Hunting Bugs Everywhere | https://xitter.cf/t.co/5Sj1CzQ4zn for private audits
Web3
Joined June 2020
- Tweets1K
- Following490
- Followers1.5K
- Likes6.2K
Beanstalk got hit for ~$4.85M, sorry i mean x100, when someone flash-loaned just enough tokens to grab two of the three Senate seats in one tx, then forced the treasury to sell into a pool they controlled.
Everything happened in the same transaction. No proposal delay, no window for anyone to react. The contracts did what they were written to do. The problem was that a temporary majority could execute immediately.
A lot of governance setups still assume voting power can’t be borrowed for the length of a single block. That assumption keeps breaking.
Railway, the cloud platform many teams use to host backends and deploy apps, just told users to rotate secrets after a possible decryption of customer variables. Investigators separately tracked roughly $371,000 leaving wallets across at least 19 EVM chains.
Most of the $1.18B lost in Q3 did not come from the contracts teams spent months auditing.
It seems that the current work is not good enough to spread the education.
The following are wrong:
1. Non audited commit on top of an audited code (even if they had 200 audits), the risk of having a critical can be from a direct flow or a stacked simple changes
2. Operation security is a must. And the industry keeps proving that...
3. For the first point, fair, you may had excuses. But launching a protocol without an audit?. Not sure what to say tbh
Glad to have helped securing @ChainLabCTU
Institutional real-world asset platforms need security review that reflects how they will operate in practice. We worked with @ChainLabCTU (@CVUTFEL) on an institutional RWA platform for tokenised bonds supporting SME financing on EBSI.
The scope covered two Solidity codebases across bond lifecycle logic, identity controls, custody, account abstraction, recovery, and WebAuthn validation. The engagement combined a private CODESPECT review with a SpecSiege community audit contest.
The case study explains how the two review layers supported broader coverage and helped prepare institutional RWA infrastructure for production. The link to the case study is in the reply ⏬
Business non tech people:
-- pets go, AGI on the corner
JUST IN: OpenAI says its AI agent stole funds from an Ethereum test network wallet it found online.
The agent found a recovery seed phrase disclosed publicly with testnet funds and used that account to pay for its task, without the owner's authorization.
This occurred on the Sepolia Ethereum test network.
Hunter retweeted
Back when I was actively hunting I got 3 five-figure bug bounties from move codebases across Aptos and Sui.
If you are building with move and need a security researcher to review your code, reach out: t.me/schnilch
The last months I realized that income from bug hunting is to unregular for me. Because of this I have decided to move more into private audits and do bug hunt only when I have some free time.
If you are looking for a security researcher feel free to reach out to me here -> t.me/schnilch
Hunter retweeted
The last months I realized that income from bug hunting is to unregular for me. Because of this I have decided to move more into private audits and do bug hunt only when I have some free time.
If you are looking for a security researcher feel free to reach out to me here -> t.me/schnilch
can't researcher exploit the current duplication system?
every line is a root cause at first, then latter we can take our time to escalate the impact, we just need to ensure we are earlier, and do the remaining work latter
honest question to my fellow auditors.
does your firm forces you to push for them on your personal twitter?
you can respond in my DMs
there is that tool that prevents showing tweets that are ai written.
typically those robotic scheduled low quality tweets are targeted towards more exposure to a scrolling developer, so i'm not the audience anyways.
i can't afford to spend time for reading something you can't spend time writing
One of my problems in this space is that i love +100% value delivering.
so far, it made me not establish good connections with some people.
i can't align with alot of stuff, something has to be done/created on our own
The current state of crypto twitter is:
1. people posting their tampered ladger
2. companies tries to ride the counter marketing
and i have a problem with the second for multiple reasons
This case of duplication resembles the issue of naive ai auditors.
@lonelysloth_sec have mentioned this previously. Eventually ai slop printing will point at every line as a root cause of something there. And the full potential of the bug would stay hidden.
Protocol lose the full impact description, and actual work by actual researchers doesn't get rewarded.
And please, i don't want any square head people telling me that ai is a useful tool. This is not related to the discussion right not
When i started bug hunting, i never thought i could find a critical duplicate. Its just illogical.
And from that fact, i went into BB with very high expectations of finding a crit -> getting paid.
Sadly, as you know, this is not the case. And iam not sure how whitehats can win against a black one.
Your Bank went bankrupt.
Your tradings eventually go to.
Your hot wallet got drained.
Your money in ftx got lost.
You got ropped directly under weapons in event.
Your cold wallet got drained.
Your money in defi got drained.
You bought a house and caught a fire storm.
Where else would any one go?
