Ares 0.2.0 is released 🎉 We went from an average runtime of 1 second to 0.98 milliseconds.

How did we do this?

The first thing we did is to exit early when we reach a happy path.

Previously in a decoder if we need to decode 1000 times but find the plainext on iteration 3, we will continue to do all 1k times.

Now we exit early if we find it!

Secondly, if we find the plaintext previously all other threads running decoders had to finish first.

Now the threads are killed and we exit early from all threads to get back to the user sooner!

Finally, our biggest speedup. We created a flamegraph and found that Regex was taking up the majority of our time.

This was because everytime we checked if some text matched Regex we would recreate the regex.

Putting it into a Once Cell means the regex are only loaded once at run time. This saved **a lot** of time

New flamegraph:


You can read the unrolled version of this thread here: https://typefully.com/bee_sec_san/2XOcZU8

One of the secrets that could 10x your gains is learning how to win the gas wars and set your own gas.

Let's look into this 🧵

gas war https://twitter.com/Zeneca_33/status/1507938383070478337?s=20&t=6VI8I0S0JgyMpZ__dhi4uw

Everytime you transact on the Ethereum network, your transaction is executed by a node.

Gas is the fee you pay those nodes to execute your transactions.

You can make those nodes run your transaction faster by paying them more, let's learn how!

By making nodes run faster our transaction faster, we can front-run other people.

100 people minting an NFT project? Get there first by increasing gas.

Want to move your assets fast? Set higher gas. Sick of waiting around for transactions to confirm? Set higher gas.

Gas is measured in Gwei, 1 Gwei = 0.000000001 ETH.

To find what gas price to use, go to this site:
https://www.blocknative.com/gas-estimator
And choose the fee on the far left.

In Metamask firstly enable Advanced Gas Control in the settings.


Then when performing a transaction, click the "edit" button. You can now modify gas!

Set the max priority fee to what we found out earlier (2.0) and the max fee too (64). If this number is below what Metamask suggests, feel free to just add it to the fee.

Back in February of 2022, Opensea was hacked.

The solution? "revoke access".

Many people used fake revoking sites and got pwned even harder.

Let me show you how to revoke access without getting hacked in the process 👻

It's not as simple as "google revoke access and click the first link"

Not too long ago fake revoking sites popped up, pushing users to revoke access. But, when you used the website linked it would hack you and steal your assets 🤯

https://twitter.com/bee_sec_san/status/1512399889103171584?s=20&t=PPhPLQYig6faxW7-GYWX6Q

❓ Did you know your wallet likely already supports revoking access? And it doesn't cost gas like the other options!

You should always use your wallet first before an external website‼

Here is how to do it on Metamask:
https://twitter.com/bee_sec_san/status/1509153559048179717?s=20&t=PPhPLQYig6faxW7-GYWX6Q


For @argentHQ you'll want to:
1. Go to your accounts screen
2. Click "settings" and then "connected DAPPs"
3. Disconnect from the DAPPs!

As you can see, I rarely do this 😅 But ideally you'd have a spring cleaning every month or so!

If your wallet does not support DAPP permission revoking, then use Etherscan:
1. Go here https://etherscan.io/tokenapprovalchecker
2. Connect your wallet
3. DIsconnect from all sites

Do not use third party sites like revoke.cash before trying your wallet / Etherscan!

Finally, if all else fails and:
1. Your wallet does not support revoking permissions
2. Etherscan does not support your wallet

Then you can use a site like revoke.cash.

Make sure it's a legit site, revoking a smart contract is a smart contract!

Revoking DAPP Access

⚠ As I predicted there's a new scam that plays off your fear in order to steal your NFTs and other assets.

Here is how it works, how to prevent it and how to spot it 🕵️‍♀️

User posts about a proposed Opensea hack claiming they lost an expensive NFT. They then beg you to revoke access

The site is a phishing site pretending to be the real revoke access site, but instead, once you sign it they'll steal your assets.

You can see this site is likely a scam by going to archive.org and seeing its history. 

The site was once archived back in 2018, but never again since then.

If it was the real popular site, it'd be archived a lot more (see right picture)

⭕ You should only disconnect from sites using your wallet, Etherscan or sites you can confirm are legit.

https://twitter.com/bee_sec_san/status/1509153559048179717


Your seed phrase is the most important part of your crypto security.

But, I bet you haven't thought much about it other than "write it down".

Here is the essential information you need to secure your assets properly 🔐

Your seed phrase is a key that allows you to access your wallet. You can use Metamask, Rainbow, or any other wallet so long as you have the key.

Imagine a magical key that no matter what door you open, it opens the door to your home.

Metamask uses 12-word phrases, Ledgers use 24.

When a machine connects the words together and decodes them, it turns into a series of characters (see pic)

These characters are your key. The word-encoding we all know & love is just human-friendliness!

The longer your seed phrase is, the more secure it is. Therefore if you get to choose, choose the absolute longest seed phrase you can!


Don't worry if this makes it too long, you only need the first 4 characters of each word!

The wordlist has been selected to specifically allow this.

If your seed is "stomach pelican..." you only need to write down "stom peli"

https://www.youtube.com/watch?v=bSgQBRuHpF8


Your private key is _private_. That means no one should know it!

Ideally, you never make it on a computer or store it digitally. Hardware wallets let you make them off-computer.

This is because your computer might already be hacked and you don't know it 👻


You should also never speak the phrase, and never let it go near any cameras.... Basically, it should be created on a device (hardware wallet or otherwise) and never go near any device ever again!

Just in case your PC is hacked and listening, or your phone's camera etc.

So far, your seed phrase is written on a bit of paper in a location in your house.

What if someone breaks in? They'll only need to find 1 bit of paper to compromise you!

What if there was a way to distribute our seed phrase 🤔

Say you have a 24-word seed, split it into 3 horcruxes of 8 (x, y, z) Then write down:
* X + Y
* Y + Z
* X + Z

Now you need 2/3 horcruxes to get your seed phrase, and your seed is no longer a single point of failure!

No wonder Voldemort thought this was a good idea! 🤔

So far we have written our seed on paper, but what if there's a fire? a flood? What if we spill water? The paper will be destroyed!

We need to use a seed storage solution that is fireproof & waterproof. 

@lopp reviewed a bunch here https://jlopp.github.io/metal-bitcoin-storage-reviews/

I personally use a Cryptosteel Capsule. No particular reason. It's water proof and fireproof, and ships from Ledger which is faster shipping for me than some of the alternatives!

https://shop.ledger.com/products/cryptosteel-capsule-solo


Now, what if someone abducts us and forces us to give them our seed locations? Then they have everything!

We can use some DIY social recovery and give 2/3 horcruxes to friends or family. We can even split our seed up into more horcruxes to stop collaboration between them!

What if you lose your seed container and can't find it? I've done this exact thing 💀💀

I use an Airtag by Apple to track it so I never lose it, I always know where it is!

https://www.apple.com/uk/airtag/


⚠ A HACKER CAN BRUTEFORCE YOUR SEED PHRASE 

in 1 × 10^53 years times the age of the universe

TL;DR - Don't worry about it!

More reading:

My blog post on public-key crypto (which powers cryptocurrencies!)
https://skerritt.blog/how-does-public-key-cryptography-work/

Seed phrase spec: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

deterministic wallets: https://river.com/learn/terms/b/bip-32/

One seed phrase for all accounts in a wallet: https://medium.com/mycrypto/wtf-is-a-derivation-path-c3493ca2eb52

You can read the unrolled version of this thread here: https://typefully.com/bee_sec_san/oLNDeu7

Seed Phrase Security 101

99% of people lost their crypto/NFTs via a phishing attack. They are fooled into clicking a link or signing a transaction.

Let me show you an easy, step-by-step guide to work out if it's a phishing attack in under 5 minutes.

This thread will save you 💰💰💰

is it too good to be true?

Blue checkmark offers 0.33 ETH for free. That's a lot of money. Even though $APE coin is real, it's a bit too good that they'd give us 0.33 eth for free.

🚨 Alarm bells go off, before getting this airdrop, let's check it out.

is it pressuring you to do it right now?

The website uses words like "now" or "once we hit a certain target, we'll move to the next step..."

Pressuring you into doing it **right now** instead of waiting. 

🚨 More alarm bells, but let's investigate further in case it's true.

Google it and add "scam".

Here we google "Ape coin scam" and see there are loads of news articles about scams.

🚨 If we read these, we find the website we were on is a scam.

Always Google it and investigate.

Now, let's go onto Discord and ask our friends if it's a scam.

We've spent 5 minutes researching this and have found out it is most definitely a scam.

Before connecting your wallet to anything, run through these 4 steps:
* Is it too good to be true?
* Does it want you to do it right now?
* Are there news articles about it being a scam?
* Are your friends warning you that it's a scam?


Let's do some more advanced tips.

Never click links directly in servers or Twitter. Always go to the official website and click around.

Can't find a direct link on the site? Possible scam.


WAIT. 

Every airdrop runs for at least a week, and sometimes months. Never pressure yourself into getting it **right now**

Wait a few days and see if it's a scam.

Don't be the fool that tries it first, finds out it's a scam and has to tell others it's a scam.

Crypto Phishing Protection 101

Buying a hardware wallet or using a smart contract wallet costs money, and not everyone has that!

Here's how to make Metamask super secure without spending a single penny.

Phishing attacks are the #1 reason why people lose their crypto.

A phishing attack tries to convince you to hand over your wallet by impersonating someone else (Opensea, Uniswap, ApeCoin)

Always ask yourself:
"Is this too good to be true?"

Free NFTs worth $20,000?
Free ApeCoin worth $10,000?

If you're unsure, Google it and add "scam" to it to find out if it is.

When in doubt, wait it out and google it.

Ask around and see if there are any hacks or scams you are not aware of. 

When in doubt, wait it out. Don't be the fool that instantly connects your wallet and tries it first.

Most real airdrops will happen over a month. Wait a week for others to try and see if they're safe.

If the website says "10 mins left" or pushes you to do it *now*, likely scam

NEVER give out your seed phrase or approve transactions that you don't know. 


Make sure the extension is legit.
* Does it have many downloads?
* Does it have a lot of reviews?
* Click on reviews and read them -- do they sound fake?

https://chrome.google.com/webstore/detail/metamask/nkbihfbeogaeaoehlefnkodbefgpgknn?hl=en

Only download the extension if you believe it's safe. There are many fake Metamasks out there!

In Metamask, click the 3-dots and then click "connected sites". Disconnect from them all every once in a while. 

This lets them view your public address and request transactions that you have to approve.

You might accidentally approve one!  Do this to prevent accidents.

Your seed phrase is your crypto. Lose it or give it out, and all your crypto is gone.

Write it down somewhere. I suggest BitWarden, a free password manager. This will encrypt your key and keep it safe for you.

DO NOT GIVE IT OUT.

https://bitwarden.com/


Metamask has a password function. To be honest this doesn't matter too much. Some wallets will use it as a 25th seed word.

Metamask just uses it to prevent other people on your computer from using Metamask.
https://ethereum.stackexchange.com/a/97652

Use a strong password and store it in Bitwarden

Metamask lets you make multiple accounts.

But, one seed phrase for all accounts. This is called a derivation path. Not all wallets work like this, however.

Keep in mind all the accounts you create use the same seed, unless you make a new seed.

https://medium.com/mycrypto/wtf-is-a-derivation-path-c3493ca2eb52


Make a 2nd burner account for minting or buying things.

1 account for long-term storage of assets, another account for minting NFTs or transacting on the blockchain.

If the minting is a hack (see Apecoin) it only affects your lesser account.  You won't lose everything this way!

Make sure that the minting / transacting account only has enough Ethereum to mint things or transfer them out.

Assume this account is already compromised and transfer out to your safer Metamask account.

Never use your safe account for minting or transacting on the blockchain. 

Make sure to keep your PC up-to-date. If your PC is compromised, so is your wallet!

Check for updates at least once a week!

Double-check every transaction you make. Carefully read what is happening. How much eth are you spending? What tokens are being exchanged?

Reading transactions is a horrible experience, but you will always know what you are doing if you read them!

"You only need to check a transaction if it costs gas"

Wrong! 

Some transactions can be gasless such as signing a transaction. In February of 2022 Opensea users were hacked because they signed transactions:
https://cryptobriefing.com/opensea-hack-key-takeaways-web3-security/

Always disconnect from sites and double-check!

Like this tweet? Follow me to learn more about wallet security.

I also have a Discord you can ask me questions on!
http://discord.skerritt.blog

You can read the unrolled version of this thread here: https://typefully.com/bee_sec_san/brX2SAQ

Making Metamask secure

Every crypto wallet sucks for general use. The user experience of crypto is the biggest thing stopping it from going mainstream, let's look at what the perfect wallet may look like.


Inspired by @simonvc and World of Warcraft, this is how trades should look. 

Firstly, you get a clear representation of who you're trading with using the ENS name + ENS avatar.

This prevents you from trading with someone impersonating someone else and getting scammed.


Instead of using contract addresses, we have an extension that looks up the contract address and converts it to a human-readable name.

If it's unknown, the address does not turn into anything. This helps prevent fraud.

@m1guelpf built a library for this

Secondly, we verify collections. No more will you buy NFTs from fake collections that look similar.

Notice how BAYC resolves to a name, but is not verified?

We can use Opensea's verification for this, but preferably we'd have an open smart contract for verifications.

This window shows you:
* Who you're trading with
* What you'll get
* In human readable names
* With verification to make sure you don't get scammed

No hard to read transactions here. Just human readable with a bit of fraud detection.

People may not understand verification, so if someone trades for an unverified collection we should warn them.

While it'll annoy the experts, it'll help prevent fraud. And it'll still let you buy things, it's just a giant warning to really help the least technological of us.

We can keep a list of the most popular contract addresses and allow seamless trades between them, so the fraud warning wont' come up.

We'll only alert if its not a known contract address.

A team that'll monitor the most used non-verified contract addresses 2 update the list.

We shouldn't have to manually verify transactions. What if our wallet does it for us?

We can store the hashes in QR codes and scan it to make them easy. 

We could even skip this using our trade window from earlier.
https://twitter.com/0xQuit/status/1506702998562435072

Social recovery wallets make sense. Seed phrase based wallets are not good for the average person.

Instead of using your seed phrase to recover, you use your friends or other wallets to recover.

https://vitalik.ca/general/2021/01/11/recovery.html



Let's take this one step further. If you interact with a non-popular smart contract, your friends will have to approve it.

This has 2 benefits:

1. If you get hacked and your wallet tries to transfer 10 Eth to Tornado.cash, your friends will think its a bit dodgy and ask you about it. Hackers can't hack you unless they social engineer your friends too.

If they deny it, we will then be alerted to it and our investigations team will see if its a popular scam. If it is, we can prevent all outbound transactions to that scam and save people.

See the $APECOIN scam
https://nftevening.com/nasty-phishing-hack-loses-enthusiastic-ape-coin-fans-over-75k/


2. Even though you are hacked and your wallet is compromised, you can recover it and send all of your Eth and NFTs to a wallet you do control.

Your friends will work with you to deny all transactions that aren't yours, and you can get your Eth out without the scammer getting it.

You'll need to trust your friends, but you can use other wallets you own instead or family. 

Since our app will be nice to non-tech people, it won't be too hard for them to learn to use.

I suggest holding majority of wallets by yourself, and having guardians on the side.

You could even text your group chat with "I've just been hacked" and your friends can elect to lock down your wallet.

Before lockdown: transactions to popular contracts is seamless and require no approval.
After: Every transaction requires approval

We can use multi-sig wallets like @gnosisSafe as joint accounts.

Example: Each user saves into Gnosis which deposits into @PoolTogether_ . By doing this, they increase their odds of winning.

By saving together they make more money together.

Let's implement this into an app. Open a joint account with your friends, your other half or your polycule. 

By saving & investing together, you can get bigger rewards.

if you pass how do you ensure your family gets access to your assets? 

With a social recovery wallet your family can come together to get assets. Hold majority of wallets in your house so they need to visit and find a hardware wallet to truly unlock it.
https://www.independent.co.uk/tech/bitcoin-exchange-quadrigacx-password-cryptocurrency-scam-a8763676.html


no more tech words, just normal words for everyday people. no acronyms.  Crypto needs a tone of voice document.
https://monzo.com/tone-of-voice/

We should have Defi apps built in, so we don't need to interact with websites & contracts hoping it's the right one and not a scam.

Crypto gives you a key and tells you "off your go, good luck surviving".

Banks hold your hand and protect you from scams.

We need both to go mainstream.

Liked this? Make sure to follow me on Twitter. I regularly write about wallet security, to help prevent getting hacked or scammed you should follow me 🥳

Want to talk to me? Join my Discord server http://discord.skerritt.blog :) 



You can read the unrolled version of this thread here: https://typefully.com/bee_sec_san/8Y6Uxaj