AGalx

Self-taught Smart Contract Security Researcher Currently training in: - Solidity Security - Foundry - DeFi Exploitation - Smart Contract Auditing. 6y defi exp

[AGalx @AlxGdi]

@HackenProof Reentrancy is taking more gas, than just doing an attacker contract with a target = IMintPassNFT(_target) for example and just a target.claim(5000).
Fix =ReentrancyGuard + limiterqty + update state before _safemint.

Have a Nice day!

[AGalx @AlxGdi]

@coinacademy_fr Il serait grand temps de s’interroger sur l’Europe et son sens de la démocratie.
L’Europe devient une démocratie d’apparence.

[AGalx @AlxGdi]

Today,

Reading and deep understanting of exploit by reading code4arena reports,
First, trying to catch the bug by reading the code before reading report.

[AGalx @AlxGdi]

@MiningTk Stp dis moi que c’est un deep fake mec 😂

[AGalx @AlxGdi]

Today,
pattern recognition drill.
Simple.
Basic.
But efficient.

[AGalx @AlxGdi]

Daily motivation 💪

[Immunefi @immunefi]

This Security Researcher has earned $3,612,409 hunting bugs on Immunefi.

32+ live critical vulnerabilities found, saving hundreds of millions of dollars from hacks.

Meet @lonelysloth_sec, ranked Top 5 all-time on @Immunefi.

We asked him how he does it.

One practical bug bounty strategy that has helped him find better bugs: "Protocols share a lot of code. When you find a bug that isn't exploitable, take some times to check if the same bug doesn't show up in other protocols where it might be. Study families of protocols, compare their code. Things are getting more and more interconnected."

The habit, routine, or mindset that has made him more consistent as a researcher: "Curiosity. I don't rest until I understand every part of the system. Even if I end up not finding a bug, I want to understand it."

A memorable bug or win, and what helped him find it: "I have quite a few public disclosures, but for one project between '24 to '25 I got paid for 9 critical bugs. I spent months getting to know every last detail of their (very large) code base. More than a breakthrough it was about persistence in one target, learning everything about it, and using everything I knew on it. They weren't the highest paying bugs I found, but I'm very proud of that achievement. I still find bugs in that project."

His advice to a researcher trying to level up or land their first bounty: "Find motivation in the journey, because it's a long one. Enjoy understanding something that previously was mysterious to you, the feeling of knowledge accumulating. It compounds and will eventually lead to your bounties. Keep trying -- you need to give luck a chance to find you."

[AGalx @AlxGdi]

Today achieved the wallet mining level in damn vulnerable defi,
Was the most challenging exercice i finished.

Keep hard working.

Loved this.

T.sol is on my git with comments ✌️

[AGalx @AlxGdi]

@Wallflower1x0 Actually learning to, wish you the best

[A3R4H4M @abrahamonchain]

The Reality of Becoming a Top 1% Security Researcher

Most people think it's about intelligence.

It's not.

It's about surviving years of confusion, rejection, self doubt, and failure long enough to become dangerous.

Here's what nobody tells you

Let's dive in

➪ The internet only shows the wins.

You see:

➣ Accepted bug bounties

➣ Audit reports

➣ Conference talks

➣ Hall of Fame achievements

➣ Research publications

You don't see:

➣ 100+ rejected findings

➣ Failed exploit attempts

➣ Weeks spent understanding one vulnerability

➣ Thousands of lines of code read for nothing

Success is visible.

The struggle isn't.

➪ Security research will make you feel stupid.

A lot.

You'll open a protocol and understand absolutely nothing.

You'll read a Solidity function 20 times.

You'll stare at an exploit writeup for hours.

And you'll wonder if everyone else is smarter than you.

They're not.

They've just been confused longer.

➪ One lesson I learned:

Feeling lost is not a sign you're failing.

It's usually a sign you're learning.

The best researchers aren't the ones who avoid confusion.

They're the ones who stay with it long enough for understanding to emerge.

➪ Nobody talks about the 3 AM reality.

The monitor glow.

The cold coffee.

The failed PoC.

The endless transaction traces.

The attack path that doesn't work.

Then doesn't work again.

Then finally works.

The world sees the report.

You experience the thousand failures before it.

➪ Security research is mostly being wrong repeatedly until you're finally right.

That's the job.

Not glamour.

Not recognition.

Investigation.

➪ Most people don't fail because they lack talent.

They fail because they quit too early.

The learning curve is brutal.

Progress feels invisible.

Validation is rare.

Rewards are delayed.

So people leave.

The few who stay become dangerous.

➪ Consistency beats talent more often than people want to admit.

Read code every day.

Study exploits every week.

Write research publicly.

Repeat.

Small efforts compound.

➪ The most underrated security skill isn't intelligence.

It's curiosity.

Elite researchers ask questions longer than everyone else.

Why is this here?

Why is this unchecked?

Why did this exploit work?

Why did nobody notice?

Curiosity uncovers vulnerabilities.

➪ Most vulnerabilities hide inside assumptions.

Attackers know this.

Researchers should too.

➪ Another uncomfortable truth:

Security research is mostly pattern recognition.

The best auditors don't magically spot bugs.

They've simply studied enough failures to recognize familiar attack surfaces.

Experience is pattern recognition in disguise.

➪ Want to improve faster?

Study:

➣ Historical hacks

➣ Audit reports

➣ Post mortems

➣ Exploit writeups

➣ Attacker behavior

Every exploit teaches a lesson.

Every lesson becomes intuition.

➪ Let's talk about the emotional cost.

Nobody warns you about this part.

Security can be lonely.

You miss events.

You skip outings.

You spend weekends reading code.

Sometimes you become obsessed.

And sometimes that obsession is exhausting.

➪ Then imposter syndrome arrives.

You compare yourself to famous auditors.

Respected researchers.

Top bug bounty hunters.

You feel behind.

Here's the truth:

Even experts feel this way.

They just keep moving anyway.

➪ Top 1% doesn't mean:

➣ Knowing everything

➣ Finding every bug

➣ Never making mistakes

➣ Being a genius

Top 1% means:

➣ Showing up consistently

➣ Learning relentlessly

➣ Staying curious

➣ Refusing to quit

➪ If I could give one piece of advice to aspiring blockchain security researchers:

Stop chasing shortcuts.

Read code.

Study exploits.

Think like attackers.

Build things.

Break things.

Write about what you learn.

Depth beats hype.

Every time.

➪ One day people will see your audit reports, findings, and achievements.

They'll assume you were naturally gifted.

They won't see:

➣ The confusion

➣ The failures

➣ The rejected reports

➣ The late nights

➣ The moments you almost quit

But that's the reality of becoming a top 1% security researcher.

Not brilliance.

Persistence.

➪ The researchers who change the industry are rarely the smartest people in the room.

They're the ones who refused to leave the room.

If you're building a career in Smart Contract Security, Blockchain Security, or Web3 Security:

Keep going.

Your future expertise is being built in today's confusion.

Repost if you're on the journey.

[AGalx @AlxGdi]

Just pushed on my git a foundry fuzzer pratice test for confirm or help discovering bugs.

It’s very simple and basic but can be helpful.

[AGalx @AlxGdi]

@FranceCryptos Mais quel est l’intérêt pour eux de s’attaquer aux détenteurs de crypto sachant que ça abouti quasiment tout le temps à un gel des fonds par traçabilité avec un simple scan sur la blockchain OU des interpel très rapides?

Il est temps que ce mirage s’estompe.

[AGalx @AlxGdi]

@WatcherGuru Bullish for Eth, They Will be using eth as infra

[AGalx @AlxGdi]

@RealJohnnyTime Debt must be < collateral.
No position must have a debt superior than her collateral

[AGalx @AlxGdi]

@Harvesto12 Exactly.

[AGalx @AlxGdi]

@RealJackPoor Maybe à Strategy for dump Price with bad news for buy back after with lower price ? 👐🏻

[AGalx @AlxGdi]

@LeJournalDuCoin Y’aura un AirDrop ?

[AGalx @AlxGdi]

@alexa__meme @WatcherGuru 😂😂
Love it
Just cheated because you show the previous top

[Rekt News @RektHQ]

$3.98 million drained from 88 Gnosis Safes across three chains on New Market Trading. A third-party Safe module trusted caller-supplied data over msg.sender. One missing require check. Anyone who read the source code could drain every wallet.

https://t.co/7fHWPH8b6F

[AGalx @AlxGdi]

Another day hard training,
Pushing my test resolved on my git,
Looked deep another different hack,
Modified my IA pipeline too,
Ready soon for my first contest but now going to sleep 😅

[AGalx @AlxGdi]

@Ysf_Mek Franchement si ça marche gg a toi et bon courage pour la suite ✌️

[AGalx @AlxGdi]

@OndoFinance Rest in peace, condolences for family.