IamSalted

I find the bugs that break protocol assumptions: fund flows, accounting, access control, integrations, and edge-case logic. DM to collaborate.

[IamSalted @IamSalted]

@yassine3eth Hi @yassine3eth pls check your dm

[IamSalted @IamSalted]

@realAkashAnand Video skills

[0x15 @0x15_eth]

Let’s be honest.

You can’t “fight blackhats” with good intentions.

Blackhats are motivated by immediate money. They spend countless hours looking for ways to break protocols because the reward is instant.

Whitehats are also expected to think like attackers, find critical bugs, report them responsibly, and then pray they get paid fairly.

That’s the problem!!

The only real difference between a whitehat and a blackhat should be responsible disclosure. Both need the same aggressive, adversarial mindset to find critical bugs.

But the incentives are completely different.

A blackhat finds a bug and can drain funds immediately.

A whitehat finds the same bug and has to go through uncertainty, delays, disputes, underpayment, or sometimes no bounty at all.

So people will naturally ask:

Why should I protect a protocol that doesn’t seem to care about security??

Why should I report a critical bug when the blackhat path pays instantly??

We can pretend everyone will “always do the right thing,” but that’s not how people behave when life-changing money is involved.

At the end of the day, security is an incentive game.

If protocols don’t make responsible disclosure worth it, they shouldn’t be surprised when hacks keep happening.

[IamSalted @IamSalted]

@0x15_eth Congrats, stay salted

[IamSalted @IamSalted]

Taking on 1 private protocol review this month. 🔒

Ideal for:
• Pre-launch DeFi
• Wallets / Security / Bridges
• Teams needing founder-readable findings

Deliverables: Risk map, vulnerability report, fix recs + follow-up review.

DM "review" to book.

[IamSalted @IamSalted]

Small win, useful lesson.

Just got another recent payout from Hackenproof.

The biggest reminder: good bugs are usually found after mapping the value flow, not after randomly scanning functions.

My audit flow:
Value → State → Assumptions → Edge cases → Exploit path.

[IamSalted @IamSalted]

How I audit a bridge:

1. Who can send messages?
2. Who verifies messages?
3. Can messages be replayed?
4. Can old roots be reused?
5. What happens if the relayer fails?
6. Can finality assumptions break?
7. What asset is actually backing the minted token?

[IamSalted @IamSalted]

• Can donations inflate exchange rate?
• Can rounding compound over multiple calls?

[IamSalted @IamSalted]

A dangerous DeFi bug pattern:

When withdrawal logic depends on stale accounting, users may receive more or less than expected.

Things I check:
• Is share price updated before withdrawal?
• Are fees applied before or after accounting?

[IamSalted @IamSalted]

@Jason I'm in

[IamSalted @IamSalted]

@gedamtekle Digital

[IamSalted @IamSalted]

@ighodarod95 @HackenProof Receive salt bro

[IamSalted @IamSalted]

Yeay, I was awarded for a valid submission on @HackenProof https://t.co/dwwjaL6EX9 #hackenproofed #bugbounty

[IamSalted @IamSalted]

@mylifechangefa1 @HackenProof Receive the salt

[IamSalted @IamSalted]

@jack__sanford Kindly check your inbox

[IamSalted @IamSalted]

@HackenProof @therealgregoAI Hmmm

[IamSalted @IamSalted]

Whitehats,

It’s time the industry treated you right.

[0x15 @0x15_eth]

For real....body go tell them lol

[0x15 @0x15_eth]

Real!

[IamSalted @IamSalted]

@0x15_eth At the end of the day just be a blackhat and enjoy your permissionless payout.