Dan Guido on Twitter: "How will we improve after this incident? 1st, we will no longer work with @HegicOptions. Their behavior has been deeply irresponsible. They ignored our advice and recklessly put user funds at risk. This hurts the entire DeFi community."

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Georgios Konstantopoulos

https://twitter.com/gakonst/status/1253987789219205121 …

Dan Guido added,

Georgios Konstantopoulos @gakonst

The bug: This `for` loop does _not_ loop over the provided arguments' array length, but over the storage variable's `options` length. This means that if you provide it with fewer elements than in the `options` array, it will always fail Fix: use the right bounds pic.twitter.com/F9xjMZaGGQ

Show this thread

2 replies 0 retweets 19 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

This is when the uproar began. There are some who mistakenly relied on a code review from @trailofbits as proof that @HegicOptions would never get hacked, without ever reading the report or investigating further. If they did their own investigation, what would they find?

1 reply 0 retweets 29 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

They would find that their code had no documentation, not even a README file. They wouldn't find a single test. They would find that our report concluded by warning more bugs exist, and that time allocated was insufficient.pic.twitter.com/v8JkRZXz1E

2 replies 1 retweet 37 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

They would find my numerous public statements (https://defiprime.com/defi-smart-contract-audits …) and client guidelines (https://github.com/trailofbits/publications/blob/master/reviews/citation_guidelines.pdf …) to distrust projects that solely rely on code audits as proof of safety. They would find that 3 days is an extremely short review.pic.twitter.com/sY6pDlNSEe

1 reply 1 retweet 39 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Dan Guido

They would find my thread from just last week, describing the holistic activities needed to secure a DeFi project.https://twitter.com/dguido/status/1251960692460093443 …

Dan Guido added,

Dan Guido @dguido

Replying to @tayvano_ @MyCrypto and 15 others

"Evaluate your code for known flaws and ensure the absence of them." Reentrancy is extraordinarily well-understood and many tools are able to catch it, including Slither and @CryticCI. https://github.com/crytic/slither#detectors …

1 reply 2 retweets 27 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted beta.mycrypto.com

... and they'd find the consensus opinion of the blockchain industry is to avoid misrepresenting security reviews as certifications of safety. https://twitter.com/zmanian/status/1254220509077598214 … https://twitter.com/rleshner/status/1254151232677003264 …https://twitter.com/MyCrypto/status/1254119736020881408 …

Dan Guido added,

beta.mycrypto.comVerified account @MyCrypto

Replying to @defiprime @dguido and 4 others

You're so close. > Developers use audits to prove its safe THIS IS THE PROBLEM WITH WHAT HEGIC DID. They have the full report + discussions with trailofbits. THE FACT THEY TOLD YOU IT WAS SAFE INDICATES THEY ARE DELUSIONAL OR MALICIOUS both which have the same outcome for YOU.

2 replies 0 retweets 24 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Rick Dudley (afdudley.eth)

This was obvious to anyone that had hired a security firm, or been on the receiving end of a security report before. https://twitter.com/MyCrypto/status/1254058121342803968 …https://twitter.com/AFDudley0/status/1254018557685325825 …

Dan Guido added,

Rick Dudley (afdudley.eth) @AFDudley0

Replying to @hitchcott @HegicOptions @ETHLDN

The summary itself is pretty grim. @trailofbits

1 reply 0 retweets 24 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Chris Hitchcott

It was more than just security experts who understood this about @HegicOptions. It was obvious that further work was needed to non-experts too. “It's OK we have no tests because the auditors will catch all the bugs” said no one ever https://twitter.com/BlockEnthusiast/status/1254132916675907584 …https://twitter.com/hitchcott/status/1253982497446166528 …

Dan Guido added,

Chris Hitchcott @hitchcott

Replying to @hitchcott @HegicOptions

Oh wait, you don't have a test suite...? https://github.com/hegic/hegic-contracts-v1 … Shame on all you #DeFI bros promoting this. @DegenSpartan @defiprime

1 reply 0 retweets 23 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Dr Heidy Khlaaf (هايدي خلاف)

We know there are roadblocks to interpreting our results by non-experts. For example, we purposefully avoid subjective opinions in our reports, preferring objective facts to maintain our integrity and independence.https://twitter.com/HeidyKhlaaf/status/1254121886902083584 …

Dan Guido added,

Dr Heidy Khlaaf (هايدي خلاف) @HeidyKhlaaf

Replying to @dguido @defiprime and 5 others

These criticism lack any realism in how auditing works. Working in Safety, where government auditors are also involved, independent auditors have their hand tied and can seldomly make "human readable" recommendations. We provide objective technical observations. That's it.

1 reply 0 retweets 21 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Jordan Spence

Further, it's possible for clients to simply ignore what we document in reports. @trailofbits does not have any authority over our clients, we simply provide them advice. https://twitter.com/HeidyKhlaaf/status/1254122500407152640 …https://twitter.com/spencecoin/status/1254116602720608258 …

Dan Guido added,

Jordan SpenceVerified account @spencecoin

Replying to @Rewkang @defiprime and 4 others

^^^^ THIS Security audits are an audit of the security. They are purely objective. They provided ALL the information and unfortunately can't control what happens after that information is given. Dan and trailofbits performed exactly as they should have.

1 reply 0 retweets 20 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

How will we improve after this incident? 1st, we will no longer work with @HegicOptions. Their behavior has been deeply irresponsible. They ignored our advice and recklessly put user funds at risk. This hurts the entire DeFi community.

9:07 PM - 25 Apr 2020