founder @osec_io | web/pwn with @redpwnctf + @dicegangctf | prev @dfsec_com
Joined September 2018
- Tweets598
- Following700
- Followers7.9K
- Likes6.6K
Robert Chen retweeted
This week, @fund_defi, @jump_ ,@paradigm, @SolanaInstitute and @Uniswap submitted a comment letter to @USTreasury on its proposed GENIUS Act Section 3 implementation rulemaking. The GENIUS Act established important statutory protections for DeFi and developers of blockchain technology. We believe that Treasury’s final rule must respect these statutory boundaries.
lots of potential footguns with multisig/mpc setup. great article on in the wild attacks
sirn.org/advisories/sirn-202…
Robert Chen retweeted
Another fun bug, we turned a Linux kernel timer UAF into a kernel read/write on Android, root + SELinux permissive. Great work @ryaagard!
Stay tuned for more 🦦
insightful article from the @jump_firedancer team on running a bug bounty program in the age of AI. would highly recommend reading
happy to have contributed to their security story!
The Firedancer bug bounty platform is live at bounty.firedancer.io! Now thru Nov 20th: 2x rewards across the board; 3x for Alpenglow.
We’re sharing our experience running a $1,000,000 bounty contest: how Firedancer’s security model works, notable bugs researchers found, what we learned, and some lessons about triaging AI-assisted reports at scale.
Read it here. jumpcrypto.com/resources/har…
Robert Chen retweeted
The Firedancer bug bounty platform is live at bounty.firedancer.io! Now thru Nov 20th: 2x rewards across the board; 3x for Alpenglow.
We’re sharing our experience running a $1,000,000 bounty contest: how Firedancer’s security model works, notable bugs researchers found, what we learned, and some lessons about triaging AI-assisted reports at scale.
Read it here. jumpcrypto.com/resources/har…
Another fun bug, we turned a Linux kernel timer UAF into a kernel read/write on Android, root + SELinux permissive. Great work @ryaagard!
Stay tuned for more 🦦
Robert Chen retweeted
turns out that everything's open source (and broken) by default
so grateful to have worked on this at @osec_io
In 2026, no program is closed source.
We decompiled a propAMM into Rust that recompiles to the exact on-chain binary, then used it to find a critical bug that put $6.1M at risk.
I gave a talk last year about decompiling Solana programs. Then it was still a novelty.
Fast forward a year, and we can get 100% source recovery. Everything is open source now
Amazing work by @marspiterr
In 2026, no program is closed source.
We decompiled a propAMM into Rust that recompiles to the exact on-chain binary, then used it to find a critical bug that put $6.1M at risk.
Anchor v2 Release Candidate 2 is here!
The TS client library has been rewritten using Kit, integrating Anchor with the modern Solana ecosystem, thanks to @lorismatic!
On the Rust side, Solana dependencies have been updated to be compatible with Agave 4.3. The built-in test helpers now support transaction v1. Instructions also accept a greater range of data types as arguments.
Please try it out and leave feedback at github.com/otter-sec/anchor/…
Last week two of our researchers hacked Oracle Autonomous AI Database with a 4 bug chain. Blog post coming soon 🦦🦦🦦
Great work @deltaclock and @BrunoModificato!
Robert Chen retweeted
Introducing Underdog x Stripe
Shop with Underdog. It finds the best option, saving you money and time. In a local browser, it gets a one-time Link card for the exact amount, and waits for your approval
The first on-device Agent Payment in Underdog: Your Private Personal AI
OtterSec is covering the trip for two people to attend @solana Breakpoint in London, Nov 15-17.
Flight, hotel and ticket all included. Applications open now and will close Oct 21st.
If you're into blockchain security, follow our work, or want to meet other cool people in the space, apply below!
speaking at Groundwork in DC next week, if you're around come say hi!
luma.com/groundwork_dc
Robert Chen retweeted
I’ve been researching @Zcash security as part of our internal work at @osec_io.
Today, I’m happy to share that the total amount I’ll be receiving in bug bounties from @Zcash has finally been confirmed at $972K.
I’m really proud of what came out of this research. More importantly, I’m glad our work contributed to improving Zcash’s security and got more security researchers interested in Zcash. It’s especially great to see that many researchers are still looking into Zcash, finding and reporting bugs, and keeping an eye on its security.
Huge thanks to the teams across the Zcash ecosystem, including @Zcash, @zodl_co, @ZcashFoundation, @ValarGroup, @ShieldedLabs, @TachyonZcash, and @ZcashCommGrants, for taking security seriously and rewarding researchers, and to the entire Zcash community for all the support.
I’ll keep doing my best to find more bugs.
wow.. @gosasu1 earned almost 1 MILLION dollars in bug bounty from @Zcash!
one of the biggest bounties this year. great research, and blog coming soon!
I’ve been researching @Zcash security as part of our internal work at @osec_io.
Today, I’m happy to share that the total amount I’ll be receiving in bug bounties from @Zcash has finally been confirmed at $972K.
I’m really proud of what came out of this research. More importantly, I’m glad our work contributed to improving Zcash’s security and got more security researchers interested in Zcash. It’s especially great to see that many researchers are still looking into Zcash, finding and reporting bugs, and keeping an eye on its security.
Huge thanks to the teams across the Zcash ecosystem, including @Zcash, @zodl_co, @ZcashFoundation, @ValarGroup, @ShieldedLabs, @TachyonZcash, and @ZcashCommGrants, for taking security seriously and rewarding researchers, and to the entire Zcash community for all the support.
I’ll keep doing my best to find more bugs.
Robert Chen retweeted
@StefanDGeorge has been one of the most prolific builders in Ethereum.
Stefan was building back when no one thought Ethereum was going to work.
He built the original Gnosis Multisig, Safe, CowSwap and many other important primitives.
xitter.cf/JaschaSamadi/status/21…
1/
Today @greenfield_cap published an open letter on the @safe Community Forum explaining why we have filed a supervisory complaint with the Swiss Federal Supervisory Authority for Foundations (ESA) concerning the Safe Ecosystem Foundation. Here is why, and what we are asking for.