Category: News

Dedaub is excited to sponsor ETHDenver once again! This year, we will showcase the Dedaub Security Suite‘s real-time monitoring capabilities. Our team is eager to discuss the latest Web3 vulnerabilities, audit best practices, and develop partnerships at ETHDenver 2025.

ETHDenver 2025 | Stop by Booth #513

Located near the Main Entrance | You Won’t Miss Us!

Visit us at Booth #513, just a few steps from the main entrance, where our team will gladly guide you through our advanced monitoring and alerting tools at ETHDenver 2025. Discover how they provide three lines of defense in a single monitoring solution to proactively identify rug pulls, anomalies, and protocol breaches before they escalate.

1st Line: Continuous Static Code Analysis

• Detect 0 days in newly deployed code
• Novel theorem-proving techniques introduced to reduce false positives

2nd Line: Custom Monitoring Agents using DedaubQL

• Fully customizable & highly expressive language for developing agents
• Detects anomalous conditions in your protocol

3rd Line: Suspicious Contract & Transaction Detection

• Predicts whether your project is targeted for attack
• Detects suspicious transactions

Post-Audit Protection: Why Continuous Monitoring is Essential

For years, smart contract security has revolved around audits, bug bounty programs, and reactive responses to exploits. However, as DeFi and on-chain applications grow, post-deployment security is becoming increasingly critical. An audit is just the beginning—ongoing monitoring ensures that emerging threats are detected and addressed before they evolve into costly exploits. Join us at ETHDenver 2025 to learn more about this crucial process.

Granular, Customizable Monitoring Agents on Demand 

Dedaub’s monitoring system enables fully customizable agents by leveraging DedaubQL, a highly expressive and performant declarative language tailored for blockchain security monitoring. DedaubQL allows protocols to define and check invariants and adapt our threat detection algorithms to their particular logic and concerns.

The execution model of DedaubQL ensures that monitoring agents operate continuously and with minimal delay, updating alerts in real-time as new blockchain data becomes available.

By enabling protocols to construct custom agents that can detect anomalies specific to their architecture—such as liquidity imbalances, unexpected contract interactions, or unauthorized fund movements—Dedaub’s monitoring suite provides a fine-tuned, protocol-specific defense mechanism.

About ETHDenver 2025

ETHDenver 2025 will once again transform Denver into a global hotspot for blockchain innovation, continuing the momentum built in previous years. As a community-owned festival powered by SporkDAO, ETHDenver 2025 offers various activities— from workshops and technical talks to boot camps and networking parties—designed to spark creativity and collaboration.

FREE MONITORING for all!

The Dedaub Security Suite continues to evolve with features designed to simplify blockchain transaction monitoring and security analysis. These new capabilities address Web3 challenges and empower developers, security professionals, and organizations to work more effectively. Here’s an overview of what’s new.

---

Blockchain Transaction Monitoring Available to Free-Tier Users

We are excited to offer all registered users free access to Blockchain Transaction Monitoring queries.

With our free plan, users can set up monitoring bots or queries to track on-chain activities and trigger custom actions through webhooks. These tools allow users to flag unusual transactions or stay alert to specific on-chain events, empowering them to maintain vigilant oversight of their projects. Blockchain transaction monitoring is essential for this oversight.

(For the free tier of the application, there are limits in how many queries can be running simultaneously, or generating alerts.)

Login today and try it out. 

---

Multi-Chain Monitoring Agents

Monitoring agents are now network-agnostic, meaning they can track activities across multiple blockchains, like Ethereum and other EVM-compatible networks. Blockchain transaction monitoring across these networks is now more efficient.

For example, a DeFi project that runs on Ethereum and Binance can now monitor high-value token transfers and detect suspicious behavior on both networks simultaneously. Updated macros make configuring these cross-chain queries easy, ensuring seamless and efficient monitoring.

---

Public Function-Based Similarity

Identifying patterns across contracts is now more straightforward. The Public Function-Based Similarity feature allows users to find contracts with similar functions to their target contract. This feature uses large language models (LLMs) to detect similarities.

---

Enhanced Monitoring Editor

The updated monitoring editor simplifies the query writing process, making it faster and more intuitive. The query language server now offers real-time suggestions, including table and macro names, helping users quickly identify the correct syntax and options for their monitoring requirements. Additionally, the revamped error reporting system accurately identifies issues in queries, such as undefined variables or incorrect filters, and provides actionable feedback to help users resolve these issues. This is especially useful for blockchain transaction monitoring queries.

---

Monitoring Star Rating System

The Monitoring Star Rating System within the Dedaub Security Suite allows users to quickly provide feedback on monitoring queries. Using this star rating system to share their experiences, users contribute to a valuable library of insights that assist others in finding the right tools to meet their needs. This approach ensures the platform stays focused on practical, real-world use cases.

---

Blockchain Transaction Monitoring Folders for Organization

The new monitoring folders feature allows users to systematically organize queries systematically, ensuring better clarity and accessibility within the Dedaub Security Suite. Users can navigate their query library quickly and maintain a cleaner workspace by categorizing queries into dedicated folders for better blockchain transaction monitoring.

---

Advanced RPC Fetch Functions

The latest Dedaub Security Suite introduces advanced monitoring capabilities that support external REST API requests. Five new functions allow users to incorporate data from external sources directly into their monitoring queries. The system supports HTTP GET, POST, and PUT requests.

Results from the requests can be joined against results from other tables. 

In total, there are 5 new functions:

• http_get() for all GET requests
• http_get_json() for GET requests that return json strings
• http_get_json_array() for GET requests that return json arrays
• http_post() for POST requests
• http_put() for PUT requests

---

Cross-Chain Contract Lists

With the new cross-chain contract lists feature, users can manage contract data spanning multiple blockchain networks in one unified list. For instance, users can create a single list to monitor contracts deployed on Ethereum and other EVM-compatible networks. This helps streamline blockchain transaction monitoring across networks.

---

Annotate and Share Transaction Traces

Transaction traces now support annotations, making it easier to interpret complex data. Users can add custom highlights and aliases to addresses and share these annotated traces with their team for collaborative analysis.

---

Blockchain Monitoring + contract lists = ♥️

Users can now incorporate contract lists into their monitoring query.

---

Improved Gnosis Proxy Support

We’ve added better support for Gnosis proxies to our Security Suite! You can now interact with the proxy using the underlying implementation ABI.

---

Advanced Code View

Play around with our new advanced code view in the decompiler and projects! The new code view allows multiple code representations to open concurrently in a split panel, with the ability to synchronize the two in some cases.

Previous Security Suite Suite Updates

Dedaub is proud to sponsor the DeFi Security Summit (DSS) 2024, which will be held from November 7th to 9th in Bangkok. The summit aims to enhance the security of smart contracts in decentralized finance. This sponsorship reflects our commitment to bolstering Web3 by elevating blockchain security standards and promoting collaboration within the ecosystem.

In the 2024 edition, we’re contributing to two key sessions:

1. SEAL Panel: “Safer Development: Don’t Get Rekt”

This panel will cover best practices for secure development, with insights from top security leaders. Gain practical strategies to avoid common pitfalls in smart contract development.

2. “Smart Contracts to Embeddings: Using Off-the-Shelf LLMs for Fun and Profit”

Dedaub will demonstrate how Large Language Models (LLMs) can improve smart contract analysis, providing developers with new tools to understand and enhance contract security.

DSS 2024 | About DeFi Security Summit

The DeFi Security Summit (DSS) is an annual, marketing-free event dedicated to advancing the security of decentralized finance (DeFi) applications and blockchain-based technology. Inspired by renowned security conferences like CCC and Defcon, DSS is a platform for white-hat hackers, protocol builders, security researchers, and tool providers to collaborate and share insights. The summit focuses on education, technical advancements, and best practices to secure blockchain applications’ on-chain and off-chain components. DSS 2024 will be the third edition, building on the success of previous years. For more info, visit https://defisecuritysummit.org/.

About Dedaub 

Dedaub is a pioneer in Smart Contract security technology and auditing. We blend cutting-edge program analysis with real-world white-hat hacking. As a founding collaborator of the SEAL 911 initiative, we contribute to emergency response frameworks within the blockchain ecosystem. Trusted by leading protocols, Dedaub is the security partner for Oasis Protocol Sapphire and collaborates with the Chainlink BUILD program. Our role on the ZKSync Security Council and as a security advisor to Arbitrum DAO emphasizes our commitment to safeguarding major Web3 projects.

Smart contracts are the underpinning of blockchain technology, and they present unique security challenges. To address this, platforms like Secureum have emerged, focusing on training researchers and developers to navigate and mitigate security risks, and we at Dedaub decided we wanted to partner Secureum in this mission.

Why we support the Secureum RACE

We decided to be part of the Secureum RACE because we believe hands-on challenges are the best way to learn. Security isn’t something you can fully grasp from reading papers or attending lectures—you need to get your hands dirty, confront real-world vulnerabilities, and think like an attacker.

The security of smart contracts is challenging due to the inability to modify the code once it goes live. This makes it extremely difficult to fix bugs or vulnerabilities. It’s even more complex, because contracts frequently interact with other contracts and different platforms, which adds even more complexity and multiplies the risk factor.

Secureum platform empowers researchers and developers to help improve their technical skills for what is needed in the challenge to secure Web3 technologies. 

As the designer of RACE-32, we have the privilege of observing Web3 researchers and developers navigate complex security issues that mirror real-world vulnerabilities in Ethereum smart contracts. This allows us to witness firsthand and see how they apply their knowledge to devise creative and effective solutions.

As well as this, we see how researchers and developers grow in their ability to identify risks and exploit weaknesses, both of which are critical  for the security of the Web3 ecosystem.

Why the RACEs are important 

The Secureum RACE aims to create a community of researchers and developers who think critically about security. It’s an opportunity to expand their skills and immerse themselves in the world of Web3 security.

By addressing actual vulnerabilities in smart contracts, participants acquire necessary technical knowledge and develop the mindset to safeguard decentralized applications in real-world scenarios. 

“RACEs are hands-on, immersive, and, frankly, a bit relentless—just like the threats we’re up against.” Yannis Smaragdakis, Dedaub Co-funder 

Designing the RACE-32

We wanted much more than your standard easily graded competition, so we created the Secureum RACE 32 to be an educational challenge. Our main aim, therefore, was to encourage participants to delve deeply into complex smart contract security issues. With this in mind, The RACE is designed to create an experience that participants can refer to for a long time rather than single out the top performers based on scores.

Even though the time constraint made it challenging to understand the depth of the questions thoroughly, we stressed that the competition aims at learning and gaining insights. We urged participants not to feel disheartened if their scores hadn’t met their own high expectations. Instead, we praised some participants for putting together the solutions, pointing out that this would make the RACE a valuable educational resource beyond just the competition.

This focus on education shows Dedaub’s commitment to helping the smart contract developer community grow. This is the backbone of Dedaub’s mantra as our co-founders both have strong academic backgrounds and always value teaching and sharing knowledge. With this in mind, one of the company’s core values is to empower the next generation by educating and supporting future blockchain security experts and help them reach their full potential. 

With challenges like Secureum RACE 32, we create real-world learning opportunities that give researchers and developers practical skills and deeper understanding. Our aim is to help them succeed in the Web3 space.

What is Secureum?

Secureum is a portmanteau of “Security” and “Ethereum” and their focus is safeguarding the Ethereum ecosystem through expert training and challenges. It’s an extensive educational platform that focuses on Ethereum smart contract security, providing a variety of resources and training programs. These include:

Secureum RACEs: Interactive quizzes that assess participants’ understanding of smart contract vulnerabilities. These quizzes are part of Secureum’s efforts to enhance practical security skills.

Community and Events: Secureum hosts events like TrustX to advance the Ethereum security ecosystem.

In summary, Secureum is committed to educating and preparing individuals for roles in Ethereum security through structured learning and practical challenges. Learn more 

We’re thrilled to announce that Dedaub is now a member of the ZKsync Security Council. We’re grateful for the community’s recognition of our efforts to play an active role in securing and maintaining the integrity of the Web3 space.

What is the ZKsync Security Council?

The ZKsync Security Council is a governance body tasked with safeguarding the security of the ZKsync protocol (ZKsync ERA, ZK Chains, and other components of ZKsync). Comprised of at least nine technical experts, the council has the authority to perform both standard and emergency actions to address security threats. Members are Signers of a multisig wallet, giving them the power to execute critical decisions that protect the protocol. Read more. 

Emergency Responses

The Security Council can freeze the ZKsync protocol in response to security threats, such as critical bugs or exploits. A Soft Freeze lasts for 12 hours and requires approval from three Security Council Members. A Hard Freeze lasts for seven days and requires approval from nine Security Council members. 

An Emergency Upgrade can be implemented during a freeze to address the threat. Any Security Council Member may initiate an Emergency Upgrade without the approval of the Token Assembly.

Why Dedaub Was Selected

Dedaub was selected for the ZKsync Security Council because of its extensive expertise in smart contract security. The company has successfully completed over 200 security audits, conducted impact studies for the Ethereum Foundation, and developed innovative security Web3 technologies as part of its security suite.  

The Dedaub team boasts exceptional academic credentials, with most members holding relevant PhDs, providing a solid foundation for our rigorous approach to Web3 security. ZKsync Security Council is one of many entities that trust Dedaub to increase its security expertise for its initiatives. Dedaub is also a founding member of the Security Alliance (SEAL), Arbitrum DAO Security Advisor, Oasis, and Chainlink Security Partners.

The Importance of Being Part of the ZKsync Security Council

Dedaub’s role in the ZKsync Security Council is actively protecting the ZKsync protocol. We our commitment to enhancing smart contract security and building trust in decentralized platforms and ZK rollups. 

Dedaub has invested heavily in preparing for ZK technologies and sponsored the House of ZK event in Brussels, which featured discussions on Zero Knowledge technology and networking opportunities. Neville Grech, Dedaub’s co-founder, participated in a panel on “Trustless Interoperability Using ZK,” along with other industry experts.

White Hat Hackers in the Crosshair

Update (Mar/11/2025): Legal pardon given to the white-hats by parliamentary vote.

As a white hat hacker and educator, I’ve seen first hand how legal frameworks can fail to protect those who devote their lives to secure software systems.

A case that strikes close to home is a case involving a couple of my University students, who were arrested and were now summoned in court for responsibly disclosing a vulnerability, in Malta. A copy of the leaked vulnerability disclosure email is available here. Two of the students, Michael Debono and Giorgio Grigolo, were subsequently hired by Dedaub. We also extended financial aid to cover part of their legal fees. The arrests occurred after they found and exposed a security flaw in Malta’s largest student application and suggested a bug bounty. This incident shows how the law can treat these good-faith efforts no differently from malicious hacking.

In addition to these students, Mark Vella, a Professor who’s coincidentally a colleague of mine at the University of Malta, is also being charged as an accomplice.

The leaked list of charges (translated into English) includes very serious accusations, so let’s look at a couple of these and try to understand the absurdity of why these were levied. In doing so, I’m keeping in mind transcripts of their interrogation questions and emails that were exchanged.

Accusation levied	Likely reason why
1,2, 5 – 7: Unauthorized access to a computer, remotely, and copying part of its data.	As part of the responsible disclosure, the students allegedly included a screenshot demonstrating the issue (via a curl command).
9, 10: Intent to make an illicit gain, financial or otherwise.	The students, in their bug report, suggest that they would be eligible for a bug bounty.
9: Forcing the “victim” (the author of the software) to do (or omit) some action.	The students kindly asked for promotion of their CTF team.
8: With respect to Vella (University Professor) – having prepared the rest of the accused to commit crimes.	Allegedly, their Professor saw the email exchange and advised them to make some changes to the wording of their responsible disclosure.

Another interesting thing that struck me is that during the interrogation of Vella, the interrogator seemed to be toying with the idea of presenting him as a head of this (criminal) organization, with the students acting in his direction, which is obviously absurd.

Implications of this case

This case highlights the significant risks that white hat hackers face, particularly under outdated and rigid cybercrime laws. While the situation has been prominently demonstrated in Malta, it serves as a broader warning that such challenges could arise elsewhere. Malta’s cybercrime regulations, particularly Article 337C, are largely modeled after the Computer Misuse Act 1990 (CMA) from England and Wales. The CMA has not only shaped Maltese law but also influenced legislation in many Commonwealth countries, such as Australia’s Crimes Legislation Amendment Act 2001. Similarly, while the Computer Fraud and Abuse Act (CFAA) in the United States predates the CMA, it has been updated to include provisions strikingly similar to those in the CMA.

The crux of the problem in Malta stems from an excessively strict interpretation of these laws by the Attorney General. This rigid enforcement fails to account for the differences between malicious actors and ethical hackers, leaving well-intentioned individuals vulnerable to prosecution. But why should white hat hackers be penalized due to outdated laws and overly strict interpretations?

One potential solution is the implementation of Safe Harbor frameworks, such as the one proposed by the Security Alliance (SEAL), a leading security coalition in the Web3 space, of which we (Dedaub) are a founding member. The Safe Harbor framework provides legal protection to ethical hackers who responsibly disclose vulnerabilities. While it may not be a perfect solution, Safe Harbor offers a starting point for updating Malta’s outdated cybercrime legislation, aligning it more closely with the realities of modern cybersecurity.

The allegations against white hat hackers like Debono and his peers should serve as a wake-up call for lawmakers. It’s crucial that legislators rethink their approach to cybersecurity and ensure that ethical hackers—those acting in good faith to safeguard digital systems—are protected from prosecution.

Coincidental Visit of Malta’s Prime Minister

Finally, the story ends with a silver lining. The charges we discussed in this article were (ironically) served to the students at almost the same time that the Prime Minister and the Minister of the Economy came to the Dedaub offices. There, the students, as well as myself, had the opportunity to exchange views on the topic. The Ministers vowed to help and to set up better legal frameworks so as to avoid cases like this in the future. The Ministers clearly understood that the activities of white hat hackers are beneficial to society. I sincerely hope we will see more progressive legal changes that protect and promote the activities of white hat hackers over the next few months.

Dedaub is proud to sponsor the SPLASH 2024 conference, helping unite top thinkers in software, programming languages, and systems. We support the community’s advancement of computer science, extending beyond our Web3 security work. 

The Doctoral Symposium, where mid-stage doctoral students receive vital research guidance, aligns with our academic roots. Led by university professors, our team is a powerhouse of expertise, with most members holding PhDs. We believe advanced knowledge is vital to delivering exceptional solutions and are excited to foster future tech leaders.

“SPLASH 2024 is where ideas meet action. At Dedaub, we push boundaries—whether in blockchain security or academic thought. By backing SPLASH 2024 , we’re investing in the minds that will define our industry. It’s about innovation, integrity, and preparing the next generation to lead.” Yannis Smaragdakis, Co-founder of Dedaub

Dedaub’s co-founders and senior researchers will attend, supporting open dialogue and contributing to the development of innovative solutions for technology’s future.

Sponsoring SPLASH 2024 emphasizes our commitment to expanding knowledge and empowering the next generation of technology leaders. We see this conference as a platform for pushing the boundaries of blockchain and smart contract security while nurturing emerging talents.

For those attending SPLASH 2024, we look forward to engaging with you, exchanging ideas, and exploring the future of programming together.

About SPLASH 2024

SPLASH (ACM SIGPLAN International Conference on Systems, Programming, Languages, and Applications: Software for Humanity) covers various software creation and delivery aspects. It’s a leading conference at the crossroads of programming languages and software engineering. SPLASH 2024 will feature the co-located OOPSLA, Onward!, SAS, GPCE, and SLE conferences, as well as SPLASH-E and other engaging workshops and events. 
SPLASH 2024 will bring together researchers and practitioners worldwide to explore the latest advancements and trends in software and programming languages. We are excited to be part of this dynamic event and to contribute to the ongoing dialogue on shaping the future of software development. Learn more.