Web3 Security Researcher ZK Student at @RareSkills_io Profile: https://xitter.gq/t.co/EN2M4JSRyV
Joined May 2019
- Tweets609
- Following362
- Followers1.1K
- Likes1.9K
Pinned Tweet
Wow! I am speechless. Making the top 10 in the UniswapV4 competition was something that I never expected in my wildest dreams. Thanks @cantinaxyz and thanks to the sponsors at @Uniswap for hosting such a great competition!
I just found a bug and got paid on @immunefi immunefi.com/bug-bounty/
A good first step, but credits have an expiration date. This keeps SRs with big credit balances into the Immunefi ecosystem and forces them to begrudgingly submit reports and subscribe to unwanted services in a use it or lose it situation. I'd rather have my money back.
Immunefi Credits are live.
You now receive credits equal to the fees you paid on valid work, backdated to the day fees began.
More than 700 researchers already have theirs. Here’s how it works.
5
276
This is all dependent on the protocol. Some protocols paid out money for invalid findings as goodwill while others downgrades/scam SRs out of critical bugs. Unfortunately SRs don't know who to trust until after the report is sent
If you’re a security researcher doing Bug Bounty in blockchain, don’t waste your time reporting it unless it’s a zero-day with no preconditions that can affect millions of dollars today without much effort. If your vulnerability can’t do that, good luck getting a decent bounty honestly even zero-days aren’t guaranteed to be properly paid in today’s economy.
1
9
597
So protocols with exploitable bugs gated behind "trusted" actors can have someone sitting on an exploit, waiting for the right moment to flip the switch and make additional money.
Now imagine being able to profit not just from exploiting the vulnerability, but from betting on when it happens.
NEW: @DefiLlama AND @Trueo_ LAUNCH PREDICTION MARKETS ON PROTOCOL REVENUE AND EXPLOIT ODDS
2
119
Problem with submission fees in BBPs is that SRs are not refunded for submitting valid work. If triage and fixes are too slow, SRs will be burning money to no fault of their own. It turns bounties into pay to play
The Firedancer bug bounty platform is live at bounty.firedancer.io! Now thru Nov 20th: 2x rewards across the board; 3x for Alpenglow.
We’re sharing our experience running a $1,000,000 bounty contest: how Firedancer’s security model works, notable bugs researchers found, what we learned, and some lessons about triaging AI-assisted reports at scale.
Read it here. jumpcrypto.com/resources/har…
4
235
This is technically false. Sherlock never started with a validity ratio requirement. The validity ratio was applied retroactively a few years ago to combat spam when the old USDC penalty system wasn't working. So, many researchers didn't sign up for this.
@jack__sanford has been getting heat for not bending the knee and not paying out rewards that were not eligible to be rewarded in the first place.
Researchers knew the rules going in and regardless of not meeting the ratio, they demand payment. This type of unwarranted entitlement and incessant griping is what is wrong with society. Everyone expects now what is not due to them and villainize the system that even gave them the opportunity in the first place. Without Sherlock and C4 giving opportunity to unknown and new researchers, you would have almost no way to prove yourself as a researcher and potentially earn while learning.
If you continue to moan and cry over these rules you willingly accepted to begin with then you are not going to make it in this tough world. There will be times when you actually worked hard and did everything right and will not be compensated. You can choose to ruminate over what could have been, or you can move on and try to find success regardless of what has occurred.
1
9
992
This is harrowing stuff. Most participants who actually found a valid bug are in the negative after the $25 submission fee.
114 of 135 valid finders earned less than their fees. 52 got $0, mostly for valid Highs.
Refund fees on valid findings.
The @Firelightfi Audit Competition is a wrap!
🏆 Top Winners:
🥇 @aussinfosec - $7,960
🥈 @Tradi3_ - $3,591
🥉 @buganbug - $1,783
Congrats to all participants & winners! 🎖
4
28
1,979
Most Defi projects are dead or struggling within ~3 years unfortunately. By the time it gets into the hands of whitehats, the project barely has money to keep the lights on, let alone pay the SR. The trick was always to get in early in the form of private engagements.
I personally haven’t said anything about this because it’s been nothing but uttermost pain seeing how we whitehats are being treated with not even a single recognition or even as simple as “Thank you” sometimes from the protocols.
Since the overwhelming increase in the number of security researchers participating in bug bounties and audit competitions on bug bounty platforms (@immunefi) leading to the rise in duplicates and undefined closures of vulnerabilities reported, I then decided to fully move into Private Audits focusing on only Critical/High severity vulnerabilities on all blockchains on @DefiLlama and over the past few months.
I have audited >60 chains and found multiple C/H findings but sadly I have only been able to communicate directly with less than 5 chains of which they are still even here to give me a first response or acknowledgement that they have even seen my report and are looking into it which is so disappointing.
I honestly don’t know what to say again as i am slowly giving up the discipline of reporting directly to their teams but instead now want to be posting my findings publicly on here as an article hopefully it will draw their attention.
@Meter_IO @VictionEco @iota and so much more out there…. BE WARNED ‼️
2
163
I don't want this post to look like I am grave dancing, but I think that the Moonwell bug bounty program on Sherlock had a significant scope gap that concealed this exploit
Blockaid’s Exploit Detection identified suspicious activity against @MoonwellDeFi on Base.
An attacker manipulated MAMO collateral pricing to borrow cbBTC from the mCBTC market.
Observed impact so far: 50.6 cbBTC ($4.0M+) drained
More details to follow. 🧵
This is not a good sign for a 14k contest. Add in the $25 submission fee and there is a good chance that most of the participants will find themselves in the red for participating
This quoted post is unavailable.
2
17
1,765
Acala went from having a $500,000 max bounty to $1,000 as of today. There are also some others (e.g. Pinto). The reality is that most web 3 projects have 2-3 year lifespan and security rewards those who come first, and not those who are necessarily better
What happened to bug bounty?? immunefi.com/bug-bounty/acal…
1
209
Took a few months, but we finally got some great opportunities; a million dollar contest on immunefi and a 550k contest on Sherlock
The @jump_firedancer Audit Competition is live! ⚡️️
A $1,000,000 scaling reward pool is up for grabs for finding eligible bugs in the Firedancer V1 code
📅 April 9 - May 9 2026
💰 Scaling reward pool of up to $1,000,000
⌨️ Language: C
✅ KYC required
Get hunting: immunefi.com/audit-competiti…
