Co-founder @QuillAudits_AI | 7+ yrs, 1400+ clients secured | Building AI Adversaries @QuillAI_Network

🇦🇪🇺🇸
Joined April 2014
This. Spent years obsessing over metrics, outcomes, recognition. Burnout. Disappointment. Frustration. Switched to: Did I do my best work today? Everything changed. You can't control the market. You can't control timing. You can't control luck. But effort? That's 100% yours. Control what you can. Let go of the rest. The dichotomy of control: 1.) Outcomes depend on a thousand variables you don't control. 2.) Effort depends on one variable you do. Anxiety lives in trying to control what you can't. Peace lives in mastering what you can. Simple. Not easy.
you can't control outcomes. only effort. so control that completely.
13
Learn the hard truths: • Most exploits come from simple mistakes, not necessarily complex math. • Knowing the tech doesn't mean you can find vulnerabilities. • Reading code ≠ understanding attack vectors. • Certifications ≠ expertise The people securing billions didn't just learn the tools. They learned to think like attackers. Study exploits, not just code. Learn offense, not just defense. Never stop sharpening both edges.
2
1
19
Preetam | QuillAudits🥷🏄 retweeted
🎉🎉QuillAudits vCISO: Your Security Leader in Web3 In Web3, every decision carries security implications—tokenomics, governance, integrations. Yet most teams only engage security after building. No more. vCISO changes that. Presenting vCISO (Virtual Chief Information Security Officer), designed to embed resilience into your protocol from day one. Led by senior security researchers with 100+ audits, $3B+ assets secured, and real-world experience safeguarding protocols at scale. How It Works: We provide strategic security tailored to your roadmap: 1⃣ Security Strategy & Architecture Review aligned with your product roadmap. 2⃣ Threat Modeling & Incident Readiness that doesn't wait for an incident. 3⃣ Continuous Advisory Across Ecosystems (EVM, Solana, Cosmos, Move) as you ship new features. No more waiting until audit time. No more reactive patching. Access senior expertise without the cost of a full-time hire. vCISO is for teams building to last. Why it matters: Every integration, governance change, and token design carries security implications. vCISO ensures you're not discovering vulnerabilities after launch, you're preventing them during build. Secure your foundation, not just your code. Built for protocol teams who want to ship fast, stay secure, and scale with confidence. 😎 Sign-up below. 👇
Every protocol you audit teaches you something. Every exploit you analyze makes you better. Every "impossible" bug you find expands your thinking.
1
9
Learn Solidity's edge cases. Learn how storage slots actually work. Learn re-entrancy beyond the textbook example. Learn oracle manipulation vectors. Learn cross-chain bridge vulnerabilities. Learn how attackers think. Learn zk circuits. Learn how DeFAI changes threat models. Learn to read code deeply. Learn to write clearly. Learn to spot patterns. Learn to explain complexity simply. Learn technical skills. Learn business realities. Reading documentation isn't learning security. Finding vulnerabilities is. The best auditors master both sides: technical depth + human communication. Keep learning. But learn by doing.
7
Preetam | QuillAudits🥷🏄 retweeted
On November 4, 2025, a major controversy erupted in the community following a $93 million loss tied to Stream Finance's xUSD stablecoin depeg and insolvency. The issue centered on permissionless vaults on Morpho Labs and Euler Finance, where third-party curators had allocated user deposits (primarily USDC) into high-risk strategies involving looped minting of xUSD. This created artificial high yields (up to 18% APY) but left lenders exposed when xUSD's value crashed due to flawed pricing that hardcoded it above $1, preventing timely liquidations. The ripple effects hit lending platforms like Morpho Labs and Euler Finance hardest. These protocols enable "permissionless vaults", user-created, isolated lending markets where third-party "curators" (risk managers) allocate deposited funds (e.g., USDC) to borrowers for yields. xUSD was heavily used in leverage loops across these vaults, promising inflated APYs (up to 18%, vs. ~4-5% market rates) through recursive borrowing/minting. However, the hardcoded price on affected platforms pegged xUSD above $1, blocking automatic liquidations even as its real market value tanked. Borrowers drained USDC collateral, leaving lenders with ~$756 million in "stuck" bad debt (worthless xUSD). Total collateral damage estimates range from $285 million to over $700 million across integrated platforms like Beefy Finance and Silo. Morpho had relatively low direct exposure (~$68M in a private, non-whitelisted Plume market + $628K in a public Arbitrum vault), with ~319 other vaults untouched due to isolation design. Euler saw heavier hits but none in its own curated vaults, mostly third-party ones. Users via frontends like Beefy were blindsided, as curators repackaged deposits into xUSD without clear disclosures. What Exactly Happened? 1⃣ Stream Finance's xUSD (meant as a yield-bearing stable) used recursive minting loops across Euler/Morpho/Silo vaults, inflating supply without real backing. 2⃣ A depeg exposed this; oracles failed to reflect < $1 price, blocking liquidations. Borrowers drained ~$93M USDC, leaving lenders with worthless xUSD. Curators like MEV Capital chased TVL/fees, ignoring red flags. 3⃣ Lenders in affected vaults (e.g., USDC → xUSD strategies) face bad debt. Indirect hits via rehypothecation (e.g., to scUSD on Mithras). No full recoveries yet; Stream insolvent. Morpho/Euler's design prevented cascade (isolated markets).
Get your money out of @MorphoLabs and @eulerfinance! Here's why. They take your USDC and give it out to insolvent protocols that leverage loop scam stables like xUSD by Stream Defi which just lost $93M of user money. The incentives are totally misaligned. Curators on Morpho and Euler want higher TVL, yields, and performance fees. They don't care about user security as they plug your money into literal ponzies. That's because users take on all the risks. Curators take the fees and Morpho + Euler brag about increasing TVL. It gets worst. Because the xUSD oracle price on such platforms was hardcoded to > $1, it ignored secondary market price movements when xUSD crashed. Why is this bad? Instead of selling xUSD to protect lenders of USDC into such pools, nothing happened. The hardcoded price prevented liquidations that would have protected USDC lenders. Since the protocol still believes xUSD is valued at $1 or above, anyone that provided USDC into such pools are stuck with bad debt, aka worthless xUSD, while the USDC was drained out. In other words, they took the USDC and lenders were left holding a big bag of nothing. The scam is now exposed. Those that took out the USDC have no reasons to pay back their debt since the collateral they posted (xUSD) was worth zero in reality. Stream Defi also paused withdrawals since the crash = insolvent. Why would anyone give up their USDC in the first place? Because they were promised up to 18% APY on USDC. That's 4x more than the going rate today. The APY was fake and created by leverage loops. They took your USDC, looped it 9 times to generate more xUSD and that extra "APY". Since more and more xUSD was created from thin air, its actual backing was lower than $1, despite what the oracle price said. Those late to exit, got rugged. Why is this bad? Because everyone from Morpho, Euler, and their curators knew what was happening. Yet, they kept this going until it imploded. They had no incentive to stop it. Morpho and Euler will argue they only provide a platform for curators and users to meet. After that, their job is done and have no responsibility. Really? I'd argue they enable and promote literal scams. The curator model is broken because it allows bad actors to profit from any reputation such DeFi platforms have. It was just a matter of time until it got bad. Like, share, and follow @DU09BTC
5
15
The hardest part wasn't surviving the bear market. It was watching competitors raise millions and wondering if we were the idiots for staying lean. Turns out the 'disadvantage' of limited capital forced us to build sustainably. They optimized for speed. We optimized for survival. Different games. The boring path won. This is YOUR story. You're the case study.
2
11
Preetam | QuillAudits🥷🏄 retweeted
Every transaction starts with intent, But intent means nothing without proof🕵 Our demo is live, here's how WachAI verifies agentic jobs on x402, validating outcomes through Mandates and recording feedback on ERC-8004’s Validation Registry. Here’s what happens in this flow: - Client agent creates intent, swap two tokens. - Server agent issues a Mandate, deliverables, deadlines. - Both countersign, proof replaces trust. - Swap executes autonomously. - WachAI validates and records the score on ERC-8004. WachAI is defining the verification layer for x402, no time to hold back!🦅
"Do things that don't pay off immediately" is the only way to build anything that lasts. Free work isn't exploitation when it's strategic investment in yourself. Early days of Web3 security, nobody knew who we were. No reputation. No network. We audited 10 protocols for free before anyone paid us. Each one: • Made us better. • Built portfolio. • Created relationships. • Proved capability. Then the clients came to us. The grind you don't see creates the opportunities you do. The formula works in any emerging space. Find the frontier. Do the work nobody else will. Repeat for 2+ years. Everyone wants the network effects. Nobody wants to talk about the sacrifices.
story time TLDR: lessons on doing things that others will not, and playing long term games. early in my career when I was looking to make a name for myself, I was continuously on the lookout for new opportunities. namely I was always trying new technologies that I could get in early on and make a name for myself, and hopefully ride the wave of upward trajectory that often comes when you're early to something big. for me, react native ended up being that first technology (and since then, there have been countless more that I've seen others capitalize on, and have also capitalized on) me and my manager asked our company to let us build our new mobile app with React Native when it was only a month or two old at the time (School Status) we were so early that most answers for our problems did not exist, and we had to figure them out ourselves, so I learned a lot and also spent most of my free time experimenting with edge cases and just building with it because I wanted to know... well I wanted to know everything about React Native. back then I had heard that people used stack overflow for recruiting, hiring, etc.. but never had the chance to really stand out there, because most of the questions coming through were not my expertise. but I realized that stack overflow had a decent number of questions coming on on react native, questions that I was able to answer. I started keeping a tab open on my computer, checking it every hour. I began relentlessly watching for new questions and giving answers to things I knew. .... but also answering questions i did not know, keeping an open React Native app instance and reproducing all of the errors and issues I was seeing there to fix them and provide answers. I quickly started racking up points there and became #1 of the month, of the year, and finally of all time. I'm still #1 of all time there, by a lot. around that time I started becoming active on social media, talking about React Native and trying to frame myself as an expert. even though I didn't feel like an expert at the time, I probably was (compared to most people) I decided to start a podcast. but I barely had any followers or network at the time, so I knew it would be hard to get any distribution. I decided to attend a React Native conference, which even though me and my family were not able to afford much things like vacations at the time, I knew it would be a great opportunity for a handful of reasons so I paid for myself to go and I went. one of the reasons I wanted to go was that the founder of the #1 (or top 5 at least) at the time podcasts, JavaScript Jabber, was going to be there, and I wanted to pitch him an idea. I told him that I would create a React Native podcast. I would do all of the work. I would do management, recording, production, deal with guests, everything. and I'd hand over the finished episodes, and he could launch them on his network and charge whatever he's like for advertising. this was a no brainer for him, especially if I delivered. and I did. well actually WE did, as it was a team effort. we ran this podcast for a number of years, and I had help from some amazing cohosts. it's still going strong, now managed by @infinite_red - @ReactNativeRdio at some point during this time I also started creating open source, including React Native Elements which quickly became the #1 UI kit in the React Native ecosystem and held that spot for a number of years. x.com/dabit3/status/77425216… during this time I traveled to many conferences, doing some speaking, and almost always paying my own way. growing my network and presence along the way. at some point during all of this, opportunities started rolling in and momentum never really stopped. consulting opportunities, book deals, job offers, and other random things like more speaking engagements. almost all of the things listed above that I did to get to that point, I did for free, with no expectation of immediate payment. but with the understanding that sometimes you have to do things that don't pay off immediately. but over time they do pay off. and they did pay off. I've left out a lot of things, mainly that no one is self made and that I was fortunate to have incredible friends, coworkers, bosses, mentors, and help along the way. but that's the end of the story. I think people sometimes think they should wait for the perfect opportunity to come to them. and that things will be just given to them, or handed over, because they came from a certain school, background, or maybe they think they deserve it for some reason (and later in your career you can indeed demand this in many circumstances) but in reality, you're competing with the entire world. especially today where we are all connected. literally everyone in the world is capable of accomplishing almost anything digitally. so you have to go out and take action, do things, and realize that sometimes you sacrifice a little up front for a huge payoff in the back.
2
1
13
Met a protocol team who made a mistake this week. Their new auditor told them their code was "probably fine" because automated tools found nothing. Manual review found a critical access control bug that could've cost them at least $5M in user-locked assets. "Probably fine" isn't a security posture. Tools find patterns. Humans find logic flaws. Never skip the boring work.
1
1
18
Preetam | QuillAudits🥷🏄 retweeted
Yes You thoughts are reflection of your enviornment , no matter how strong you internally are
Replying to @Akshat_World
All of this, plus one addition: #18: Surround yourself with people better than you. You can do everything on this list and plateau if you're the smartest person in every room. Top 1% isn't achieved alone. It's achieved by: • Learning from people ahead of you. • Being pushed by people around you. • Teaching people behind you Skill + Focus + Right Environment = Inevitable.
1
1
1
The playbook from this story: 1.) Find emerging tech early (React Native at 2 months old). 2.) Become #1 resource where questions exist (Stack Overflow). 3.) Create distribution channel (podcast with established network). 4.) Build in public (open source = proof of work). 5.) Show up physically (conferences, even self-funded). 6.) Keep doing unpaid work that compounds. Provide so much value for free that paid opportunities become inevitable. Stealing this framework.
story time TLDR: lessons on doing things that others will not, and playing long term games. early in my career when I was looking to make a name for myself, I was continuously on the lookout for new opportunities. namely I was always trying new technologies that I could get in early on and make a name for myself, and hopefully ride the wave of upward trajectory that often comes when you're early to something big. for me, react native ended up being that first technology (and since then, there have been countless more that I've seen others capitalize on, and have also capitalized on) me and my manager asked our company to let us build our new mobile app with React Native when it was only a month or two old at the time (School Status) we were so early that most answers for our problems did not exist, and we had to figure them out ourselves, so I learned a lot and also spent most of my free time experimenting with edge cases and just building with it because I wanted to know... well I wanted to know everything about React Native. back then I had heard that people used stack overflow for recruiting, hiring, etc.. but never had the chance to really stand out there, because most of the questions coming through were not my expertise. but I realized that stack overflow had a decent number of questions coming on on react native, questions that I was able to answer. I started keeping a tab open on my computer, checking it every hour. I began relentlessly watching for new questions and giving answers to things I knew. .... but also answering questions i did not know, keeping an open React Native app instance and reproducing all of the errors and issues I was seeing there to fix them and provide answers. I quickly started racking up points there and became #1 of the month, of the year, and finally of all time. I'm still #1 of all time there, by a lot. around that time I started becoming active on social media, talking about React Native and trying to frame myself as an expert. even though I didn't feel like an expert at the time, I probably was (compared to most people) I decided to start a podcast. but I barely had any followers or network at the time, so I knew it would be hard to get any distribution. I decided to attend a React Native conference, which even though me and my family were not able to afford much things like vacations at the time, I knew it would be a great opportunity for a handful of reasons so I paid for myself to go and I went. one of the reasons I wanted to go was that the founder of the #1 (or top 5 at least) at the time podcasts, JavaScript Jabber, was going to be there, and I wanted to pitch him an idea. I told him that I would create a React Native podcast. I would do all of the work. I would do management, recording, production, deal with guests, everything. and I'd hand over the finished episodes, and he could launch them on his network and charge whatever he's like for advertising. this was a no brainer for him, especially if I delivered. and I did. well actually WE did, as it was a team effort. we ran this podcast for a number of years, and I had help from some amazing cohosts. it's still going strong, now managed by @infinite_red - @ReactNativeRdio at some point during this time I also started creating open source, including React Native Elements which quickly became the #1 UI kit in the React Native ecosystem and held that spot for a number of years. x.com/dabit3/status/77425216… during this time I traveled to many conferences, doing some speaking, and almost always paying my own way. growing my network and presence along the way. at some point during all of this, opportunities started rolling in and momentum never really stopped. consulting opportunities, book deals, job offers, and other random things like more speaking engagements. almost all of the things listed above that I did to get to that point, I did for free, with no expectation of immediate payment. but with the understanding that sometimes you have to do things that don't pay off immediately. but over time they do pay off. and they did pay off. I've left out a lot of things, mainly that no one is self made and that I was fortunate to have incredible friends, coworkers, bosses, mentors, and help along the way. but that's the end of the story. I think people sometimes think they should wait for the perfect opportunity to come to them. and that things will be just given to them, or handed over, because they came from a certain school, background, or maybe they think they deserve it for some reason (and later in your career you can indeed demand this in many circumstances) but in reality, you're competing with the entire world. especially today where we are all connected. literally everyone in the world is capable of accomplishing almost anything digitally. so you have to go out and take action, do things, and realize that sometimes you sacrifice a little up front for a huge payoff in the back.
1
9
Preetam | QuillAudits🥷🏄 retweeted
Another day, another Moonwell exploit. 4th major incident in 3 years. . @MoonwellDeFi, a Compound Finance v2 fork (with features like borrow/supply caps, cross-chain governance, and multi-token emissions), and a decentralized lending and borrowing protocol deployed on @base and @Optimism, has lost ~292 ETH (~$1.01M) in a price manipulation exploit earlier today. The exploit targeted Moonwell's lending contracts, specifically involving wrapped restaked ETH (wrstETH and wstETH) markets. Here's what our preliminary investigation found: An off-chain oracle caused an asset price fluctuation, that resulted the attacker to borrow 20 mwstETH. (basescan.org/address/0x627fe…) against 0.0000207 wrstETH via a flash loan from the CLpool. (basescan.org/address/0xedfa2…) Flash Loan TX (Base): (basescan.org/address/0x14dcc…) 1.) This minuscule amount was deposited as collateral into Moonwell. 2.) Due to the oracle malfunction, the protocol valued this tiny collateral at millions of dollars. 3.) The attacker borrowed over 20 mwstETH per transaction against the artificially inflated collateral. 4.) Borrowed assets were liquidated or swapped for profit. 5.) The initial flash loan was repaid within the same block, avoiding liquidation. 6.) This cycle was executed repeatedly to drain 292-295 ETH. A Pattern: 1.) Oct 10, 2025: $1.7M oracle/DEX security incident. 2.) Nov 4, 2025: $1.01M oracle exploit (today). 24 days apart. 3.) Dec 2024: $320K flash loan exploit. 4.) 2022: Nomad bridge exposure lead to a bad debt scenario. Total: 4 exploits, $2.7M+ lost in 2 months alone. interestingly, Moonwell removed its bug bounty on @immunefi earlier this year in Feb, 2025, just months before suffering two major exploits. The Moonwell (#WELL) fell 13.48% over the last 24h, underperforming the broader crypto market (-3.95%), and currently holds a TVL of $137,236,306. If you're a lender/borrower on Moonwell, verify your collateral via the app. Revoke unnecessary approvals using @RevokeCash.
Preetam | QuillAudits🥷🏄 retweeted
The new WachAI site is live. The agent economy is forming around x402, a trustless payment standard. while ERC-8004 defines how those agents prove execution. WachAI connects the two, enforcing proof before payment across the agent economy. Making x402 truly trustless, Validating every agent on ERC-8004 Not a redesign. A recalibration, check now: wach.ai
The next wave of Web3 won't be won by the fastest builders. It'll be won by the most secure ones. Every headline hack sets the industry back 6 months of institutional trust. Every protocol that launches without exploits builds credibility for the entire ecosystem.
5
Preetam | QuillAudits🥷🏄 retweeted
Replying to @impranavm_
Their affected vault was last "publicly" audited in 2021 and others were audited in 2023 latest. We're in Q42025.
:( I have nothing to say.
1
1
2
Add a 4th that's quietly massive: Risk mitigation services. • Security audits • Insurance protocols • Compliance infrastructure • Monitoring/analytics Not as sexy as the other three. But every protocol doing #1, #2, or #3 needs this to survive. Revenue scales with the industry, not just individual protocol success. Volume scales with usage, not just price. Also, infrastructure that captures value from all three. Oracle networks, cross-chain bridges, custody solutions. Asset issuance needs them. AUM needs them. Volume needs them.
3 business models that work in crypto: * asset issuance * assets under management * volume
5
Preetam | QuillAudits🥷🏄 retweeted
Polymarket Resolved with $100M+ Exploit due to this Attack! . @Balancer, a prominent decentralized exchange (DEX) and automated market maker (AMM) protocol in the DeFi ecosystem, suffered a major exploit for $128M primarily from ETH main net pools, targeting its V2 liquidity pools earlier today. When the attacker deployed their contract they ran a series of Balancer batch swaps that altered the contract’s internalBalance, then simply pulled the tokens out using manageUserBalance. Because internalBalance was updated during deployment and the withdrawal function isn’t pausable, there was nothing to stop the exploit from continuing. This is the third significant security incident for Balancer since its launch in 2020. Here's everything we uncovered during our on-going preliminary analysis: Exploit occurred across 7+ chains including: • Ethereum mainnet (Balancer), • Sonic (e.g., Beets on Sonic), • Polygon (Balancer), • Berachain, • Arbitrum (Balancer), • Base (Balancer), • Optimism (Beethoven) Berachain validators paused their network for an emergency hard fork to patch Balancer-related exploits in their BEX (Berachain Exchange). x.com/SmokeyTheBera/status/1… Attack TX (ETH): etherscan.io/tx/0x6ed07db1a9… Withdraw TX (ETH): etherscan.io/tx/0xd155207261… The Balancer team urged the attacker the return funds in exchange of a successful 20% bounty by sending an on-chain message with a deadline of the next 48-hours to comply with the bounty term. TX (ETH): etherscan.io/tx/0x97d4d33a51… There are 27 forks of Balance v2, while 2 forks of Balancer v3, according to @DefiLlama. As a result of the exploit, the #BAL token fell ~7% and the crypto fear/greed index sits at 36 (“Fear”), while Bitcoin dominance rose to 59.68%. As a precautionary measure, @VenusProtocol paused #BAL borrowing on ETH (LTV set to 0%). x.com/VenusProtocol/status/1… Users in any Balancer-derived pools were urged to withdraw immediately. Revoke approvals via tools like Revoke.cash. Recovery odds are moderate due to derivative controls, but full retrieval is uncertain. Balancer's team is prioritizing forensics, and a post-mortem is expected soon. The Balance v2 hack today is the largest protocol hack in 2025, and the largest hack is of Bybit CEX on 21st February, 2025. As a result of the attack, a @Polymarket created whether the industry will see a $100M+ exploit by the 31st of December, 2025 or not, just resolved with "Yes". x.com/QuillAudits_AI/status/… This is a developing story; DeFi users, prioritize security.
We’re aware of a potential exploit impacting Balancer v2 pools. Our engineering and security teams are investigating with high priority. We’ll share verified updates and next steps as soon as we have more information.