🦉enjoy code & life-long learning · customer first · Security Researcher @cantinaxyz 🪐 · https://xitter.gq/t.co/hVmGgV1lkg
Joined September 2021
- Tweets90
- Following156
- Followers519
- Likes16
🥳My first bounty in @cantinaxyz. Maybe I should have joined Cantinaxyz earlier.
yttriumzz retweeted
The Top 10 Blockchain Hacking Techniques 2nd Edition is out.
The industry’s compilation of the 10 most novel, interesting, and unexpected smart contract hacks and bugs.
From the governance hack of Tornado Cash using metamorphic contracts, to the billion-dollar exploit targeting validators' private keys and a straightforward and innocent function costing $200 M, this edition unfolds an enthralling narrative of ingenuity and caution.
Curated by the community and a panel of the best white hats in the world :
- @samczsun, Head of Security at Paradigm
- @exceed_silence, Principal Security Researcher at OpenZeppelin
- @tinchoabbate, Ethereum Security Researcher, Creator of Damn Vulnerable DeFi and The Red Guild
- @gf_256, Co-Founder of Zellic and Perfect Blue
- @AshiqAmien, Independent Security Researcher
- @PwningEth, Security Researcher, Co-Founder of Offside Labs
- @iphelix, Creator of BlockThreat
- @gpersoon, Independent Security Researcher
Enjoy it, the link is below 👇
#ImmunefiWrapped
🥳It would be nice if it were later. I just received a reward of 30,000 USDC recently.
They have been confirmed as High and Medium. I'm a little confused, I think they're underrated.🥲
Once I get permission, I'll write the write-up.
1
2
589
I recently studied a well-known ZK L2 node and found two bugs:
- Bug1 can be directly exploited to cause the node to be unable to process new transactions.
- Bug2 is a potential (not yet enabled) protocol-level bug cause the node to be unable to verify new transactions.
1
14
2,855
When I thought I found a reentrant bug😎
When I learned that fallback() was limited to 2300 gas🤡
1
6
577
Very slow, but at least it works. Every time I spend a lot of time adapting fuzzer.🥲
It’s also good to occasionally research non-Web3 projects.
1
1
771
🚀
#LeaderboardWeeklyUpdate!
Here are some of the whitehats on fire this week:
👉 LonelySloth: moved to 6th from 7th!
👉 yttriumzz: moved to 62nd from 74th!
👉 cergyk: moved to 43rd from 55th!
Congratulations to all!
immunefi.com/leaderboard
4
723
I think this should be determined by the project. @immunefi should have strict requirements and the project chooses whether to be lenient on the basis.
The platform can show the whitehat's historical submission paid/dup rate to the project for decision. 👀
This is common problem for all of us @immunefi @MitchellAmador
Have you thought of allowing whitehats to skip POC if their accepted reports are above certain threshold and if ratio of accepted/total > some threshold
Whitehats with X amount of accepted reports are less susceptible to just spam
And lets say they do it in rush to be first for new bounties, their paid/total ratio would drop eventually, forcing them to provide POC from next time.
1
5
1,225
yttriumzz retweeted
#LeaderboardWeeklyUpdate!
Here are some of the whitehats on fire this week:
👉 Trust: moved to 35th from 36th!
👉 yttriumzz: moved to 73th from 75th!
Congratulations to all!
immunefi.com/leaderboard