Cyfrin Audits (@cyfrin) / X

Cyfrin Audits

2,396 posts

Cyfrin Audits

@cyfrin

Securing the blockchain and its users. Powering @cyfrinupdraft | @soloditofficial | @codehawks | @battlechain

Request an audit

Joined January 2023

Pinned
Cyfrin Audits
@cyfrin
Apr 15
Your newest AI security engineer has just arrived. Cygent isn't just an AI bug scanner; it learns your codebase, works alongside your team, and writes the PRs to fix them. - Finds bugs - Gets on calls - Schedules tasks - Proactive security advice All in your chat interface 🧵
00:00
28K
Cyfrin Audits
@cyfrin
3h
Replying to @cyfrin
Right now, exactly one wallet has shipped ERC-8213: Keycard Shell. Ledger, Trezor, MetaMask, Safe, Rabby, and every other major wallet have the work ahead of them. The spec is small. The implementation cost is minimal. Which wallet ships it next? Track adoption here:
erc8213.eth.limo
ERC-8213 — Cryptographic Fingerprints for Wallets
The standard for displaying EIP-712 and calldata digests so signers can verify what they sign.
93
Cyfrin Audits
@cyfrin
3h
Replying to @cyfrin
The Bybit signers had hardware wallets. They had training. What they lacked was a fixed, short reference value to compare against an independent source. ERC-8213 gives them exactly that. Two lines of code to compute. One digest to match. That's the whole verification step.
71
Cyfrin Audits
@cyfrin
3h
Replying to @cyfrin
Think of it as two layers. → ERC-7730 is the everyday-user layer. Makes signing legible. → ERC-8213 is the high-value layer. Makes signing verifiable. A treasury manager approving a $200M transfer needs both. They want to read what the transaction does AND confirm the bytes
8
Cyfrin Audits
@cyfrin
3h
Replying to @cyfrin
ERC-8213 answers: "How do I verify the bytes haven't been swapped on me?" One 32-byte digest. You compute it yourself on a separate machine. Compare it to what the wallet shows. The trust model is simpler: you only trust your own hash function.
126
Cyfrin Audits
@cyfrin
3h
Replying to @cyfrin
ERC-7730 answers: "What does this transaction mean in plain language?" It translates raw calldata into something like "Send 100 USDC to vitalik.eth." Great for everyday users. But it depends on a description registry, and you have to trust that registry is honest.
224
Cyfrin Audits
@cyfrin
3h
ERC-7730 and ERC-8213 keep getting framed as competitors. They're not. They solve different trust problems for different signers. A wallet should ship both. 🧵
325
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
Our auditors see dependency issues in nearly every engagement. The teams that catch them early are the ones with workflows that don't punish you for checking. That's what this is built for. Cygent dependency monitoring is live now. Worth setting up before your next dependency
Cygent — Your Dedicated AI Security Engineer
From cygent.dev
155
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
The loop between alert and verification is where teams stall. An alert fires in Slack, someone opens a browser, checks the advisory, cross-references the lockfile, pushes a bump, then has no fast way to confirm it resolved. Cygent closes that loop in the same channel where the
165
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
This matters most for transitive dependencies. The ones your team never directly installed but inherited three layers deep. Cygent checks against your real dependency graph, not a generic feed. If the vulnerable package is still reachable through another path after your fix,
44
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
The response includes everything you need to verify the fix without leaving chat. → Package name and affected versions → Severity level and advisory source → Whether the vulnerability still exists in your dependency tree → Suggested remediation if it does No tab-switching.
535
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
The workflow is simple. You push a fix or update a dependency. Instead of switching to a dashboard or CLI, you trigger a re-scan from the same chat channel where the alert originally landed. Cygent runs the scan against your actual project dependencies and reports back right
854
Cyfrin Audits
@cyfrin
Jun 8
We've watched teams lose hours context-switching between vulnerability alerts, package managers, and chat threads trying to confirm a fix actually landed. Cygent now lets you trigger a dependency re-scan directly from Slack, Discord, or Telegram. 🧵
1.2K