0xleastwood: Spearbit Lead Security Researcher talks Web3 Security and Smart Contract Auditing

[@erenb2004]

i love your content

[@andyli]

Awesome to hear :D

[@niloy9664]

Super Useful content. And I request you to make a separate video on Roadmap to Web3/Smart Contract Security ( I know you did, but we need the updated one) , I just switched from web2 security to Smart Contract security recently

[@andyli]

yeah I have been thinking of doing an updated roadmap

[@niloy9664]

@@andyli Bro do this please, I need it badly. Now I'm in confused stage, just doing Ethernaut Challenges after finishing Solidity from Patrick

[@jackgikandi5875]

Yes please make an updated video on this, and include its pros & cons whether it is its job market, its longevity even with the emergence of insane auditing tools and the inevitable AI integration into the auditing processes.

[@code46ash]

Andy's content is getting better and better, ⚡👏

[@andyli]

🫡

[@ldzoid]

Keep doing these, super useful!🔥

[@andyli]

Thanks! Will do!

[@HelloWorld-sy4yc]

Nice dude! Thanks!

[@andyli]

No problem!

[@aftabkhan2677]

Really loved the video. I have few questions. I am college dropout i was previously in web2 security did few training internship and I am very new to web3 Security but I still like the web2 aspects of social engineering how can I bring these 2 things together and get some leverage in web3 Security and also is getting a degree important for getting jobs or grow in web3.

[@andyli]

you could consider the infrastructure security side of web3 which is less developed compared to the app sec side

[@denshaotokohongkong]

Do you think AI will replace smart contract auditors' jobs? Can you make a video on this topic, please?

[@andyli]

Not right now. In the future I don't know

[@yourdailyblockchain]

Love the content thanks guys

[@andyli]

cheers

[@Brevis-il9bh]

Thanks for your efforts, Andy!

[@andyli]

No worries!

[@loserdavictor]

another banger🐧🐧

[@andyli]

🫡

[@exp7l741]

Very relevant blockchain auditor content!

[@andyli]

thanks!

[@techgreat5847]

SIR Do I need to learn Web3.js and Hardhat and libraries like this to become a Smart Contract Security Auditor or Just I need to learn Solidity ?. I knew solidity

[@techgreat5847]

Hope you understand what I am trying to ask

[@andyli]

Learn Solidity first, then learn a framework like hardhat etc

[@thomasmarques8040]

Banger over banger ! When Cmichel sir ?

[@andyli]

🤔

[@Rdyrdy1]

Andy, hello, have a question. Can c4rena ban you for a bad report?I am just looking at the contests now and all three of them are private. I know that there are contests that limited to specific participants and have special requirements. But, anyway, I have this kind a paranoia

[@andyli]

Not that i am aware of, if you are making an effort in your reports, even if they are judged as invalid you won't get banned. The private contests are for people who ranked high in previous contests.

[@Rdyrdy1]

@@andyli thank you for answer!:)

[@HelloWorld-sy4yc]

Idk, but i've seen him somewhere :D

[@andyli]

maybe TrustX video?

[@erenb2004]

probably C4 Showdown at Secureum TrustX 2022

[@andreafede3290]

Nice content, as always! Do you have any resources to point out to get into zk auditing?

[@andyli]

Jackson posts good zk content sjkelleyjr.medium.com/zk-snark-concepts-explained-like-youre-15-54755f87c6d1

[@MaximManylov]

Andy, are there any stories in your videos of how to apply to the Spearbit and what skills one needs to have to apply?

[@andyli]

Apply on the Spearbit website. You will need to do a technical assessment and interview

[@thinkingonyx847]

I reckon the thing that helps with the amount of bugs in web3 vs web2 is that the code is always in staging, fresh and fertile grounds for bugs :) Can you still do SpearBit while working at Sigma?

[@andyli]

can't do spearbit

[@thinkingonyx847]

@@andyli Is that standard for audit companies?

[@andyli]

@@thinkingonyx847 yep I believe so, Spearbit is equivalent to doing private audits, so there will be a conflict of interest. Bug bounties and audit contests are still ok to do though

[@nikitastupin]

Thanks!

[@andyli]

No problem!