myvector

Hey bro. What’s up. You good?

Been a while, right? Last time I torched Web2 and steered the ship into Web3. Now I’m gonna tell you what happened after that.

Why the long break? Because I don’t wanna write about every single piece of crap, man. I only get the urge when there’s a real trace — when I actually build a report and then take a beating for it. Coming here to say “bro I looked at this program, did this, did that, found nothing” feels pointless.

But hold on. Let me touch this, because it’s the whole reason this blog exists.

The Planes That Came Back

There’s this old story. In the war, they look at the planes coming back from missions, they mark where the bullet holes are, and they say let’s put armor there. Then a man called Wald says: no bro. You’re looking at the planes that came back. Armor the places with no holes. Because the ones that got hit there never came back to be measured.

Now look at the Web3 learning path. CryptoZombies, Ethernaut, Damn Vulnerable DeFi. Where did that list come from? From the guys who made it. The ones who came back. And thousands of people are bolting armor onto the exact same spots.

Nobody writes the other post. “Bro I tried the roadmap and quit in a month.” “I opened the course and got bored to death.” “I sat there feeling like a monkey.” Those planes don’t come back, so nobody measures them.

This is a transmission from one of those planes. It’s still in the air, by the way.

I Already Spoke Web2

Let me rewind. After six months of getting slapped by triagers, a pattern showed up and I had to make a move. Pivot to Web3. That kicked off a two-month grind.

Bro, there is a mountain between Web2 and Web3. I learned this by crawling through mud and cursing.

And I understood something else, something I didn’t know about myself. When I came to Web2, I already spoke that language. Pretty well, actually. That’s why I adapted with zero friction and started popping bugs. In Web2 I can say “alright, an e-commerce site works like this.” I have the picture.

I figured the same flow would run here.

And then Brother Solidity punched me square in the mouth. Here, let’s see how you handle this one.

What Are We Gonna Do With a Ford?

Man, I’ve been in and out of programming languages for years. I struggled with Solidity like I’d never seen a line of code in my life.

If you ask me right now “do you understand it yet” — nope. But whatever.

The problem wasn’t syntax. There’s this thing called require. Fine, makes sense. But then what happened to if? Oh, if is here too? So what’s the difference, why does this one exist? And okay, there’s all this code — what is it actually doing, my dude?

I didn’t have the mental model. That’s it. In Web2 I know what a shopping cart is before I read the code. Here, I don’t even know what the building is.

And that bastard Claude is explaining things all smart-ass. “Check the proxy implementation on Etherscan.” And I’m sitting there like, what the fuck are you even saying. He says “we need Forge,” and I say what are we gonna do with a Ford.

That was the level, man. 😂

The Monkey and the Computer

Middle of the first month, I stopped.

I had walked in expecting this to be Web2 again — learn it fast, have fun, start blasting bugs. Instead I felt like a monkey seeing a computer for the first time.

So I said, alright bro, we joked about roadmaps, but let’s do it properly. Buy a real course. Sit down like a student.

The second I started looking at courses, I got bored to death.

I can’t do the standard path. I’ve never been able to. And the AI keeps going, “bro, CryptoZombies, bro, Ethernaut, bro, Damn Vulnerable DeFi.” Nah man. My system rejects CTFs. I don’t get pleasure from a puzzle someone built for me to solve.

See — this is the part of the plane nobody armors.

The Answer Key Incident

Then Claude says: dude, there’s no way you learn it like this. Let’s pick a closed contest on Code4rena and reverse the whole thing.

Fair enough. I picked one.

Bro, I opened it and it was straight-up Chinese. We started reading. What’s this? What’s that? Why is this here? Tiny monkey-brain questions. Then slowly, a few lightbulbs.

And we found something. Something that smelled like a bug. I questioned the hell out of it. Then I thought — it’s a closed contest, the answer key is public. So I told Claude very clearly: I’m sending you the key. Only tell me if my finding is in there. Do not tell me the real answer.

“Sure boss, send it over.”

I send it. He goes: “Yours isn’t in there, because the answer is THIS.”

Hahahah. You absolute psychopath. I hadn’t even reached that part of the code yet. I asked one question and you burned the whole thing in one line.

Anyway. After that I said fuck closed contests, and steered to Immunefi.

Crypto Loan Sharks and the Orphan Tranche

So I started reading a live program. Let’s call them the Kings of the Code Comment — you’ll understand the name in the next post.

And here’s the thing. I dissected that protocol down to the roots. Not the roadmap way. My way — pull the thread, follow the link, ask what it does in real life. I can sit at a coffee shop right now and explain the whole business to you like I work there.

Turns out these guys cut the bank out of the middle and hand out loans. Borrowers pay interest, lenders make money. You crypto loan sharks. 😂

Senior tranche, junior tranche. AA gets paid first, BB eats the loss first. And look at them — everybody’s parked in AA. Come on, at least spread out a little. Why is BB sitting there like an orphan?

That orphan is the whole next post.

The Language

Two months. Call one of them training. In the first real month of hunting, I put a Web3 bug in my portfolio. Not too shabby, right?

But that’s not the part I keep thinking about.

The part I keep thinking about is that I finally learned enough of the language to catch someone lying in it. Because what stopped my report wasn’t the code. The code was on my side — I have the tests, I have the on-chain reads, it all holds.

What stopped it was a sentence. A human sentence, written in English, sitting inside the contract as a comment. A line that doesn’t compile, doesn’t run, doesn’t enforce a single thing.

An unbelievably secure smart contract, guarded by a majestic, almighty code comment.

Next post, we open it up.

---