@taichiaudit Founder | Whitehat doing mediations @Immunefi | Core Member @DeFiHackLabs
GMT+8
Joined January 2018
- Tweets3.1K
- Following3.9K
- Followers2.6K
- Likes8.4K
Unfortunately I had one very similar case on cantina today lol, an unfixed critical marked duplicate and it shows the original report was rejected and I can't see the details.... Again I am very confused but that's the norm of beg bounty now, moving on to next target
Update: Immunefi upheld the duplicate closure.
Their own fix-bypass policy says a bug that wasn't effectively fixed should be reported.
That's exactly what I did. The PoC in my report still works after the attempted fix.
Yet their mediation response didn't even mention the fix-bypass policy.
So what's the point of having it?
Why would any whitehat spend time checking whether a fix actually works if the answer is still "duplicate, no reward"?
I thought Immunefi was supposed to keep this fair.
Instead, they're keeping their clients happy.
Submitted 2 High severity bounty reports to Cantina and let's see how it goes😜Wish me luck and mental health
Like what I always say, in web3 everyone will be scammed, including security researchers. This is called the Fundamental Theorem of Web3.
I will never understand why a fund loss bug is private known issue, but I guess that is life, you will never understand everything, just move on with confusion and accept it.
It was my mistake that I didn’t see this tweet earlier
Also I found this rule was added after my submission time and before mediation time. We quote things based on mediation time instead of submission time now? Why?
Paid $250 bucks for a mediation and got closed after 25 minutes with this response, stay away from this scam. Do not pay for mediation.
Paid $250 bucks for a mediation and got closed after 25 minutes with this response, stay away from this scam. Do not pay for mediation.
Immunefi can refund this, no big deal. The real problem is "private known issue" can't be proved. Studio says report is good, triager says report is good, protocol closes your report with private known issue but no evidence whatsoever and it is over.
I decided to give Immunefi Studio Review a shot before submitting a High severity finding.
The submission for this particular program costs $75 so I decided to pay $20 for a Studio review first to sanity-check the report.
Immunefi Studio came back with "Ready" - "meets standard escalation criteria with no blocking technical flaws".
To be fair, it suggested a couple of improvements to the PoC which I applied to the report before submitting.
So I paid the $75 and submitted.
15 minutes later, my favorite guy Andrew closed it as a duplicate of a report submitted 9 days earlier.
So that's $20 for Studio Review + $75 submission fee = $95 to have one Immunefi bot tell me "send it" and another Immunefi bot tell me "duplicate report".
That's the part I'm struggling with.
Immunefi Studio is explicitly advertised as checking duplicate risk too.
If a duplicate has already been sitting in your system for 9 days and the Review bot can't catch it, but the triage bot catches it almost immediately after submission, then what exactly is the value proposition here?
@immunefi / @MitchellAmador - I genuinely think this is useful feedback if you're still iterating on Immunefi Studio.
But from the whitehat side, this flow feels pretty broken.
Especially when it costs $95 to get to this outcome.
My 16th bug bounty on @immunefi (haven't posted for a month because I have several confirmed but downgraded severity reports and I am waiting for free mediation slots, paid too many, won't pay anymore) #immunefitribe immunefi.com/s/ss/?severity=…
One of my bounty report was closed for being a “duplicate of some internal finding” and I can’t see the content. Opened a ticket and got response saying I should do mediation which means I will have to pay 250 bucks. In such case I guess I should just forget about it right?😂
Very useful repo where you can collect evidence, but I still recommend to save a snapshot like wayback machine, in my understanding that snapshot is more convincing. It doesn't hurt to have more evidence.
You might find this helpful: github.com/infosec-us-team/I…
Bug bounty tip learned the hard way: when you submit report, save a wayback machine snapshot or similar public evidence to avoid unnecessary arguing. Protocol can ghost your report and add "out of scope" rules during that time and close your report, you need evidence to flip it
I remember you froze fund in a recent hack, how you suddenly turned permissionless?😂
We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved.
THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain.
What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?
@star_okx @GracyBitget
Yeah my ranking will be much higher if confirmed bugs are paid faster😂Please!
In just six weeks, @ret2basic has had 17 confirmed or paid reports. That is almost three per week.
He has found bugs across a range of attack surfaces, including Web/App, Smart Contracts, and Blockchain/DLT.
He now sits at 45 on the 90-day leaderboard, but with multiple confirmed but unpaid reports still in the pipeline, he'll likely break into the top 20 very soon.
Do you think you can take a spot on the leaderboard?
