Korok

Independent Security Researcher | DM for private audits

[Korok @0xKorok]

I’m no technical writing expert but at some point wouldn’t you need to be imprecise like this to keep the content focused on the core result it’s meant to achieve?

If not it just seems like the author runs the risk of having to keep introducing or referencing other articles that fully explained things.

Which may or may not be what the readers want depending on their assumed skill level / prior knowledge.

[Korok @0xKorok]

Entertain-ucation is more true to the content but it just doesn’t have the same ring to it.

While I agree that edutainment isn’t the best resource for serious study I do thinks it’s efficient at exposing people to basic concepts.

That exposure lets you “speak the language” of the field, even if it is at a low level of understanding.

This can be useful in social settings where you want to stand out for asking reasonable questions or expressing interest in a topic. You don’t need to be, and shouldn’t pretend to be, an expert to get value from basic understanding.

I’d be surprised if the group of people confusing edutainment for serious resources is large. Mainly because as a learning strategy it simply wouldn’t work. I do think it can be an initial stepping stone though.

[Korok @0xKorok]

Found an uninitialized implementation contract in a factory. Anyone can initialize it which writes an arbitrary bytes32 to the protocols shared storage.

There is no impact on the overall system (trust me I checked) but I was tempted to initialize it with “Korok was here” as such opportunities to be remembered forever are few and far-between.

I decided to leave it be. Given that it can’t be changed afterwards and becomes part of their core contract. Did I make the right call? Hahaha

[Korok @0xKorok]

I’m motivated by the idea of freedom and controlling my time.

I also think about how cool of a job auditing is. If an auditor has the skills to make the money they need by only hunting 2 hours per day. They can do it. The job can’t be taken away. This can allow people to build the life they believe in which gives more motivation.

Disappointment is natural. I try to identify if there was anything I could have done differently. If not I do my best to move on.

Sometimes taking a day or even a week off really helps me feel ready to re-enter the arena. ⚔️😁

[Korok @0xKorok]

Sometimes after finding a bug I’ll implement a fix myself. To test the dev skills!

This backfired today when I forgot to revert my fix, then ran my PoC (one last time for good luck) before submission… suddenly the bug was gone.

For 5 minutes I thought I’d lost my mind hahaha

[Korok @0xKorok]

@danielvf They chose from the “solutions” that were available to them. Unfortunately sleeping more likely isn’t one of them.

[Korok @0xKorok]

The rep score can’t be separated from the finding and proving of bugs. Some chose to try to ignore it.

To me it’s more about the perceived fairness and balance in the award and reduction of rep score than actual maxing it.

The recent changes make this dynamic unbalanced and I feel it’s to the detriment of intermediate level auditors that cantina should want more of.

With that said rep score does have tangible benefits like ability to submit issues without PoC, and join Cantina fellowship for private contests / bounties access and fixed minimum payouts for participation.

[Korok @0xKorok]

The latest iteration of @cantinaxyz rep score makes it much harder for the average auditor to increase their score.

I’m curious what others think of this change. I’ll share my thoughts below 👇

As a Cantina user who was, and continues to be, adversely impacted by this change I actually think it was a sensible move that could improve fairness— IF the behavior of judges can be brought in line with the new reality of how hard rep is to earn.

Going forward, I believe all judges should default to "informational" severity when downgrading issues. Some already do, but others reject too quickly—even when an auditor is clearly making a good-faith attempt to report an issue

Previously, issue rejection was more tolerable since lost rep could be regained with reasonable effort—even by those still learning, who sometimes need to submit borderline issues just to understand where the lines are.

But now, auditors trying to upskill on Cantina who aren’t yet able to easily max their rep score by winning contest face tougher decisions. If they care about rep, submitting an issue that is anything less than ironclad is risky—since -3 for a rejection, followed by -3 escalation denial is just too harsh.

All that said, I genuinely enjoy auditing on Cantina. It’s been a great space to learn, and I’ve audited there exclusively for the past few months with good results.

I have more thoughts and specific experiences related to this topic I’d like to share with the team, anyone from Cantina is welcome to DM me to continue the conversation. @hrkrshnn @TatianaDas95919 @cantinaxyz

[Korok @0xKorok]

Thanks for the reply. I know you all are trying to implement a robust rep system and it’s easy to imagine why that would be difficult.

To me it seems like no rep beyond the 8 duplicate threshold makes sense in the world where the duplicates grouped by judges were actually equivalent reports.

However I often see findings duplicated in cases where it’s a stretch to call the issues truly equivalent. Obviously this happens for the reason you mentioned, greatly increased participation, and judges needing to optimize to save time.

I just want to point out that to be fair to intermediate level auditors (who find valid bugs but don’t win contests yet) Cantina judges may need to be more careful moving forward when grouping duplicates and rejecting findings.

Incorrect groupings deprives SRs of legitimately earned rep. Few will want to risk penalty of escalation.

I’ve had to take the risky, and ultimately successful, move of escalating to de-duplicate issues when judges don’t respond to justification given in comments.

I feel that the environment is now one where as an intermediate auditor, who want to increase rep, it’s hard to be rewarded and too easy to be heavily penalized. Do you have any thoughts on this?

[Korok @0xKorok]

I managed to get a high with only 1 duplicate in the Velvet contest. I’m happy with the result. Thanks @cantinaxyz for the opportunity. The grind continues!

[Korok @0xKorok]

@0xNForcer @cantinaxyz Personally I find that many contest related mistakes are only made 1 time, the bad news is there is a nearly infinite amount of potential mistakes to be made hahaha.

Keep at it, we’re getting a bit smarter everyday!

[Korok @0xKorok]

@0xGreed_ @WhiteHatMage Correct 😁 🧙‍♂️ 🪄

[Korok @0xKorok]

Imagination is a great way to make auditing more fun. In games you often spawn as an insanely fit, perfectly aged, and untiring hero free of mundane concerns like food, money, or household chores.

Not so with auditing. Every bit of an auditors ability is earned.

[Greed @0xGreed_]

I believe auditing is like beating a boss in a video game
The first time you fight it, you don't know anything about it, so you:
- study its patterns & behaviors
- identify ways to go around its defenses
- try different attack strategies
- keep going until you get that xp & loot

[Korok @0xKorok]

I’ll add that I obviously don’t think judges are doing this intentionally. They have so much on their plates that their default response to downgrade / invalidate is rational and likely even correct most of the time.

[Korok @0xKorok]

As an auditor if you aren’t certain of a finding and ready to fight for it judges will gaslight you into thinking valid findings are invalid or lower than they truly are.

I love bug hunting but it astounds me how many different skillsets and virtues are required to do well. ⚔️

[Korok @0xKorok]

I feel like auditors also need some strategic ignorance or delusion. Most would be highly demotivated by the reality of what it takes. Better to be irrationally optimistic and deal with it day by day.

Every time I sit down I think to myself “I’m just here to learn”

[bbl4de @bbl4de_xyz]

I think the key with auditing is to imagine the worst possible outcome, then multiply it by 10 and prepare for that mentally.

Contest?
Worst case scenario I find nothing -> worst case scenario I spend 100 hours analyzing 10 leads only for them to turn out invalid.

Bounty?
Worst case scenario I go over 10 codebases and not find even a low for a month -> worst case scenario I go over 100 codebases and not find anything significant for 10 months.

With that mindset the side-effect is that in the worst case scenario you learn a LOT and gain godly-like patience and perseverance.

( the beautiful part about this is that you will not get the worst case scenario most of the time, but you can’t expect anything else )

[Korok @0xKorok]

@0xGondarxyz Thailand is a great place, value for the money can be unbelievable. Comfortable life can be had from $400/mo (total cost) all the way up to as much as you want to spend. Can confirm my stress levels are 0 which helps a lot with contests

[Korok @0xKorok]

@0xT1MOH Looks like my real life findings aren’t so different than my contest findings. At least it’s not invalid. Hahaha

[Korok @0xKorok]

Always fun to find “bugs” in real life. What is the parallel in code inaccurate validations? Good thing I’m only carrying this food 🔫 🤣

[Korok @0xKorok]

To be fair the Thai does say “No food is allowed in the area. NO WEAPONS ALLOWED”. Maybe It’s just me but the image text mismatch just feels wrong 🥲