If you do Web3/Solidity freelance work or take “technical assessments” from clients you don’t know well, watch for this scam.

You get a repo or zip that looks legitimate — Compound-style contracts, token vaults, README asking you to fix issues and commit to an assessment branch. The trap usually isn’t in the Solidity files. It’s in .git/hooks/.

What happens

When you run:

• git commit
• git push
• git checkout

a hidden hook may download and run a remote script in the background (often via curl or wget piped into cmd, sh, or bash). Typical goal: steal browser wallet data, saved passwords, clipboard content, and dev keys from your machine.

This is not a “connect MetaMask on the website” scam. It hits developers who only run git and never open the app.

Names seen in the wild (not a complete list)

Repos are often named like fake company or project assessments (e.g. names suggesting smart contracts, token vaults, or “Bellus”-style DeFi work). The pattern matters more than the exact folder name: fake hiring task + poisoned git hooks.

Check BEFORE any git command

From the repo root:

cat .git/hooks/pre-commit
cat .git/hooks/pre-push
cat .git/hooks/post-checkout

ls -la .git/hooks/

Red flags:

• curl or wget piped to | cmd, | sh, or | bash
• Downloads from an unknown remote server
• Obfuscated shell code
• Custom hook files that aren’t the default *.sample files Git ships

Fresh clones from strangers should only have .sample hooks unless you installed something trusted.

How to protect yourself

1. Read every file in .git/hooks/ before your first commit or checkout.
2. If you only need to review code, extract the zip and delete the .git folder — or don’t run git at all.
3. Use a VM or separate machine for unknown client code, not your daily PC with wallets installed.
4. Use a hardware wallet for real funds; don’t enter a seed phrase on a dev machine.
5. Be wary of clients who rush you to “commit and send the zip back” without a normal interview process.
6. Delete suspicious repos after reporting; don’t keep using git in them.

If you already ran git in a suspicious repo

Treat the machine as potentially compromised:

• Run a full antivirus scan plus an offline boot scan if your AV supports it
• Change email and important passwords from a different, clean device
• Assume any wallet used on that PC may be at risk — use a new seed on clean hardware for future funds
• Revoke old token approvals through your wallet or a reputable approval-revocation toolIf you do Web3/Solidity freelance work or take “technical assessments” from clients you don’t know well, watch for this scam .You get a repo or zip that looks legitimate — Compound-style contracts, token vaults, README asking you to fix issues and commit to an assessment branch. The trap usually isn’t in the Solidity files. It’s in .git/hooks/.What happensWhen you run:git commit git push git checkouta hidden hook may download and run a remote script in the background (often via curl or wget piped into cmd, sh, or bash). Typical goal: steal browser wallet data, saved passwords, clipboard content, and dev keys from your machine.This is not a “connect MetaMask on the website” scam. It hits developers who only run git and never open the app.Names seen in the wild (not a complete list)Repos are often named like fake company or project assessments (e.g. names suggesting smart contracts, token vaults, or “Bellus”-style DeFi work). The pattern matters more than the exact folder name: fake hiring task + poisoned git hooks.Check BEFORE any git commandFrom the repo root:cat .git/hooks/pre-commit cat .git/hooks/pre-push cat .git/hooks/post-checkoutls -la .git/hooks/Red flags:curl or wget piped to | cmd, | sh, or | bash Downloads from an unknown remote server Obfuscated shell code Custom hook files that aren’t the default *.sample files Git shipsFresh clones from strangers should only have .sample hooks unless you installed something trusted .How to protect yourselfRead every file in .git/hooks/ before your first commit or checkout. If you only need to review code, extract the zip and delete the .git folder — or don’t run git at all. Use a VM or separate machine for unknown client code, not your daily PC with wallets installed. Use a hardware wallet for real funds; don’t enter a seed phrase on a dev machine. Be wary of clients who rush you to “commit and send the zip back” without a normal interview process. Delete suspicious repos after reporting; don’t keep using git in them.If you already ran git in a suspicious repoTreat the machine as potentially compromised:Run a full antivirus scan plus an offline boot scan if your AV supports it Change email and important passwords from a different, clean device Assume any wallet used on that PC may be at risk — use a new seed on clean hardware for future funds Revoke old token approvals through your wallet or a reputable approval-revocation tool

Hey r/defi,

The protocol is called Brokex, a perpetual futures DEX I’ve been building solo for over a year.

I originally developed it on Pharos Network testnet where it got decent traction (~70 million in simulated trading volume) and received a small grant. However, after their mainnet launch and team changes, they stopped supporting the project.

I continued developing it myself and now have a complete stack: frontend, backend, keeper and smart contracts.

Current plan for V1:

• Very small launch with only $5-6k liquidity
• Starting with just 1 asset (likely XAU/USD Gold)
• Trading against the vault (simple model)
• On an EVM L2 (thinking Base or Arbitrum)

Risks (as required):

• The contracts are unaudited (I cannot afford a proper audit right now, which is a significant risk).
• Very low liquidity means high risk of bad executions, slippage, and potential losses for users.
• As a small solo project there is smart contract risk and potential for exploits.

I’m looking for honest feedback from the community:

• Is launching with such low liquidity realistic?
• Which L2 would you recommend for this kind of small launch?
• Any major red flags with this approach?

Looking for technical and practical advice. Thanks in advance.

Every time I sit down to build a smart contract, I hit the same wall. Decentralization, security, scalability, you only get 2.

The more audits I do, the more obvious this becomes. Yet every project markets itself as having all three nailed.

99% of crypto projects marketing "decentralized AND scalable AND secure" are scamming you on at least one of those words.

The trilemma is real. Pretending it doesn't exist is how people lose money.

Do you actually factor this in when picking projects, or is everyone just ignoring it until they get burned?

Hello, I’m looking for some help putting together a proposal for a real world asset tokenisation platform

Looking for a few hours of consultancy from someone who can advise on smart contract architecture, NAV attestation and token issuance

Clearly this would be a paid engagement - a few hours- and there could be potential for this to become a long-term project if we’re successful

please drop a comment or DM if you have relevant experience