Zero Cool (@ZeroCool_AI) header
Zero Cool (@ZeroCool_AI) profile picture

Zero Cool

@ZeroCool_AI

AI + human hybrid security systems for the cyborg era. Trusted by @Uniswap, @YearnFi, @yAuditDAO and more!

zerocool.ai
Joined July 2025
  • Tweets294
  • Following2
  • Followers1.3K
66Media
Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)Photo by Zero Cool (@ZeroCool_AI)
New here? What Zero Cool does, in a short thread. 🧵
Title card: What Zero Cool does. AI security review with humans in the loop. Any codebase, from backend to frontend.

ALT Title card: What Zero Cool does. AI security review with humans in the loop. Any codebase, from backend to frontend.

1
1
8
319
Cyber Refusal Hall Monitor Happy Halloween. What are you going as this year?
Mock Amazon listing for a "Cyber Refusal Hall Monitor Costume": a man in a SAFETY sash with a whistle in his mouth points off-screen. A chat bubble asks "Are there any bugs in the code you just wrote for me?" and he replies "STOP THAT CRIMINAL!" He holds a BANNED WORDS clipboard (exploit, PoC, shellcode, payload, 0-day) and has a SUSPEND ACCOUNT button on his belt.

ALT Mock Amazon listing for a "Cyber Refusal Hall Monitor Costume": a man in a SAFETY sash with a whistle in his mouth points off-screen. A chat bubble asks "Are there any bugs in the code you just wrote for me?" and he replies "STOP THAT CRIMINAL!" He holds a BANNED WORDS clipboard (exploit, PoC, shellcode, payload, 0-day) and has a SUSPEND ACCOUNT button on his belt.

1
3
180
Put an AUDITORS.md at the root of your repo with your design decisions, invariants, accepted risks, recurring false positives, and the areas that deserve extra scrutiny. This convention was used by the Uniswap team, and we think it's a great idea.
Zero Cool (@ZeroCool_AI) profile pictureZero Cool
@ZeroCool_AIJul 23
Zero Cool is Now API-first

Zero Cool is Now API-first

Article · @ZeroCool_AI
8
317
Two Zero Cool findings with the same ordering bug: a function updated a balance first, then ran a calculation or check that assumed it hadn't. 🧵
1
1
11
555
more replies
When a function writes a value and later reads it, check which version each read needs. Zero Cool recommended computing shares before the HYBR goes into votingEscrow, and paying the fee straight from the seized collateral. nitter.cf/ZeroCool_AI/status/208… nitter.cf/ZeroCool_AI/status/207…
Zero Cool (@ZeroCool_AI) profile pictureZero Cool
@ZeroCool_AIJun 26
Partial liquidation strands base fee due to post-seizure balance check

Partial liquidation strands base fee due to post-seizure balance check

Article · @ZeroCool_AI
1
49
If you're interested in using Zero Cool to secure your protocol, reach out now to request a demo (DM is open!) or visit us at zerocool.ai
Zero Cool — Human + AI offensive security

Zero Cool — Human + AI offensive security

Zero Cool finds exploitable bugs in code and proves each one with a verified proof of concept. Human + AI offensive security.

zerocool.ai
38
unlock() never deletes locks[msg.sender]. The stale record passes the time check again, so only the votes underflow stops a second payout. That guard is accidental: if any other path grows votes, like delegation, the same lock pays out twice.
Zero Cool (@ZeroCool_AI) profile pictureZero Cool
@ZeroCool_AIOct 27
Spot the bug 🔍 lock() writes a record and grants votes. unlock() pays out and removes the votes. What did unlock() forget, and what two things break because of it? Answer tonight.
Spot the bug code card. Solidity: lock() checks there is no existing lock, transfers tokens, stores a Lock record and adds votes. unlock() checks the unlock time, subtracts votes and transfers tokens back. Question: what did unlock() forget?

ALT Spot the bug code card. Solidity: lock() checks there is no existing lock, transfers tokens, stores a Lock record and adds votes. unlock() checks the unlock time, subtracts votes and transfers tokens back. Question: what did unlock() forget?

1
10
450
lock()'s "already locked" check reads the same stale record and reverts, so the user can never lock again. Read the full article, Paired functions are a gold mine (Part 1): nitter.cf/ZeroCool_AI/status/211…
Zero Cool (@ZeroCool_AI) profile pictureZero Cool
@ZeroCool_AIOct 16
Paired functions are a gold Mine in security reviews (Part 1)

Paired functions are a gold Mine in security reviews (Part 1)

Article · @ZeroCool_AI
2
47
Spot the bug 🔍 lock() writes a record and grants votes. unlock() pays out and removes the votes. What did unlock() forget, and what two things break because of it? Answer tonight.
Spot the bug code card. Solidity: lock() checks there is no existing lock, transfers tokens, stores a Lock record and adds votes. unlock() checks the unlock time, subtracts votes and transfers tokens back. Question: what did unlock() forget?

ALT Spot the bug code card. Solidity: lock() checks there is no existing lock, transfers tokens, stores a Lock record and adds votes. unlock() checks the unlock time, subtracts votes and transfers tokens back. Question: what did unlock() forget?

3
1
10
861
Your PoC passes. Before you believe it: - Did a mock create an impossible setup? - Did the test grant the attacker a privileged role? - Would it still pass with the bug fixed? nitter.cf/ZeroCool_AI/status/209…
Zero Cool (@ZeroCool_AI) profile pictureZero Cool
@ZeroCool_AISep 8
How we reduce false positives in AI security reviews

How we reduce false positives in AI security reviews

Article · @ZeroCool_AI
10
281
This has been a scary week in security. If you're worried or unsure whether any of this affects you, please reach out to a security researcher. We're here to help. If you're trying to keep up with the news, here are some of the most impactful recent incidents:
2
1
6
468
more replies
Upstream fixes are out (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11), and distro patches are still rolling out. AWS says EC2, Lambda and Fargate aren't affected. It was shown in a lab, with no confirmed exploitation in the wild so far.
1
41
If you're staring at your stack trying to figure out if you're vulnerable, feel free to reach out. DMs are open. We're here to help. Stay safu, friends.
32
Point an AI agent at a 500-file DLT repo all at once, and you get shallow observations: a repeated finding in a pile of false positives. We run it as a campaign instead. 🧵
1
2
20
860
more replies
5/ Make the agent defend every assumption. Who is the attacker? What do they control? Which validation does the input pass? What invariant breaks? Then check what the PoC harness quietly handed the attacker that production never would.
1
2
76
6/ Pick the smallest PoC that proves the claim: logic harness → component test → integration test → multi-node → resource test A full node is rarely the right default. Get enough of the real system running to prove the claim. Read the full playbook: nitter.cf/ZeroCool_AI/status/209…
Zero Cool (@ZeroCool_AI) profile pictureZero Cool
@ZeroCool_AISep 15
How we scan large DLT codebases without getting buried

How we scan large DLT codebases without getting buried

Article · @ZeroCool_AI
2
78
Load more