Dan Guido on Twitter: "2nd, we will keep services from @trailofbits accessible for those with lower or limited financial resources. Security assistance is essential for smaller projects, and we'll continue to help those that need it with shorter project sizes."

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

Report Tweet
Report NetzDG Violation

This is when the uproar began. There are some who mistakenly relied on a code review from @trailofbits as proof that @HegicOptions would never get hacked, without ever reading the report or investigating further. If they did their own investigation, what would they find?

1 reply 0 retweets 29 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

They would find that their code had no documentation, not even a README file. They wouldn't find a single test. They would find that our report concluded by warning more bugs exist, and that time allocated was insufficient.pic.twitter.com/v8JkRZXz1E

2 replies 1 retweet 37 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

They would find my numerous public statements (https://defiprime.com/defi-smart-contract-audits …) and client guidelines (https://github.com/trailofbits/publications/blob/master/reviews/citation_guidelines.pdf …) to distrust projects that solely rely on code audits as proof of safety. They would find that 3 days is an extremely short review.pic.twitter.com/sY6pDlNSEe

1 reply 1 retweet 39 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Dan Guido

They would find my thread from just last week, describing the holistic activities needed to secure a DeFi project.https://twitter.com/dguido/status/1251960692460093443 …

Dan Guido added,

Dan Guido @dguido

Replying to @tayvano_ @MyCrypto and 15 others

"Evaluate your code for known flaws and ensure the absence of them." Reentrancy is extraordinarily well-understood and many tools are able to catch it, including Slither and @CryticCI. https://github.com/crytic/slither#detectors …

1 reply 2 retweets 27 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted beta.mycrypto.com

... and they'd find the consensus opinion of the blockchain industry is to avoid misrepresenting security reviews as certifications of safety. https://twitter.com/zmanian/status/1254220509077598214 … https://twitter.com/rleshner/status/1254151232677003264 …https://twitter.com/MyCrypto/status/1254119736020881408 …

Dan Guido added,

beta.mycrypto.comVerified account @MyCrypto

Replying to @defiprime @dguido and 4 others

You're so close. > Developers use audits to prove its safe THIS IS THE PROBLEM WITH WHAT HEGIC DID. They have the full report + discussions with trailofbits. THE FACT THEY TOLD YOU IT WAS SAFE INDICATES THEY ARE DELUSIONAL OR MALICIOUS both which have the same outcome for YOU.

2 replies 0 retweets 24 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Rick Dudley (afdudley.eth)

This was obvious to anyone that had hired a security firm, or been on the receiving end of a security report before. https://twitter.com/MyCrypto/status/1254058121342803968 …https://twitter.com/AFDudley0/status/1254018557685325825 …

Dan Guido added,

Rick Dudley (afdudley.eth) @AFDudley0

Replying to @hitchcott @HegicOptions @ETHLDN

The summary itself is pretty grim. @trailofbits

1 reply 0 retweets 24 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Chris Hitchcott

It was more than just security experts who understood this about @HegicOptions. It was obvious that further work was needed to non-experts too. “It's OK we have no tests because the auditors will catch all the bugs” said no one ever https://twitter.com/BlockEnthusiast/status/1254132916675907584 …https://twitter.com/hitchcott/status/1253982497446166528 …

Dan Guido added,

Chris Hitchcott @hitchcott

Replying to @hitchcott @HegicOptions

Oh wait, you don't have a test suite...? https://github.com/hegic/hegic-contracts-v1 … Shame on all you #DeFI bros promoting this. @DegenSpartan @defiprime

1 reply 0 retweets 23 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Dr Heidy Khlaaf (هايدي خلاف)

We know there are roadblocks to interpreting our results by non-experts. For example, we purposefully avoid subjective opinions in our reports, preferring objective facts to maintain our integrity and independence.https://twitter.com/HeidyKhlaaf/status/1254121886902083584 …

Dan Guido added,

Dr Heidy Khlaaf (هايدي خلاف) @HeidyKhlaaf

Replying to @dguido @defiprime and 5 others

These criticism lack any realism in how auditing works. Working in Safety, where government auditors are also involved, independent auditors have their hand tied and can seldomly make "human readable" recommendations. We provide objective technical observations. That's it.

1 reply 0 retweets 21 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Jordan Spence

Further, it's possible for clients to simply ignore what we document in reports. @trailofbits does not have any authority over our clients, we simply provide them advice. https://twitter.com/HeidyKhlaaf/status/1254122500407152640 …https://twitter.com/spencecoin/status/1254116602720608258 …

Dan Guido added,

Jordan SpenceVerified account @spencecoin

Replying to @Rewkang @defiprime and 4 others

^^^^ THIS Security audits are an audit of the security. They are purely objective. They provided ALL the information and unfortunately can't control what happens after that information is given. Dan and trailofbits performed exactly as they should have.

1 reply 0 retweets 20 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

How will we improve after this incident? 1st, we will no longer work with @HegicOptions. Their behavior has been deeply irresponsible. They ignored our advice and recklessly put user funds at risk. This hurts the entire DeFi community.

2 replies 7 retweets 52 likes

Show this thread

Dan Guido‏ @dguido Apr 25

Report Tweet
Report NetzDG Violation

2nd, we will keep services from @trailofbits accessible for those with lower or limited financial resources. Security assistance is essential for smaller projects, and we'll continue to help those that need it with shorter project sizes.

9:07 PM - 25 Apr 2020

2 Retweets
48 Likes

3 replies 2 retweets 48 likes

1. Daniel Bilar‏ @daniel_bilar Apr 25
  
  Report Tweet
  
  Report NetzDG Violation
  Replying to @dguido @trailofbits
  
  Righteous
  
  1 like
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. Mad Martian‏ @MadMartian5 Apr 26
  
  Report Tweet
  
  Report NetzDG Violation
  Replying to @dguido @trailofbits
  
  Good to hear. have got you guys bookmarked for the future.
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

Tweets

Dan Guido

@dguido

Tweets

Loading seems to be taking a while.

false

Saved searches

Tweets

Dan Guido

@dguido

Tweets

Go to a person's profile

Saved searches

Promote this Tweet

Block

Tweet with a location

Your lists

Create a new list

Copy link to Tweet

Embed this Tweet

Embed this Video

Preview

Why you're seeing this ad

Log in to Twitter

Sign up for Twitter

Not on Twitter? Sign up, tune into the things you care about, and get updates as they happen.

Two-way (sending and receiving) short codes:

Confirmation

Welcome home!

Tweets not working for you?

Say a lot with a little

Spread the word

Join the conversation

Learn the latest

Get more of what you love

Find what's happening

Never miss a Moment

Loading seems to be taking a while.

Promoted Tweet

false