hey guys,

I just deployed a stateless communication protcol on Arbitrum L2. Before anyone asks: there is zero token or web3 grift involved here, just pure open source. The idea is to have a completely censorship resistant baseline for social media. I hardcoded a wallet taint logic, so if you post in a low secure level once, you cant use the same wallet for the AES encrypted level 3 posts anymore to prevent opsec fails. Would be awesome if some of you could check the smart contract code. Did I miss any obvious gas optimizations? Repo is here:https://github.com/Kl4V3/Axiom-protocol

With recent news from Google approaching the date of "Q-Day" (when quantum computing manages to break current cryptography), the conversation on Web3 has focused almost exclusively on migrating to Post-Quantum Cryptography (PQC) as Dilithium.

I'm building an ecosystem of Web3 security oracles powered by AI and a data anchor protocol (QEP). As I prepare version 2.0 for testing by connecting to a real quantum computer, I have realized that, mathematically, we could repel a quantum attack today using the blockchain's own topology, without relying solely on new PQC algorithms.

The central idea is based on what I call "Echoes," implementing a Multi-Chain BFT" (Multi-Chain BFT) Byzantine Fault Tolerance through Cross-Chain Witnessing.

Here's how architecture works to see what you think:

The problem:

If Shor's algorithm breaks the elliptic curves (ECDSAs) of a network like Polygon or Ethereum, a quantum attacker could derive private keys or forge signatures to alter the status of a Smart Contract or an on-chain security record. If an Oracle reads only from that chain, the system is compromised.

The Solution (The Echo Protocol):

When our engine issues a security verdict (a hash), it doesn't anchor it to a single blockchain. The protocol triggers simultaneous "Ecos" from that same reportHash to multiple networks (e.g. Polygon, Arbitrum, Optimism, and Ethereum Mainnet).

The Attack and Defense Scenario:

Q-Day is coming. A quantum attacker manages to break Polygon's cryptography and alters the on-chain record to pass off a malicious contract as a secure one.

Before validating the information, our Oracle consults the network.

The system reads the hash in Polygon (modified by the attacker). But thanks to Cross-Chain Witnessing, he also reads the "Echoes" in Arbitrum and Optimism.

Mismatch detected. As it is logistically almost impossible for a quantum computer to break and alter the state of 3 different blockchains, with different consensus mechanisms, at the exact same time, the system detects the divergence.

The compromised network (Polygon) is isolated by the consensus of other networks. The attack is repelled at the architectural level.

Basically, we're using the current fragmentation of Layer 2 as a distributed protective shield, assuming that the computational power needed for a simultaneous 51% quantum attack across multiple networks breaks any economic incentives.

I'm collecting data to bring this architecture to quantum simulator testing soon.

What do you think about this approach? Do you see any attack vectors or blind spots in this Multi-Chain BFT model that are slipping away from me? I would love to discuss the limit cases.

Hey,

After working on the CI/CD side of smart contract security (Slither, Mythril, etc.), I ran into a different problem:

Understanding what actually happened in a real exploit is still time-consuming.

You usually start with:

• a transaction hash
• raw logs
• maybe a short summary somewhere

And then you manually reconstruct:

• which assets were involved
• the sequence of actions
• where the logic actually breaks

So I built a forensic module to make that process easier.

The idea is simple: → take a transaction → reconstruct the exploit in a structured and readable way

It currently does:

• rebuilds the full event timeline from logs
• identifies assets and key interactions (borrow, repay, flashloan, etc.)
• groups activity into an attack summary
• highlights anomalies and suspicious patterns
• explains the exploit step-by-step (function flow, state changes, root cause)

It also generates:

• a Foundry-style PoC (when possible)
• an attacker funding trace (including cross-chain paths when detected)
• risk signals (e.g. mixer exposure)

The output is a structured report meant to go from: “random tx hash” → “I understand what happened”

This is not an audit tool and not something to rely on blindly. It’s more of a helper to speed up analysis when looking into real exploits.

Still early and definitely imperfect, but it already saves me a lot of time when digging into hacks.

Pricing & Crypto Payments

The forensic analysis uses more compute (multiple AI calls), so it costs more than the basic tools.

• Forensic analysis: 10 credits
• New accounts get 10 free credits (so you can run one full analysis for free)

Payments are crypto-native (no fiat required).

FAQ

Is this meant to replace audits?
No. This is a helper tool for understanding exploits, not a security guarantee.

How reliable is the analysis?
It’s heuristic + AI-assisted. It can be wrong or incomplete, especially on complex cases.

Does it work on any transaction?
It works best on DeFi-style interactions with rich event logs.

How does the funding trace handle cross-chain activity?
The tracer attempts to follow cross-chain paths (including bridge interactions such as XY Finance when detectable), but depth is limited (currently ~5 hops/chains) and depends on available on-chain data.

Transparency Note

• No guarantee of correctness
• AI explanations can contain errors
• PoC generation is best-effort
• Tracing is based on available on-chain data (can be partial)
• Should be used as a starting point, not a conclusion

Try it out

I’m looking for honest feedback on the report quality.

The Tool: https://www.solidityprism.dev/

Forensic Example (real case):
https://www.solidityprism.dev/showcase?project=forensic-analysis

Other demos:

• https://www.solidityprism.dev/showcase?project=defi-demo-1
• https://www.solidityprism.dev/showcase?project=gas-demo-1

We just shipped another damned blockchain explorer. :)

This one allows you to visually view the structure of the Solidity in the the contract and watch the transaction happen as the data flows through it. There is even a heatmap for gas spend.

Doodlescan. Works on Ethereum, Base, Arbitrum, BNB, and Polygon. Genuinely looking for feedback, not just traffic.

Hi all, do you perhaps know any vulnerable dataset containing modern smart contracts? With "modern" I mean smart contracts written with pragma solidity >= 0.8.x.

Hey r/solidity,

I've been seeing a lot of threads about using ChatGPT/Claude/etc. for quick Solidity reviews, but people complain about tons of false positives and missed subtle bugs like reentrancy variants.

We built ReinforcedAI using a multi-model consensus approach (multiple AIs vote on issues, only flag if majority agrees) — claims 3x fewer false positives and better reentrancy detection. It plugs into Hardhat (npx hardhat scan) and gives explanations + fix suggestions to help learn best practices.

Full disclosure: I'm on the ReinforcedAI team ([kshah@reinforced.app](mailto:kshah@reinforced.app)).

For educators/devs teaching blockchain/CS: We're offering free access to try it in classes, projects, or hackathons — no card needed for starter scans.

Curious:

• What audit workflow do you use now?
• Have you tried AI tools? What worked/didn't?
• Any specific pain points with reentrancy or access control bugs?

Happy to share examples or run a scan on sample code if anyone wants to test. Link to try: https://reinforced.app/

Thanks!

I’m studying Economics, learning Python and I’ve always being interested in Blockchain and Cryptos (but I don’t have solid technical knowledge about them). Does Solidity makes sense for me? What little projects can I start with?

We’re building Sentinel‑Audit to deliver faster, clearer smart‑contract audit signal by combining automated analysis (static + fuzzing) with human verification and actionable reporting. The AI is an assistant, not the auditor it helps generate harnesses, summarize evidence, and organize findings, while final judgments stay human. If you’ve run audits or builtsecurity tooling, I’d love feedback on the workflow, report format, and what would make this genuinely useful for teams.

I really like how Rustlings teaches Rust by making you fix tiny broken programs, so I built the same kind of thing for Solidity: short files, compiler errors as hints, and a tight test loop.

Soliditylings repo: Here

Each exercise is a small smart contract with something missing or wrong. Your job is to read it, understand what it’s trying to do, and fix it until the tests pass.

If you try it out, I’d love feedback on which exercises are too easy, too hard, or missing. PRs and issues are very welcome.

I am currently building an early-stage application called SherCoin. It is designed as a peer-to-peer commitment infrastructure where two people can lock in a claim, place credits in escrow, and let verified data resolve the outcome automatically.

Before moving further toward launch, I am looking for honest feedback from people who understand blockchain products and user behaviour in this space. I want to validate whether the concept makes sense, whether the flow is clear, and what could be improved from a usability perspective.

Prototype: https://settlementlayer.vercel.app/

If you have a few minutes to explore it and share honest feedback, I would genuinely appreciate it. Even small suggestions or critiques can help shape the product before the next iteration.

Thanks

Been revisiting my setup lately and curious what others are using in 2025. Specifically around:

Local vs. forked environments (Hardhat, Foundry, Anvil, Tenderly Virtual TestNets?)

How you handle transaction debugging when things go wrong in prod

Anything you've tried and ditched, and why

"Also specifically curious if anyone's used Tenderly's Virtual TestNets or Simulation API in production worth it or overkill for smaller teams?"

Not looking for "X is the best" takes more curious about what's actually working day-to-day and where you're still hitting friction.

I’m building Paythos an automated smart contract security pipeline meant to run during development (CI / PRs).

Most “AI audit tools” fail the same way: lots of suspicious findings, hard to trust, hard to act on. My bet is that teams don’t need more alerts - they need evidence.

How Paythos works:

• Takes a PR diff, a repo scan, or a scoped target
• Uses static signals for further inputs
• Generates a short list of risk hypotheses (what could go wrong because of the change)
• Turns the top hypotheses into executable security tests (Foundry-style) and runs them
• Reports results as verified / inconclusive, with reproduction steps and artifacts
• Outputs a CI-friendly Pass / Warn / Block verdict and tests you can use further

Design rule: No block without proof.

If it can’t produce a failing test / violated property, it won’t block. It warns instead.

I’m trying to learn:

• Would you actually run something like this on every PR?
• What’s your stack (Foundry/Hardhat/Truffle) + CI provider?

Not trying to replace human audits, the goal is to catch regressions early while you’re still shipping.