Get live statistics and analysis of Giovanni Di Siena's profile on X / Twitter

Lead Security Researcher @Cyfrin 🌌 BSc Physics @UniofBath

1k following2k followers

The Analyst

Giovanni Di Siena is a detail-driven Lead Security Researcher with a knack for deep technical dives into security vulnerabilities, blending his physics background with cutting-edge blockchain technology. His tweets blend insightful analysis and heartfelt reflections on the complex realities of Web3 security. A thoughtful voice in a high-stakes industry, he values precision, transparency, and continuous learning.

Impressions
114.9k-38.9k
$21.55
Likes
879-149
62%
Retweets
54-1
4%
Replies
93-28
7%
Bookmarks
396-19
28%

Top users who interacted with Giovanni Di Siena over the last 14 days

@dcbuilder

🇪🇺🇨🇿. math. Ethereum. ZK. Rust. @worldcoinfnd. accelerating @worldcoin. World Chain⚪️. angeling in friends. Hopeful about humanity.🦀👽

1 interactions
1 interactions
1 interactions
@ngmiruggd

not ganna make it rugged

1 interactions
@0xenzo_eth

Smart Contract Researcher || 📍🇰🇪 AKA The Bread Guy 🍞 Obsessed with Rust 🦀

1 interactions
1 interactions
@emmanuelSR77

Security Researcher

1 interactions
1 interactions
@TamayoNft

🛡️Mechanical engineer turned to smart contract security researcher | 100+ H/M in public contest | working with @cyfrinAudits / eagle on @codehawks | I like Nft

1 interactions
@SergeysSon

Sergey Jr. Decentralization ⟠. On-chain gambling addict IRL FX Broker

1 interactions
@DevDacian

Audit Team Leader @Cyfrin Protected $40,000,000,000+ on-chain TVL!

1 interactions
@0xpedro_eth

Libertarian software engineer passionate about Solidity, Rust and DeFi. Engineering @SkyEcosystem. Founder @kaizenlabs_cc.

1 interactions
@pxng0lin

☔ Cybersecurity pro F/T • Web3 Hunter P/T • 🛸 'NotADev' Buildr • Echo App: catforge.pxng0lin.xyz

1 interactions
@maa___ly

Blockchain Engineer | @_HerDao Ambassador | @shefiorg season14| DevTool |EigenAlpha @eigenlayer| github.com/Maa-ly | other account : @0xodeili

1 interactions
@PatrickAlphaC

Co-founder of 🛡️@cyfrin | 🟪 @soloditofficial | 🦅 @codehawks | 🎓 @cyfrinupdraft Building the Web3 we promised.

1 interactions

Giovanni spends so much time diving deep into code vulnerabilities, I’m half convinced he dreams in bug reports and wakes up whispering 'unvalidated input' to his pillow.

Publishing a comprehensive deep dive on Uniswap V4 Hooks with 26 categories and 126 real-world bug examples, backed by collaborations with industry leaders and significant community engagement, stands out as a landmark achievement affirming his status as a top-tier security researcher.

To safeguard the integrity of blockchain systems by uncovering vulnerabilities and sharing knowledge that empowers the community to build more secure and resilient infrastructures.

Giovanni believes that rigorous analysis and ethical responsibility are key to advancing the Web3 ecosystem; that failure and breaches, while painful, are crucial learning opportunities; and that the tech community must support each other with transparency and respect.

His analytical prowess allows him to identify and communicate complex security risks clearly, while his compassionate reflections demonstrate emotional intelligence rare in technical fields.

His intense focus on deep technical detail might sometimes make communication less accessible to a broader audience, potentially limiting wider engagement.

To grow his audience on X, Giovanni should consider weaving more digestible, thread-based explainers and real-world impact stories into his feed, balancing technical depth with approachable language to invite broader discussion and attraction beyond the niche security community.

Fun fact: Giovanni’s expertise spans from a BSc in Physics to leading security audits involving multi-million dollar vulnerabilities, showing that crossing disciplines fuels innovation in security research.

Top tweets of Giovanni Di Siena

The article you've all been waiting for, finally! 🦄 Uniswap V4 Hooks Security Deep Dive 🦄 ✨ Epic @DevDacian style heuristic-based deep dive ✨ 26 categories & 126 examples of real bugs in the wild ✨ Learnings from 7 @areta_io @UniswapFND subsidized @CyfrinAudits Link 👇

26k

Now that the dust has settled, it goes without saying that I took this saga pretty heavily. Despite all our best efforts and high security output, including a completely separate live $7m+ critical vulnerability disclosure, it sadly wasn’t enough. It was always a pleasure working alongside @boredGenius and the @bunni_xyz team. A true asset to the industry, I wish them nothing but the best moving forward. No one deserved for things to play out like this. Make sure to keep an eye out for whatever they move on to next. In the meantime, I’ll continue quietly hoping for an Euler-style salvation and comeback. If you are the attacker reading this, please just return the funds. Congratulations on the impressive exploit, but think seriously about all the lives you have ruined in the process. Is the financial gain really worth the burden of this guilt and forever having to look over your shoulder? To everyone else, just remember that it’s easy to pile on with all your opinions and hot takes when observing the arena from the sidelines. There’s a reason this ended up as a blackhat attack and not a whitehat rescue. I’m truly sorry to everyone who has been affected. Back keeping my head down on what I do best to help minimise the chances of it happening again. Chapter closed. Uniswap v4 vulnerabilities deep dive coming very soon.

13k

Patrick and @CyfrinUpdraft are the Chainlink of web3 education. At this point, I’m convinced they’ve taught the majority of the industry, including a large portion of our team! Very proud to have joined the ranks around the time of VRF Pizza and now call myself an alumnus 🤓

2k

Security researchers & smart contract developers: What sort of diagrams do you find useful when auditing and under what circumstances do you use/create them? What are the specific qualities that make them useful? In my opinion, it's not always necessary or even a good use of time to diagram. That might just be the artistic luddite in me though idk... Having said that, I do think that the right diagrams can be very helpful for visualising and understanding complex systems at various levels of scale. For example, this is one of multiple by @quarkslab that does an excellent job of breaking down the lifecycle of a ZKsync transaction: I would strongly recommend taking a look at the full article (linked below) if you are interested in seeing it with the surrounding context and would greatly appreciate any other similar examples that can be used for inspiration. Do we think it's best to build up a collection of specific flows throughout a system with supporting commentary or is it possible to create a single canonical diagram covering all the main functionalities and flows? While you probably do have to be strategic about what you black-box, I'd say I'm currently leaning toward the former. Interested to hear what everyone else thinks!

2k

Don't make this mistake when integrating Chainlink Functions unless you want to DoS your application!! (pro tip: you don't ❌) So, say you have some piece of critical functionality that acts as a trigger for off-chain computation via Functions, such as Chainlink Automation. In the scenarios where you don't want a new request to be executed until the most recent request has been fulfilled, you might have something that looks like this: But beware, it is VERY IMPORTANT to note that: 1️⃣ Only ever one of response or err will be assigned a non-empty value. 2️⃣ The executing DON will not retry a fulfilment if it fails. Your subscription will be billed and that will be that. This means that you really don't want any of the fulfilment logic to revert for valid request ids. This is especially important if your core business logic depends on some logic being executed at the end of fulfilment, such as lastRequestId as shown above. ⚠️ HOWEVER!!! ⚠️ There are of course a number of ways that this could happen: - If err contains non-empty bytes then it might be tempting to bubble-up the revert – don't! - If err contains non-empty bytes then you absolutely must also remember that any attempt at decoding response will revert because it is empty. - If the actual fulfilment business logic reverts, execution will revert. This includes external calls, but also don't forget about any internal/private functions! 🔧 So here are the steps to avoid it: - If err contains non-empty bytes then you should not simply revert but rather handle the error gracefully, falling through to any cleanup logic that needs to be executed at the end. - Validate response against its expected length to ensure that the decoding does not revert. - Handle reverts from all external calls using try/catch blocks. - Unless you are absolutely certain you have covered all bases, consider refactoring the internal fulfilment logic into public function(s). This way, you can call it externally with this.doFulfillment() and handle it the same as any other external call. 🛡️🛡️🛡️ Phew! You should now be in a great position to deploy your contract without fear of bricking the core functionality and having to redeploy (or worse). For added peace of mind, you might also consider including an access-controlled admin function to reset lastRequestId as a last resort just in case there is something we have overlooked here. Lots more where this came from coming soooooon! If you learnt something new, drop a comment below with your thoughts below and let me know what you'd like to see next 👇

851

Most engaged tweets of Giovanni Di Siena

The article you've all been waiting for, finally! 🦄 Uniswap V4 Hooks Security Deep Dive 🦄 ✨ Epic @DevDacian style heuristic-based deep dive ✨ 26 categories & 126 examples of real bugs in the wild ✨ Learnings from 7 @areta_io @UniswapFND subsidized @CyfrinAudits Link 👇

26k

Now that the dust has settled, it goes without saying that I took this saga pretty heavily. Despite all our best efforts and high security output, including a completely separate live $7m+ critical vulnerability disclosure, it sadly wasn’t enough. It was always a pleasure working alongside @boredGenius and the @bunni_xyz team. A true asset to the industry, I wish them nothing but the best moving forward. No one deserved for things to play out like this. Make sure to keep an eye out for whatever they move on to next. In the meantime, I’ll continue quietly hoping for an Euler-style salvation and comeback. If you are the attacker reading this, please just return the funds. Congratulations on the impressive exploit, but think seriously about all the lives you have ruined in the process. Is the financial gain really worth the burden of this guilt and forever having to look over your shoulder? To everyone else, just remember that it’s easy to pile on with all your opinions and hot takes when observing the arena from the sidelines. There’s a reason this ended up as a blackhat attack and not a whitehat rescue. I’m truly sorry to everyone who has been affected. Back keeping my head down on what I do best to help minimise the chances of it happening again. Chapter closed. Uniswap v4 vulnerabilities deep dive coming very soon.

13k

Security researchers & smart contract developers: What sort of diagrams do you find useful when auditing and under what circumstances do you use/create them? What are the specific qualities that make them useful? In my opinion, it's not always necessary or even a good use of time to diagram. That might just be the artistic luddite in me though idk... Having said that, I do think that the right diagrams can be very helpful for visualising and understanding complex systems at various levels of scale. For example, this is one of multiple by @quarkslab that does an excellent job of breaking down the lifecycle of a ZKsync transaction: I would strongly recommend taking a look at the full article (linked below) if you are interested in seeing it with the surrounding context and would greatly appreciate any other similar examples that can be used for inspiration. Do we think it's best to build up a collection of specific flows throughout a system with supporting commentary or is it possible to create a single canonical diagram covering all the main functionalities and flows? While you probably do have to be strategic about what you black-box, I'd say I'm currently leaning toward the former. Interested to hear what everyone else thinks!

2k

ICYMI I recently started a new @hashnode blog on which I will be sharing my public security research work going forward. Pretty great experience so far, and have to say I really like the seamless GitHub backup feature. Hello World Computer👇

3k

Patrick and @CyfrinUpdraft are the Chainlink of web3 education. At this point, I’m convinced they’ve taught the majority of the industry, including a large portion of our team! Very proud to have joined the ranks around the time of VRF Pizza and now call myself an alumnus 🤓

2k

People with Analyst archetype

The Analyst

🎮 UX/UI with psychology & #nudge → +45% conversion ⚡ Behavioral design insights & ideas daily (no robot, no promises) 🎨 In love with Design History

1k following494 followers
The Analyst
677 following624 followers
The Analyst

Founder, mini-investor @point_fm | Music, watches, cars, private equity, tech, stocks

696 following3k followers
The Analyst

Hyyypergrowth, SaaS, Digital money enthusiast, CEFI Skeptic, Oil bull, and Futurist. If you ain't long, you're wrong. Occasional Security Analysis.

696 following21k followers
The Analyst

I became Elite in many disciplines, while traveling through more than 70 countries and helping others to achieve the same.

93 following482 followers
The Analyst

至今还在岛上。 好消息:我航司今天第二件行李半价。 古法编程 CURD 爱好者

94 following179 followers
The Analyst

Solana ops: research 🔬 + automation ⚙️ Alpha drops 📈 | smart-money tracking 🐳 | narrative radar 🔭 | tools & scripts 🛠️ — DM for collab 🤝 · NFA

513 following413 followers
The Analyst

MILADY IS LOST! Sign up for a journey. Become part of the story. Currently: W3C WoT Invited expert & @bindSystems Previously: crypto, big data Github: citrullin

1k following1k followers
The Analyst

澳洲区块链9年老韭菜,Bnbchain专家,Kaito中文区Yap No.1,爱投研爱分享爱生活爱赚钱。 绑定大狮兄币安钱包邀请码,减免10%交易手续费! 币安钱包邀请码:X7HMTOPH OKX钱包邀请码: GOGOGO

3k following117k followers
The Analyst

Autor del libro "El Arte de Especular". Curso "On line": "Un Sistema de Especulación que te cambiará la Vida". Está disponible:

516 following132k followers
The Analyst

PhD Neuroscience | Specialist Cancer Pharmacist | Metabolic health, circadian science & disease prevention. Opinions ≠ medical advice

386 following2k followers
The Analyst

Smart Contract Researcher || 📍🇰🇪 AKA The Bread Guy 🍞 Obsessed with Rust 🦀

2k following1k followers

Explore Related Archetypes

If you enjoy the analyst profiles, you might also like these personality types:

Supercharge your 𝕏 game,
Grow with SuperX!

Get Started for Free