최고의 보안 연구원이 되기 위한 여정

### 초보자에서 전문가로: Ziga의 보안 연구 여정
* 👨 현재 칸의 리더보드에서 2위를 차지하고 있는 지가가 **사이버 보안 초보자에서 스피릿의 숙련된 보안 연구원**으로 성장한 과정을 공유합니다.
* 📈 그는 첫 대회에서 겨우 **5달러를 벌고 100위 이상의 순위**를 기록하는 등 초창기에는 대회에서 부진한 성적을 거뒀다고 말하며 자신의 초기 고군분투를 이야기합니다.
* 🔍 지가는 자신의 단점을 인정한 후, **프로토콜의 목표를 이해**하고 워크플로를 시각화하는 데 중점을 두고 기술을 향상시키기 위한 체계적인 접근 방식을 개발했습니다.
* 🛠 그는 에너지와 집중력을 유지하는 것이 중요하다고 강조하며 격렬한 업무 세션 중 생산성을 높이기 위해 **적절한 수면, 영양 섭취, 규칙적인 휴식**의 중요성을 역설합니다.
* 💡 Ziga는 수동 코드 리뷰의 중요성을 강조하며, 참가자들에게 **익숙하지 않은 코드 영역에는 숨겨진 취약점**이 있는 경우가 많으므로 이를 탐색하도록 독려합니다.
* 📚 그는 각 대회에서 얻은 취약점과 교훈을 문서화하기 위해 **지식 기반**을 만들어 경험에서 최대한의 가치를 끌어냈습니다.
* 🚀 지가는 새로운 방법론을 적용하여 **2024년 초에 6위와 5위를 차지하는 등 이후 대회에서 인상적인 성적**을 거두며 자신의 접근 방식이 효과적임을 입증했습니다.
* 🌟 궁극적으로 그는 이 분야에서 장기적인 성공을 거두기 위해서는 **열정이 중요**하므로, 보안 연구원을 꿈꾸는 사람들에게 **자신의 여정을 즐기고 업무에서 개인적인 성취감을 찾으라고 조언**합니다.

초보자에서 최고의 보안 연구원이 된 Ziga의 여정은 자체 평가와 지속적인 개선의 중요성을 보여줍니다.

all right, let's try that. Okay, I think we have it working now, so let's give it like a minute or two, and then we can get started. Cool, I can see some people jumping in, so maybe like 30 seconds also. All right, I reckon we're good to get started if you are, so we can go. Yeah, yeah, let's go. So thank you to everyone who's jumped in to join today. We've got another seminar for you, this time with Ziga, and basically just going through his journey to becoming a security researcher. He's currently number two on Kan's leaderboard, and I think I remember in maybe July, was it, that we did the research highlight, and yeah, you've just kind of shot up the ranks pretty much out of nowhere, so definitely interested to hear how you did it. Yeah, so that's the point of this seminar, so it's all right, definitely over to here. Okay, so welcome everyone, and thank you, Cantina, for this seminar. So today, we are going to talk

about my approach that I use to basically go from newbie to security researcher and uh lead almost almost lead the the Cantina platform uh Zach is still in front of me but so close some point I will do it I will I will rank first sometime so yeah that's it so in this seminar we are going into four parts uh the first one I will present myself and we explain you from where I'm coming uh and then we are going to see that at first I was bad really bad and then once I understood that I was bad I did something that maybe you don't know you don't do that helped me a lot to really get get good uh and uh yeah and break more and more cut bases and in the last part we will see the result of the methodology that I used uh during the last months so first I'm Z I'm currently a security researcher at Spearit. I'm also an instructor at R Skills uh giving some course about Rust and before that I was a student at

rare skills, especially in the Solidity boot camp. And so, as we said, I'm currently on the Contin leaderboard. So, before 2024, I was a cybersecurity student in Web 2, but it was not that technical. It was more about analyzing risk, so risk assessment, and it was really not that technical, not as much as what I do today. And so, during the studies, I worked as an apprentice in securing embedded systems. And during my studies, I did a really interesting project that has brought Web 3 to me. It was the post-quantum blockchain that I'm going to detail a little bit because I think it's pretty interesting. And after this project, I decided to follow the real skill Solidity boot camp. So, that was 2023. So, let's talk a little bit about the post-quantum blockchain project that I worked on. Most of you know that when you are interacting with Ethereum and you are making a transaction, you are signing it with the SIGP, K1, elliptic curve with the ECDSA.

algorithm signature, uh, but there exist other blockchains such as Solana or Near that allows to use another algorithm that is named, uh, EDSA. And this is, this is, this is still using elliptic curve, but a different, a different one, uh, so yeah. Theon Quantum blockchain is based on Near because it uses, it allows to use two types of keys, which is pretty interesting. But the issue with all these keys is that tic curve, uh, cryptography could be broken by a quantum computer. This is so basically, we take a quantum computer that is really working because today it's not the case, and we take the show algorithm, um, and with that, we are able to break all the security that is allowed by blockchains nowadays. So yeah, uh, the day a quantum computer works, uh, like it could break every secret key that is used on any blockchain, so that's a problem. And, uh, so with some friends, we decided to work on a project named the PQB post-cont blockchain, and the goal was to use a signature algorithm that is

different than the others. It does not use the same mass behind the thing. So, in this case, we were using the Falcon algorithm that is using lattices to do cryptography. And with that, you can sign the transaction, and these specific masses are not shown to be broken by a computer for now. So, the goal would be to really secure against a quantum computer. The issue with that project is that a signature from an elliptic curve is pretty small, like 64 bytes most of the time. But with this type of algorithm like Falcon, it was 660 bytes. So, it's more than 10 times more, so it's not usable in production. So, that's it for this part. Okay, so now let's see what was the start of my web3 security audit journey. So, my first contest was Spark in on CodeHS, and I earned like $5, which is really good for the first one. And yeah, there was a lot of

people, uh, competing in this competition. So, yeah, I ranked like more than 100. It was pretty bad. And, yeah, my second one was in November 2023 at the start of Cantina, and it was super form, uh. So, yeah, I ranked as 21st, but it was not the... I think I had this rank because there was not that much people on the platform as it was pretty closed at the beginning, uh. I can show you the bug that I found. It's like, Hey, uh, so we are in a transfer from function basically, and we are checking that the allowance is given to the current color, but we are decreasing the allowance from another address, which doesn't make any sense. So, that was that easy. This was an easy BG, and it was found by more than 10 researchers, so it was pretty easy to find. So, yeah, super form was my really first contest in which I committed at 100%, and seeing that I ranked 21st is not good. And so, I, yeah, that was the turning point.

in my journey because I said, Okay, I'm bad. This is a proof that I'm bad. I can't make it even more clear. I'm bad. So, from this point, I will just work to become good. And so, that's what we are going to talk about right now, and I think it's the valuable part. So, yeah, I asked myself some questions. Why am I bad? Most of the time, it is because I don't know what to look for, or I don't focus enough. It can also be, I'm missing vulnerabilities that I know or I've met before, but I can't use that knowledge in a new context. And this is really bad because you are just losing time and money. And yeah, the last point is that I don't have experience. So, these are the reasons why I'm bad. But yeah, now that we have identified them, we can just work to make them disappear, basically. So, yeah, we are going into the approach. Let's say that we have a new

competition coming. The thing to do is to, yeah, we can answer to the problem. I don't know what to look for first. You need to understand the goals of the protocol. Like if it's a lending protocol, I want to learn money. But then you will have to visualize how it works. I like to do drawings, but I know a lot of researchers don't do drawings. I think it's really, you should do drawings if you like them. If you don't do like them and they don't bring value to you, you are just losing time doing them. Then you can avoid it. Because if you don't like what you are doing, then it makes no sense and you will not succeed. But once, yeah, once you really understand how it works, you must identify where it could break. Like for example, if I retake the lending protocol, I know that I have a deposit function, a withdraw function, something to borrow, one to repay, and a workflow to liquidate.

so basically these five workflows are like the most important ones in the code base, and all the other things are more in the periphery of these five workflows. Like, for example, there can be admin functions that are just setting some values or view functions which may not be important. So once you identify those five workflows, you can say, Okay, I know that there exist ring issues. So ring issues can happen when I'm depositing U liquidity or withdrawing. So yeah, you must identify where it could break, and for example, external integration. Yeah, I give some examples or calculations. So I like to call this stage the threat model. So it's really coming, it's really the start of a new competition, a new code base that you have to edit, and it will, yeah, basically, it's the beginning of all your understanding of the code base. So yeah, then the other issue that I talked about was I don't focus enough. I think that having energy is really important because if you have

good energy. You can easily focus more easily, and uh yeah, if you focus more and in a better way, you will be better at the end. So for that, I like to have good sleep. Uh, I like to eat LC, especially on lunch. I'm not, I can feel sleepy if I eat a lot of carbs, uh, so I avoid them at lunch. And uh yeah, being fit, like going outside, walking, doing sports, is really important, especially when you focus for extended hours. Like try to take a break, go outside, take some fresh air, and you will come back even more focused and energized. So yeah, that's the second point. Something that is uh not easy to understand at first. You don't need to be deeply focused 100% of your time because first, your brain can't do it. Uh, like studies show it. Uh, and for my personal case, I do really deep focus uh work only four hours a day, and the rest of it uh is is not uh I'm not doing nothing. I'm just

preparing my next deep work slot. So, this is really important. You must have really some slots in which you have no music, nothing to distract you, like no music. If you really focus more by having some music, then do it. But yeah, you must really focus on one thing in this deep work slot. And when you are in this deep work, you must deload your brain. Like, if you are thinking about something and you want to check it, but you are also checking another thing at the same time, then you should not keep that in your brain. You should take it on notes because if you keep it in your brain, it will just stay here, and you will be less focused on what you were doing before. So, yeah, that's important. I like to take notes on Notion, for example, but you can do it on a markdown file or anything. And especially if it's something that you can check without being deeply focused, then put it on the notes, and you will check it in.

the later when you will be less focused, and you don't need that focus for this specific task. Yep, and uh, yeah, uh, so this is it. Yeah, uh, this is what I said: small things that don't require a lot of focus. You can just postpone it to check it later. And yeah, the last point to find bugs. You must dig into code areas that you don't understand and that you don't want to dig because it's too difficult. Uh, if you don't want to dig it because it's just an admin function, and uh, uh, at the end, it will end up being a low. Then I understand you, but if you are feeling that you don't understand what is done, you must really dig in that part because, yeah, for sure, if you don't understand it, there are a lot of changes that the developer did not understand it also. So yeah, you will find bugs in these code areas for sure. Uh, so yeah, this is the most important part of your contest. Uh, like

this manual review will bring maybe not all the bugs because, uh, in the sh model, you may have some small bugs that are easy to find, but for really difficult ones, the ones that allow you to go high in the rank, uh, you must be really focused on that manual review part. And yeah, I like to make this double um arrows because you can go from manual review into so manual review will bring you more knowledge about the code base, and then you can think about other attack vectors, new attack ideas, uh, that will um feed your manual review at the end. And yeah, you can go back and forth between these two parts. Then once the competition ends, there will be the results that will be announced, and here is the most important part of the process, I think, uh, it's some people call it the feedback loop. Uh, so yeah, I'm missing vulnerabilities that I already know or that I've met before. Um, for that, I what I do is to put my knowledge in a document so that I de my brain once

again and I'm sure that, uh, yeah, so this can be a waiting template or a checklist, so you can have your own checklist for it, and, uh, yeah, with that, you ensure that you will not miss it because just because your brain will forget it or will not think about it at the right time, like you did not forget it, but you did not think about it at the time it was required, so just put it on some notes, on a knowledge base, and you will check it, uh, during your audit. You will take time because it's not something that you require deep focus. You can put it into the time slot where you are not that much focused if it's just something to check. So we end up with this, uh, process in which, like, after the competition is even more important than the before because, uh, you are already preparing the next audit with that. And the last one, uh, I don't have experience is an issue, but it's not really an issue.

because every competition you are participating in increases your experience. So, you have experience, but the main problem is that you are not extracting 100% value from this experience. Um, so yeah, that for me, it was the problem at least. And so, with that problem, the point because I have experience but don't extract 100% value from it. So, the thing that I do after the result of a competition is to understand every issue that I missed. So, this is the first part because if I don't understand the issue, for sure I will not be able to reproduce it. But then you have to think about why you missed this issue. And so, this is not about the code base anymore, this is about you. So, is it a lack of knowledge or maybe you didn't think about that? So, that's what I was talking about for in the knowledge-based section. Uh, and yeah, uh, for example, you did not dig enough in a sensitive code area that you identified because you were tired, for example, or

you may not have identified some part of the code as sensitive, and so yeah, this is it. You must find the root cause why you didn't find this specific issue, and once you know why you missed this issue, you just have to modify your work, your way of working, your work process to be sure to not miss it the next time. So, as said, the knowledge base is really helpful for that, especially when you audit. You need to identify code areas that are potentially sensitive, so this was in this model parts, and you use your knowledge base to know which parts are potentially sensitive. And so yeah, it helps read your knowledge base but also your intuition. Like, it's not always about the knowledge base and the knowledge you have; it's just you have to feel where the bugs are, and this comes with multiple audits. Once you identify patterns, like today, just by understanding how the protocol works, I know approximately where, like, I don't know where the bugs are, but

I know where they will be most probably, and this is it. At the end, your experience is the most important thing because it really impacts everything in your audit. But having some knowledge base will help you a lot. So, yeah, if you have to really get something from this seminar, just try to get 100% value from all your experiences, and you will level up for sure. So, yeah, to summarize it, you must create your own methodology, the one that you like, because the one that I use today is not the one that I used six months from now, and it may change in the upcoming months. And so, this is just for myself, but for sure, I'm not auditing in the same way as every other audit. Visualizing the code base is really important because when you understand how it works, then you can identify where it could potentially break. So, this is completing the think about potential issues section. And yeah, focus deeply because you need it for sure where this is a job in which you really need to focus hard.

to find Buds and uh yeah I will not let you down with that extract as much value as possible from all your experiences. This is the most important thing from this seminar. And so, by applying all this approach that I detailed before, uh I went from Super form in November 2023, in which uh yeah it was pretty bad result. So, I took the whole December months to prepare and then in January I came back with a Cod arena in Cana contest. So, Opus and Olas and uh in the first one I was ranked six and in the second I was ranked fifth. So, it was the second one was on Solana and the first one was on Koo. So, it was my first time auditing both the yeah the February month was really good because uh I ranked really good in in blast. So, yeah I ranked six because uh in the leaderboard on Cantina as there was a team before me. So, they are taking two ranks instead of one because they were team. So, yeah but yeah by applying this this process that Loops

uh, and you will get more and more efficient, uh, and better in each iteration of your process. So, you will get better at every competition you do until you rank first, and then you can't improve anymore. But, uh, I'm not sure that you can rank first in every contest. It's pretty hard to do, uh. And so, I continued my, uh, my increase in results by ranking two times second in the first in the same months in March 2024, uh, and with pretty good earnings in this case. And that's it. That was awesome. Thank you. I have a couple of questions from my side, and I've seen a couple in the, um, in the post as well, but just a, just a reminder that if anyone wants to ask any questions, pop them in the reers, and I can ask them. I'll start with mine first, uh. So, the first one is, um, I know that you're now an Sr with Spearit. Do you approach reviews any differently to competitions, or do you buy the same, um, methodology that you outlined there? This is really interesting as a

question. So, yeah, I did my first spe review a month ago, and so, yeah, I just met the lead security researcher, and we were talking about this difference, and I don't use the same approach because in competition I have to find the bugs, while in noit I can use the team that is responding, and I can use the shotgun approach. It's like, Okay, I'm reading this code, I'm not sure what it does, so I put a comment, and the sponsor, like the client, is going to respond to it and will explain things if I don't understand them, while in the competition it's more, I have to find the bug, so I have to understand everything on my own. I can ask some questions, but I will lose time, and yeah, in this case, it's different. In all the rest, it's pretty much the same. Like, I want to visualize the code base, how it's working. I like to do drawings with function calls, and so, yeah, that helps me a lot.

during the manual review because I'm using some extension from VS Code to integrate with Doio, and then I can split my screen in two, having my drawings on the right and my code on the left. And then by double-clicking on blocks in Draw, I can just um, so I will, the code appears on the VS Code. So this is the I can share the extension if someone wants uh, but this is on the VS Code Marketplace, and this is really useful to navigate. So with your drawing, you visualize your code base, and with this extension, you can just navigate it easily. Yeah, that's pretty cool. That's pretty cool. And then a follow-up to that question, more of a fun question um, do you prefer reviews or competitions? Do you know yet which you prefer? Uh, that's a tricky question. I yeah, I think competitions are really cool because if you are good, you rank well, while it's not that transparent in a review, in a private review. Yeah, the competition like taps into human

psychology of wanting to win, which is how we got here. And then one more question from my side, and I'll have a little look at the replies. But you spoke a lot about focus earlier on in the presentation. I guess this might be a tricky question too, but would you say that anyone with enough focus can get good at code review, or do you think like some people are just wired that way? What do you reckon? Yeah, asking for a friend. Yeah, I think that, for sure, having some programming experience is useful. But yeah, at the end, we are just like, I don't, when I talk to people, I don't like to, to people that are not in the space. I like to say that I'm just understanding a logic and trying to break it, but this logic is just code. So if you can translate this code to the logic, and I guess everyone can understand a logic and break it, so this is just, this is just the fact that it is code and it afraids people. But um, yeah.

just the form that the logic comes in. Yeah, yeah, cool, cool, cool. All right, I'm seeing a couple of questions in the replies. So the first one, how did you get so good at Photoshop, and where can I learn? Asked someone about your photoshopping skills. I'm not using Photoshop because I'm on lit, so I'm using it's that's which is yeah awful. That is the alpha. Don't use don't use Photoshop. And then the other question was you mentioned between I think it was super form and what was the next one Opus and Alis or maybe it was between it was during the period in December. Yeah, December. What did you do during that preparation phase between November super form and January Opus and allas like what did you do to prepare over that time. Okay, so yeah, it was preparing this W approach because it does not it did not exist or yeah I wanted to create my own thing. I know that a lot of researcher are posting their process how they work but I don't think that it is something.

you can copy and paste from people to people, and it just works like this. I had to build it, so it took months because I had to build my knowledge base, my feedback template, because I have a template for every contest that I do. Like, I have a feedback thing, I have a template for the audit, so yeah. And I built everything in December, and then it moved a lot thanks to the feedback loop. Yeah, because it... yeah, for... don't try to make it perfect in the first round. It will become perfect to you because it's for sure what you are doing will not fit to me. And yeah, you will get better and have better tools, and yeah, that's it. Yeah, I like that. So, you spent that time basically learning the best way to set it up for yourself, and then creating the templates and outlines that suit you best. Awesome, yeah. And sometimes I receive some messages about, Can you share me your process? or things like that. And yeah, I can do it if you want.

but you will not apply because, uh, it's not yours. You are not proud of it, or, and, yeah, it doesn't give you any happiness, or, or what. And so, building your own process will make you better, and you will really enjoy your journey because you are getting better, but it's not because of anyone else. It's just because of yourself, and you have built everything to become good. So, yeah, I love that. Cool. I think that was all the questions and the replies. Um, yeah, thank you. Thank you so much again for this. I see some right now on the, oh, maybe on your post. That's a good point. Yeah, on the space directly, like, there is, how did you prepare to do competition? Did you already got experience in s? Um, so, I did not get any experience from Sana, but I have experience in Rust, which really helps. Um, but, yeah, Solana, the thing is, you may know Rust, but Solana has a really strange, compared to Ethereum, way of handling the data. Uh, in Ethereum, when you have a contract, your code and your data about this code is really

attached while in Sana it is two different things, and you can use different data with the same code. Uh, so yeah, there are a lot of issues with that. Uh, but reading the docs and understanding how it works takes time. Uh, I was pretty happy to rank this good in INAS, but yeah, now that I have done multiple audits in S, I feel more confident for sure. But yeah, S is pretty different than E. Can you see any more questions on your side? I'm just having a look through now. Yeah, there is someone asking how did you learn about new vulnerabilities or way to look at them. Uh, and he also asked if I read solo report. Uh, I don't read solo report. I may have read once, one or two, maybe, maybe two, but uh, that's not something that makes me feel. Yeah, I, I don't like it, so I don't do it. Uh, but yeah, the thing is when you are reading a solid report, you don't have the, you don't understand the protocol behind it. Uh, and you don't understand

how it works. This is the part I was explaining in the threat model. Uh, and if you don't have that knowledge, how can you understand the issue? Uh, and be able to ident ify. Would you have missed it in these conditions? Yeah, basically, it's just taking something out of context and trying to understand it. And you can't apply it to yourself because you were not there to work on this audit. So, yeah, just my advice would be to stop doing solo reports reading. Just take one contest that you like or inspire you at the time. Do it. Try to understand everything. Try to fun. Try to find bugs. You may be surprised because you find something that you didn't expect. Or, and once the results are out, you can just take those results, analyze all of them, and this time you have the context because you audited this code base. And then you can apply what I told before. Uh, analyzing what did you miss it and increase in that. And you are also asking how to find ways to look at them. You will see that by analyzing bugs.

that you missed. You will for sure identify new attack vectors, but you will have some intuition, some attacker mindset that helps a lot in finding bugs. So, this is the thing I was talking about when I say that now, just by having the way the protocol works, I can identify where it can break, where it has the most probability of breaking. So, yeah, this is coming from this intuition that you build. You can't read some article and get it; you have to work it, and it comes with time and effort, learn by doing. And there is the last one: do you do multiple contest audits in parallel? I guess because, yeah, I do, because I think that most of the bugs I found are in the deep focus time that I talked about, and the rest of the time that I have, it's not that focused, and so I can prepare my next audit during auditing another one. So, it's just, yeah, I have some, I can do multiple at once, but as long as the DAT

Focus sections are like properly deep focus. Yeah, yeah, I gotta cool. All right, one last call for questions. You've got 30 seconds to ask them if anyone's got anymore. I think we might be good. Yeah, I think there is some delay. Yeah, now this has been awesome. And um, I will be uploading it to the Cana YouTube channel as well for people who weren't able to join live. Any um, any parting words of wisdom from yourself s. Oh, can you repeat please? Did you uh, did you have any like last final points um, anyone listening um, yeah um, I think that the most important thing is that you must enjoy your journey. If you are, I saw some tweet today about someone saying that he didn't don't like what he do but discipline helps him. I I think that having some discipline is important because you can't enjoy 100% of what you are doing but for sure if you don't like what you are doing for example you are just here for the money.

or you will not enjoy it, and it will not work at the end for sure. Uh, so just find the way that you enjoy the things, and I think security research can be, um, yeah, like people wants to Ed it because it has a lot of money, but I guess some people don't even like it, uh, and may prefer developing or anything else. So yeah, that that's that's my point. Just try to have fun in what you do, you do, and because at the end this is what matters. Beautiful. I agree wholeheartedly. Thank you again so much, and I will talk to everyone later.

The Security Researcher Journey with Zigtur | Cantina

Cantina

보안 연구원이 되기 위한 Ziga의 여정

현재 스피릿의 보안 연구원이자 R Skills의 강사로 활동 중인 지가는 칸의 리더보드에서 2위로 급부상한 비결을 공유합니다.

그의 여정은 비기술적인 사이버 보안 교육과 임베디드 시스템 보안 견습생으로 시작되었습니다.

퀀텀 이후의 블록체인에 관한 중추적인 프로젝트를 통해 솔리디티 부트캠프에 참여하게 되었고, 그곳에서 보안 연구 분야에서 탁월한 능력을 발휘하는 데 필요한 기술력을 습득했습니다.

격자를 암호화에 사용하는 팔콘 알고리즘은 양자 컴퓨터로부터 거래를 보호하는 것을 목표로 하지만 서명 크기가 커서 실제 사용에는 실용적이지 않습니다.

0 보안 감사 여정은 대회에서 5달러를 획득한 것으로 시작되었고, 이후 대회에서 21위를 차지하면서 전환점을 맞이했습니다.

발표자는 초기에 어려움을 겪었던 이유를 파악하면서 향후 성공을 위해 프로토콜 목표를 이해하고, 워크플로를 시각화하며, 잠재적인 취약점을 파악하는 것이 중요하다고 강조합니다.

코드베이스 관리의 주요 워크플로 및 중점 전략

코드베이스에서 가장 중요한 5가지 워크플로를 파악하는 것은 잠재적인 문제를 결정하는 경우가 많기 때문에 매우 중요합니다.

수면, 식이 요법, 신체 활동을 통해 좋은 에너지를 유지하면 집중력과 생산성이 향상됩니다.

심층 작업, 메모 작성, 어려운 코드 영역 해결은 버그를 발견하고 코드베이스에 대한 이해를 높이는 데 필수적인 전략입니다.

버그 헌팅에서 수동 검토의 중요성

수동 검토는 순위에 영향을 줄 수 있는 어려운 버그를 식별하는 데 매우 중요하며 코드 베이스에 대한 귀중한 지식을 제공합니다.

이 프로세스에는 피드백 루프가 포함되며, 놓친 취약점을 문서화하고 체크리스트를 사용하면 학습을 강화하고 향후 감사를 개선하는 데 도움이 될 수 있습니다.

대회를 통해 경험을 쌓는 것도 중요하지만, 놓친 문제의 근본 원인을 이해하고 업무 프로세스를 수정하는 것이 그 경험에서 최대한의 가치를 이끌어내는 핵심입니다.

성공적인 감사를 위해서는 경험을 쌓는 것이 중요하며, 자신만의 방법론을 개발하는 것이 핵심입니다.

코드 베이스를 시각화하면 잠재적인 문제를 식별하는 데 도움이 되며, 버그를 발견하려면 집중력이 필수적입니다.

팀과의 협업을 통해 명확한 설명과 지원을 제공할 수 있으므로 리뷰에 대한 접근 방식은 경쟁사와 다름니다.

드로잉과 코딩을 VS 코드와 통합하기

발표자는 VS Code 확장 프로그램을 사용하여 화면을 분할하여 도면과 코드를 동시에 볼 수 있습니다.

투명한 순위 시스템 덕분에 리뷰보다 대회에 더 매력을 느낀다고 합니다.

발표자는 프로그래밍 경험도 도움이 되지만, 누구나 충분한 집중과 연습을 통해 코드 로직을 이해하고 분석하는 방법을 배울 수 있다고 믿습니다.

성공을 위한 나만의 프로세스 구축

외부 요인에 의존하기보다는 자신만의 프로세스를 만드는 것이 개인의 성장과 행복을 위한 핵심입니다.

Rust에 대한 경험이 도움이 될 수 있지만, 솔라나의 독특한 데이터 처리 방식은 어려울 수 있습니다.

혼자 보고서를 읽는 대신 콘테스트에 집중하여 결과를 분석하면 중요한 맥락을 파악하고 놓친 문제를 파악하는 데 도움이 될 수 있습니다.

공격자의 사고방식과 직관을 개발하는 것은 프로토콜의 잠재적 취약점을 식별하는 데 매우 중요합니다.

버그를 찾기 위해서는 집중적인 시간이 필수적이므로 여러 번의 감사를 동시에 수행하는 것이 효과적일 수 있습니다.

보안 리서치에서 장기적인 성공을 거두려면 여정을 즐기고 일에 대한 열정을 찾는 것이 중요합니다.