Web3 Security Researcher ZK Student at @RareSkills_io Profile: https://xitter.cf/t.co/EN2M4JSRyV
Joined May 2019
- Tweets600
- Following356
- Followers1.1K
- Likes1.9K
Pinned Tweet
Wow! I am speechless. Making the top 10 in the UniswapV4 competition was something that I never expected in my wildest dreams. Thanks @cantinaxyz and thanks to the sponsors at @Uniswap for hosting such a great competition!
So protocols with exploitable bugs gated behind "trusted" actors can have someone sitting on an exploit, waiting for the right moment to flip the switch and make additional money.
Now imagine being able to profit not just from exploiting the vulnerability, but from betting on when it happens.
NEW: @DefiLlama AND @Trueo_ LAUNCH PREDICTION MARKETS ON PROTOCOL REVENUE AND EXPLOIT ODDS
Problem with submission fees in BBPs is that SRs are not refunded for submitting valid work. If triage and fixes are too slow, SRs will be burning money to no fault of their own. It turns bounties into pay to play
The Firedancer bug bounty platform is live at bounty.firedancer.io! Now thru Nov 20th: 2x rewards across the board; 3x for Alpenglow.
We’re sharing our experience running a $1,000,000 bounty contest: how Firedancer’s security model works, notable bugs researchers found, what we learned, and some lessons about triaging AI-assisted reports at scale.
Read it here. jumpcrypto.com/resources/har…
This is technically false. Sherlock never started with a validity ratio requirement. The validity ratio was applied retroactively a few years ago to combat spam when the old USDC penalty system wasn't working. So, many researchers didn't sign up for this.
@jack__sanford has been getting heat for not bending the knee and not paying out rewards that were not eligible to be rewarded in the first place.
Researchers knew the rules going in and regardless of not meeting the ratio, they demand payment. This type of unwarranted entitlement and incessant griping is what is wrong with society. Everyone expects now what is not due to them and villainize the system that even gave them the opportunity in the first place. Without Sherlock and C4 giving opportunity to unknown and new researchers, you would have almost no way to prove yourself as a researcher and potentially earn while learning.
If you continue to moan and cry over these rules you willingly accepted to begin with then you are not going to make it in this tough world. There will be times when you actually worked hard and did everything right and will not be compensated. You can choose to ruminate over what could have been, or you can move on and try to find success regardless of what has occurred.
This is harrowing stuff. Most participants who actually found a valid bug are in the negative after the $25 submission fee.
114 of 135 valid finders earned less than their fees. 52 got $0, mostly for valid Highs.
Refund fees on valid findings.
The @Firelightfi Audit Competition is a wrap!
🏆 Top Winners:
🥇 @aussinfosec - $7,960
🥈 @Tradi3_ - $3,591
🥉 @buganbug - $1,783
Congrats to all participants & winners! 🎖
Most Defi projects are dead or struggling within ~3 years unfortunately. By the time it gets into the hands of whitehats, the project barely has money to keep the lights on, let alone pay the SR. The trick was always to get in early in the form of private engagements.
I personally haven’t said anything about this because it’s been nothing but uttermost pain seeing how we whitehats are being treated with not even a single recognition or even as simple as “Thank you” sometimes from the protocols.
Since the overwhelming increase in the number of security researchers participating in bug bounties and audit competitions on bug bounty platforms (@immunefi) leading to the rise in duplicates and undefined closures of vulnerabilities reported, I then decided to fully move into Private Audits focusing on only Critical/High severity vulnerabilities on all blockchains on @DefiLlama and over the past few months.
I have audited >60 chains and found multiple C/H findings but sadly I have only been able to communicate directly with less than 5 chains of which they are still even here to give me a first response or acknowledgement that they have even seen my report and are looking into it which is so disappointing.
I honestly don’t know what to say again as i am slowly giving up the discipline of reporting directly to their teams but instead now want to be posting my findings publicly on here as an article hopefully it will draw their attention.
@Meter_IO @VictionEco @iota and so much more out there…. BE WARNED ‼️
I don't want this post to look like I am grave dancing, but I think that the Moonwell bug bounty program on Sherlock had a significant scope gap that concealed this exploit
Blockaid’s Exploit Detection identified suspicious activity against @MoonwellDeFi on Base.
An attacker manipulated MAMO collateral pricing to borrow cbBTC from the mCBTC market.
Observed impact so far: 50.6 cbBTC ($4.0M+) drained
More details to follow. 🧵
This is not a good sign for a 14k contest. Add in the $25 submission fee and there is a good chance that most of the participants will find themselves in the red for participating
This quoted post is unavailable.
Acala went from having a $500,000 max bounty to $1,000 as of today. There are also some others (e.g. Pinto). The reality is that most web 3 projects have 2-3 year lifespan and security rewards those who come first, and not those who are necessarily better
What happened to bug bounty?? immunefi.com/bug-bounty/acal…
Took a few months, but we finally got some great opportunities; a million dollar contest on immunefi and a 550k contest on Sherlock
The @jump_firedancer Audit Competition is live! ⚡️️
A $1,000,000 scaling reward pool is up for grabs for finding eligible bugs in the Firedancer V1 code
📅 April 9 - May 9 2026
💰 Scaling reward pool of up to $1,000,000
⌨️ Language: C
✅ KYC required
Get hunting: immunefi.com/audit-competiti…
Let’s be real: this is embarrassing. Seeing this and recent Monad C4 drama makes me wonder why this space treats contest players and bug bounty hunters so poorly? They are the last line of defense. Keep this up, and they will either walk away or turn into blackhats.
We should not allow this to become the new norm in security research. This must change.
gist.github.com/marikravets/…
#BugBounty #CryptoSecurity #Web3 #SecurityResearch
@cantinaxyz @MonadOfficvn @monad @bountywriteups @VitalikButerin
Great article for learning ZK security. On another note, how am I just now hearing about this $500k bug bounty? Clearly need to do a better job curating my feed. Recommendations for who to follow in the ZK/Audit space?
Added my portfolio to my profile. Some stuff is a work in progress but happy to see my latest result reflected and crossing the 50K mark
The C4 report for Succinct is out. This is a great resource for those learning ZK *Security*. I came in top 5 in this contest, finding the only high finding, but there are plenty of solid Medium finds that I unfortunately didn't catch. I think it will be good to go over each one of them in the future, since it wasn't that many
code4rena.com/reports/2025-0…
IMO the protocol already believes their code is secure. The contest is mainly a signal to users that due diligence was done, even if they know it won’t attract elite SRs. At this stage it’s more about optics and reassurance than security.
Why not a bug bounty after 7 audits for 6 months with conditional pot $0 if no H/M?
"Live audit contest" H/M pool of $96,000 🤔
- Securing $1B TVL
- Launched in September
- $70k fees generated daily
- 35% Solana marketshare (defillama.com/protocol/jupit…)
I know this is a joke, but contests/BBPs already function like unpaid internships—minus the mentorship, structure, or career path. When satire mirrors reality this closely, something’s broken.