launch needs two kinds of work: getting the asset issued, and making it useful where people already manage Bitcoin.
That split is visible in the @utexocom –UniSat rollout. Utexo handles the minting infrastructure;
An exchange, a wallet and an OTC desk don’t handle stablecoins in the same way. Their operational needs differ, even when the asset is identical. @utexocom
Six decimals and the Energy model will bite anyone porting Solidity over, and share math in vaults is where I'd start reading. Tutorials don't replace a real review of user funds 🔍
🔺 Building DeFi on TRON is becoming more accessible with better developer resources.
OpenZeppelin's new tutorial on creating a USDT Vault using Hardhat and TRC-4626 is worth exploring because it connects familiar Solidity development practices with TRON-specific requirements.
Here are three important takeaways:
🛠️ 1. Understanding TRON's Development Environment
Developers need to account for important differences, including USDT's six-decimal precision, TRON address formats, token transfer behavior, and the Energy resource model.
🏦 2. Bringing Structure to DeFi Vaults
TRC-4626 provides a framework for deposits, withdrawals, and tokenized vault shares. The tutorial also explores entry and exit fees, highlighting the importance of accurate accounting and share calculations.
🔐 3. Better Tools, More Careful Development
Hardhat helps Solidity developers work within a familiar development environment. However, tutorials are only a starting point. Real financial applications still require thorough testing, security reviews, and careful handling of user funds.
Better documentation creates fewer development barriers and more opportunities for meaningful experimentation.
TRON's ecosystem needs not only liquidity, but also tools that help developers turn ideas into useful applications.
📚 Explore the guide: docs.openzeppelin.com/tron-c…
@trondaoCN @justinsuntron
#TRONEcoStar
Kupia Security retweeted
We launched @TowerExchange on @arc mainnet on September 16, the same month we joined the Arc Accelerator Program.
So the accelerator never saw a deck version of Tower. It saw launch week and then the first two months of a live product, with real routes going through @Uniswap, @aeroxyz, @KyberNetwork and @circle StableFX and real questions coming back from people using it.
The program wraps up on soon...
Week 7 with Bharat Vishnubhotla at @circle was one of the sessions I'll keep coming back to.
We're coming out the other side building the same thing we went in with: one API for stablecoin swaps and bridging across networks, so wallets and fintechs don't have to stitch it together themselves
Find our free API and explore your build here:
devs.tower.exchange
Week 7 of the Arc Accelerator Program, led by Bharat Vishnubhotla at @circle, was a very insightful and engaging session on building trust in financial products.
It explored how early-stage teams can establish credibility, secure strategic partnerships, and earn user and enterprise trust when handling financial workflows, with valuable insights for teams building on @arc.
Kupia Security retweeted
"Audited" usually means a team reviewed one version of the code on one date. The claim people hear is "so it's safe".
Teams can often swap out a smart contract's code later, so the code running today may not be the code that was reviewed. The report also lists a scope, and anything outside it was never looked at. Think of a health inspection from last spring: it tells you little about tonight's kitchen.
Habit for the @RallyOnChain crowd: open the report before you trust the badge. My take: the badge answers "was it checked". Safety is a separate question.
One question to carry: who can change this smart contract after the audit? Run it on the last protocol you used and tell me what you find.
Hooks on Xahau is a neat split to know about, the mainnet vs sidechain-style naming trips up a lot of audit scopes 🔍 Which network do most contracts we look at actually deploy to?
Kupia Security retweeted
Elysium public mainnet is Monday 9 November
But the chain has been trading for days already
Memecoins, launchpads and bridges are all live on early mainnet
Some projects I am keeping a close eye on 👇
We read contracts all day. No time left for X, not on this account, not on our own 🔍 Now viralroyale.com keeps them active in 10 minutes a day: fresh posts, replies in our voice. Perfect for teams too busy to post 🛡️
Kupia Security retweeted
Velixo was the first NFT marketplace live on Fogo mainnet day one.
Not a port. Built native for Firedancer’s ~40ms blocks and sub-second finality, with optional fully sponsored (gasless) Sessions.
Now dual-chain on Robinhood Chain too.
Most marketplaces still treat speed and gas as afterthoughts. This one doesn’t.
@VelixoMarket
500+ High and Medium severity findings 🔍
Found across public contests, private audits and bounties, by the same team that reads your code 🛡️
Shipping soon? Request an audit at sec.kupia.io
#Web3Security #SmartContracts #Audit
36 podiums in public audit contests 🏆
13 gold, 8 silver, 15 bronze, in contests where every team reads the same code 🔍
The same team can read yours. Request an audit at sec.kupia.io
#Web3Security #SmartContracts #Audit
Before you upgrade a proxy, three checks 🛡️
1. Diff the storage layout, old vs new
2. Make sure the new implementation can't be initialized by anyone
3. Run the upgrade on a mainnet fork first
Most upgrade bugs are caught by #1 alone 🔍
sec.kupia.io
Empty vault, first deposit: the first depositor can inflate the share price so the next user rounds down to 0 shares 🚨
Seed the vault at deploy or use virtual shares 🛡️
Launching a vault? sec.kupia.io
#Web3Security #SmartContractAudit #DeFi
Five 1st places on @code4rena 🥇
Audit 459, ULTI, Fenix, Karak and Doubler, across invitationals and open contests 🔍
Launching soon? Request an audit at @KupiaSecurity
#Web3Security #Code4rena #SmartContractAudit #DeFi
Nearly half of the whole prize pool in the @FenixFinance invitational audit on @code4rena 🥇 1st place, top hunter and top gatherer 🏆 Thank you @FenixFinance and @code4rena! #Web3Security #Code4rena #SmartContractAudit #DeFi #BugBounty #KupiaSec
nitter.cf/code4rena/status/18466…
The results of the Fenix Finance invitational audit are in, and the report is live!
Big congrats to everyone who submitted valid findings, especially to @KupiaSecurity for securing nearly half of the total prize pool!
Much respect to @FenixFinance for their unwavering commitment to the highest security outcomes.
Top winners and link to report in thread 👇
