Mr Strange

[MiloTruck @milotruck]

Whenever I open up a large codebase, my first step is to break down the protocol into its smaller components.

This is where briefly scanning through documentation comes in helpful.

What I like to do is look for an overview of the protocol, or some sort of architecture diagram.

[MiloTruck @milotruck]

Been asked quite a few times recently how I approach large and complex codebases without getting overwhelmed.

My answer - break it down into smaller components and tackle them one by one.

⏬⏬

[Mr Strange @GeneralxApe]

@ustas_eth @infsec_io @Ehsan1579 @therealgregoAI @0xvivekd just how in the world these guys are claiming so many bounties ??

was it unique AI workflow ?
was it there manual audit approach ?
or are they able to get perfect target ??

I wish some one amoung these folks share there knowledge to us

[0xSimao @0xSimao]

@muellerberndt nice! 3rd way to put what I think is the same idea, you must be able to:
- Build the protocol yourself (@cmichelio)
- Memorize the whole codebase (@0xsimao)
- Do a mental interpreter (@muellerberndt)

[Bernhard Mueller @muellerberndt]

The best way to audit is to build a "mental interpreter" of the entire codebase so you can run it in your head. It can take weeks. But then the bugs start falling out automatically. You might wake up in the morning with a new bug in mind.

[chrisdior @chrisdior777]

💰🚨 $1.4M from Web3 bug bounties in 2026!

Meet @0xvivekd and learn about his journey, mindset, AI workflow, and the lessons he's learned along the way.

Part 1: The Journey

- Vivek didn't come from a software engineering background.

- He was a Chartered Accountant (licensed financial and tax professional) running his own firm.

- In 2021, a friend who traded crypto came to him for help filing taxes. That's how he got introduced to crypto and started investing, mainly participating in IDOs (Initial DEX Offerings).

- When the bear market arrived, he didn't leave the industry. He pivoted into data analysis.

- Then in 2023, as the market became active again, he started airdrop farming.

- In June 2024, he entered Web3 security through public audit contests.

- The next 15 months were difficult.

- He kept participating in contests but struggled to achieve consistent results.

- Around August/September 2025, he made a decision that completely changed his career.

- He switched from public audit contests to bug bounties.

Today, he has earned over $1.3M in bug bounties in 2026 alone, including another $250,000 critical bounty announced yesterday.

Part 2: The Mindset

- "Bug bounties are not difficult in the technical sense. They are difficult from a psychological point of view."

- He explained what led him to leave audit contests:

- During a White Hat Mastermind, everyone was asked what they were working on.

- Around half of the researchers were working on the contest with the smallest scope and the lowest payout.

- Vivek realized he was always choosing the easiest targets because they offered the fastest and most predictable payouts.

- Bug bounties were different. There was no guarantee of finding anything. No guaranteed payout. Sometimes weeks of work could lead to nothing.

- That was exactly why he switched.

- As he put it:
"Bug bounty hunters are paid handsomely for dealing with uncertainty."

Part 3: AI

- AI has completely changed Vivek's workflow.

- Today, he gives AI a target while he spends that same time building a high-level understanding of the protocol.

- Once AI surfaces potential issues, he validates them, removes false positives, and determines whether they're actually valid vulnerabilities.

- His estimate surprised me.
Today, around 70-80% of the issues are initially surfaced by AI.

- But he doesn't believe AI will replace security researchers. His reasoning is simple.

- AI is excellent at spotting unusual behavior. It still struggles to understand intended behavior. That's why human validation remains essential.

- He also believes the learning process has changed.

- Reading audit reports and recent hacks is still fundamental, but today researchers should also follow AI developments and continuously experiment with AI tools.

Part 4: Advice

- According to Vivek, DISCIPLINE is what separates the best researchers from everyone else.

- His advice was straightforward:
Don't expect meaningful results during your first 12 months. Focus on the inputs, not the outputs. Don't compare yourself to researchers who have been building their skills for years. Stay disciplined. Don't chase shiny objects. Keep adapting as the industry evolves.

- One detail I really liked was how he dealt with difficult periods.

- Whenever he went through a dry spell, he listened to podcasts from other top white hats.

- Not because they never struggled. But because they did.

- It reminded him that even the best researchers experience periods without finding bugs.

Congratulations on the incredible journey! @0xvivekd. 👏

[s1r1us @S1r1u5_]

So, this is how lazarus drained 1.5 Billion

1) malicious JS injected into Safe{Wallet} at https://t.co/s8gAO3DM4d (because apparently, one of the nk devs just casually pushed it to production 🤡)

2) the JS modified executeTransaction() only if the signer was in a predefined list (Bybit’s multisig owners).

3) modified transaction now sets operation: 1 (delegatecall) to attacker address instead of a normal call.

4) delegatecall hits the attacker contract, which changed Safe contract's first storage slot which is masterCopy to a another attacker contract.

5) new masterCopy contract contained sweepETH() & sweepERC20(), draining $1.5B

[Harsh Jaiswal @rootxharsh]

@S1r1u5_ This is a skill I talked with @iamnoooob often. Its amazing how much cve reversing, decompiling closed source and cloning every other open source on weekly basis has helped me to become good at breaking down complex code and arch.

[s1r1us @S1r1u5_]

agree with sean here, and that’s why you should start doing ctfs or reversing vulnerabilities.

you open a basic binary challenge in picoctf. but you never took any courses.

it looks completely alien. you have no clue where to start. something in you wants you to solve it, for the sake of glorious point or just for the sake of solving it.

you stare at it. start googling. read old writeups. you learn what a binary is, how to run it. you want to understand how the program works. google again. how to reverse a binary? you spin up ghidra.

but you don’t understand assembly. for god’s sake, you don’t even know c.

so you install gcc, compile hello world. now you know how c program works. but ghidra still looks like gibberish. so you learn about pwndbg. start debugging. bp, si, si, p/x $rax, repeat. a week later, it finally clicks. you understand what the program does.

you read a writeup. “gets” overflows. okay, let’s try "aaaa"*20.

segfault. uhm, what now?

you google. you learn what a segfault is. you start digging into how the stack works. you realize you need to control the return address. you build a rop chain to jump to the win function. and finally, yayy, you solve the challenge locally in pwndbg.

now you want to do it on prod. so you learn pwntools. exploit it. got the flag. fuck yeah, a dopamine spike you never experienced in your life. a spike that you won’t ever get for doing surface level things.

it took a month to solve a basic challenge. but you learned a gazillion things. next time, another challenge comes up, you solve it in a week. then in a day. before you know it, you’re pwning chrome and popping calcs.

this isn’t easier than taking a course. courses can’t distill knowledge as efficiently as doing it yourself, top-down. none of my friends, none of my teammates have any solid foundation from university. everything we learned is through ctfs.

but at the end of the day, if you’re not wired to grind through this, it ain’t gonna work. something in your brain has to make you obsessed. but if you are obsessed, do this.

[s1r1us @S1r1u5_]

Pick a niche, become an expert, find bugs maybe even 0days or reverse n-days, and write blogs. Even if you don’t hit those $100k bounties, it’ll be a stepping stone toward a $100k job.

What niche? How to pick? Examples?

infosec being so vast from web3 sec to web2, mobile, desktop, recon, client-side, server-side, cryptography and so on. These are umbrella terms, but if we zoom in, there are specific areas where spending a lot of focused time will make you a top 20 expert -- 100% sure.

The key thing is, that the current top 20 experts in any niche will eventually be replaced as they get bored or burned out. This leaves room for you, and the easiest way to pick a niche is to learn from an existing expert in the niche, take inspiration, and grind to build on top of it.

1. For instance, I got into the client-side JS niche by following @terjanq’s work. From there, I went down even further to focus specifically on ElectronJS.

2. Another example: @rootxharsh and @iamnoooob their niche is in reversing n-days and finding new ones based on that knowledge. I don’t think anyone in India can compete with them on reversing n-days, writing blogs, and submitting findings to bounty programs.

3. And off the top of my head, @ajxchapman, from his tweets, seems to have a specific niche in V8 n-day exploits. I don’t think there’s anyone else in the web security scene who can write V8 exploits 😅.

4. Like @orange_8361 , pick a complex target and grind on it for months eventually uncovering mind-blowing findings.

5. Or, like @albinowax, choose a complex specification, such as HTTP, and find bugs from every aspect of it from top to bottom
(Sorry for tags xD)

I could list so many more people, but my point is this: if you look at the top bug bounty hunters or experts, there’s a pattern. Their blogs or tweets consistently focus on a specific niche (or two) for years and years. No one ever becomes a pro in a night.

How to Become an Expert in a Specific Niche?

Spend a lot of time. There’s no shortcut. Follow the work of the expert you picked for inspiration, read their blogs, dive into the blogs they learned from, and explore everyone else in that specific niche. Solve CTFs and write about them.

For example, not to make it all about myself, but just as an example. I’ve read every blog from the people I listed as inspirations(https://t.co/5MCSPeoygf) while learning client-side security.

If it’s taking time to understand, you’re likely on the right path. That’s where most people give up, so keep pushing. Just dedicating days to it will put you ahead of at least 100 others. It’s that simple.

Expert = Spent Time × IQ

Find Bugs or 0days, Reverse n-days, and "Write Blogs

Once you’re an expert, finding bugs will start to feel natural. But let’s be real, sometimes you might not get lucky. When that happens, reverse other n-days and write about it. I mean write about anything. Nothing gives you as much exposure as writing blogs: you’re helping others, plus you’re building a network that will eventually help you land a $100k job or $100k bounties.

[Bloqarl | Zealynx @TheBlockChainer]

A member asked me whether he should quit bug bounty contests now that they are drying up.

My honest answer, and it is not the one that sells courses: chasing the big payout skips the one thing that actually makes you better, the feedback loop. That is what shadow audits give you.

[pashov @pashov]

POV: @0xvivekd submitting his next vulnerability report

[obront | eth/acc @zachobront]

That's my current process, but I love learning how others see things from different angles:
- 0x52 starts with docs and user journeys
- @trust__90 is magical at continuing to poke at things after I give up
- a friend recc'd having a standard list of Qs for different contexts

[obront | eth/acc @zachobront]

One of the hardest things for new auditors is getting your head around a code base.

I remember feeling like I was aimlessly jumping in circles. Based on the DMs I've been getting, seems like this is a common experience.

Here's the process I now use for every audit...

[pashov @pashov]

One of my favourite security audit reports. Bunni V2 - AMM with 'shapeshifting' liquidity, automatic fee compounding, strongly related to Uniswap V4. Many great findings here, great team, a goldmine.

Must read for auditors👇
https://t.co/CGZzzcuZyT

[Immunefi @immunefi]

Name a better feeling

[guhu @Guhu95]

You can measure how vulnerable the code is after a contest. This can help:
- Projects and users to estimate hack risk
- Bug hunters to scope targets
- Ecosystem to track what works best
- Platforms to manage reputation risk

TL;DR: More solo findings -> more hidden bugs.

This works for most formats: flat pot, conditionals, invitationals, reserved auditors. As long as duplicates are allowed.

### Recent examples:

- Cork exploit: last private contest had 4 solo mediums (out of 4 total mediums). "Chao 1 bias-corrected" estimates 6 unfound bugs. Jackknife 8 more bugs.

- BeraBorrow's Recon's recent post about a critical: private contest had 8 solo mediums (out of 15 mediums), 6 doubletons (doubletons = found by two auditors). Chao 1: 4.5 more bugs, Jackknife: 9 more bugs.

### The science of capture-recapture

There are many disciplines that use this approach: software engineering, quality control, biology & ecology, epidemiology, criminology, linguistics.

Similarly, there are many estimator formulas: Lincoln-Petersen, Chapman, Schnabel, Schumacher–Eschmeyer, Jolly–Seber, Chao 1 & 2, ACE, ICE, Jackknife 1 & 2, Bootstrap, Zelterman, Good–Turing, etc. Will post some links below.

Two simple examples are Jackknife 1 & 2, Chao 1 & 2 which roughly say :

- Jackknife 2 (second-order, simplified): `unfound = 2 * uniques - doubletons`. Jackknife is more popular in software-inspection studies.

- Chao 1: `unfound = (uniques^2) / (2 * doubletons)`. (A slightly different version for no doubletons)

Specifics don't matter really - pick your favorite from the long list. What's important is they all say: more unique findings -> more hidden bugs.

### Intuitions

Math is not always intuitive, so here are some intuitions.

1. Parallel worlds: If a bug is unique to one finder, there’s a parallel world where it stayed hidden because he got sick, or was booked on an audit, or just missed it. Maybe you're in that parallel world. In contrast, if there are many duplicates - in most worlds the same bugs are found.

2. Serial auditing: If you imagine auditors working in sequence, the contest is just a stopping point for the sequence. The contest with uniques stopped when new bugs were still being found, so more like these remain. In contrast, the contest with only duplicates stopped after finding most bugs of similar rarity.

### What can we do?!

1. Measure: what platforms, pot sizes, contest formats give the best coverage?
2. Educate clients on the more secure formats with data.
3. If you're a project, check if your contest was weak.

### No solo findings = code is safe? No.

It's possible whole classes of niche bugs (e.g. cryptography) or higher complexity bugs were not found because pot was too low. That's always a risk.

This rule doesn't tell as what's safe, but it tells us what's LIKELY still vulnerable.

---------

See next tweet for links and statistical nitpicking

[Mr Strange @GeneralxApe]

@0xTimofey @StrangerMontana foreshadowing

[0xSimao @0xSimao]

1/ How I use AI in smart contract audits (2026)

From 2023–2026, I entered 57 contests, reached top-3 30 times, won 21 and earned $627k in prizes.

109 highs + 156 mediums. 53 of them solos.
86 private audits.

This came from reading every line and building the mental model.