Security happens to be a topic i have highlighted in a number of ways previously, so I’d make sure not to sound like a broken cymbal.
Web3 contract security is fundamentally broken with billions lost every year to exploits that someone probably saw coming, but the warnings never got to people.
Many teams treat security like a one-time thing - pay for audit, publish a pdf or an X post, and that’s it. But audits can miss up to 80% of flaws, cost a fortune, and go stale the moment the protocol upgrades, adds new integrations, or composability shifts introduce fresh attack surfaces.
We’ve seen this movie before:
1. Nomad protocol hack of 2022 ($190M) where its own audit had already flagged the vulnerability that would later be exploited but it was only ‘acknowledged’ and was never resolved until it was exploited.
Quantstamp audit (June 6, 2022) — QSP-19 “Proving With An Empty Leaf” — Status: Acknowledged.
2. A full year before ~$25M was lost in the imBTC (Lendf.me) reentrancy exploit, OpenZeppelin had publicly shown how ERC-777 tokens could be exploited, yet protocols never adapted and users remained unaware of the risks involved.
These two cases cost users their hard earned money because they were in the dark; not because the knowledge wasn’t there, but because it never made it into the hands of users, developers, or tools at the time.
Users are expected to read some ancient-scroll-of-uncertain-origins audit report to stay afloat, or have to hit into telegrams and query no high-school-level understanding of what the code says. Either way, it remains a dead-end with costly consequences (drain, hacks, loss).
But what if security expert warnings didn’t live in PDFs and scattered articles?
What if the warnings were live, ranked, and showed up pre-click?
Enter Intuition:
A public onchain “fact board” where teams post the real details of a project, contract addresses, codes, and others (developers, researchers, users, etc.) can co-sign or flag them (stake-based confidence) just like you vouch on ethos. Apps can then read the best current answer before a user clicks.
How reputation-based warning system can work with Intuition:
-
security expert can make claims about contracts vulnerable to flashloan attack or reentrancy, etc. when they emerge.
-
they stake ($$) on these claims which means Signal.
-
if right, they earn rewards and stronger reputation; and vice versa.
-
scores can be set to decay over time, i.e., if no one updates it, the system assumes risk info is old and becomes less trusted.
-
the user during interaction (swaps, LPs) with the contract receives notifications like:
23% Risk — 12 experts flagged a reentrancy vulnerability, updated 3 hours ago
94% Safe — reviewed by 8 auditors, last checked 2 days ago
This way, users are protected, cost is cut, one-time audits become continuous monitoring, and tools (wallets, ai agents, aggregators) can automatically choose safer contracts to interact with. Security won’t depend on whoever reads the right pdf, instead a live signal that updates fasts as the risks do.
Also, as we move into a world where AI agents will do more than approve transactions on our behalf, Intuition becomes compulsory. Making stake-weighted human expertise the source of truth for agents, humans, and tools.
That’s the shift Intuition is bringing to the table.
I hope team finds it interesting and intuitive as well… gm!
X handle: @pgreyy