lodelux

DMs are always open for opportunities | #29 on code4rena's 2026 leaderboard | #149 on Sherlock's all-time leaderboard | full portfolio in link below

[lodelux @LuxLode]

Finally got the results of thecontest I did back in September. I'm really happy with this top 5, even more so since I found my first Solo! :)
Thx to @code4rena and @GTE_XYZ for the opportunity.

I'm open to join an auditing firm, if you have opportunities lets connect :)

[lodelux @LuxLode]

Yeah I understand this is the real reason and it holds from a purely rational pov, but the B players are anyway contributing to the value of the company even if less than As and if AI is overall allowing you to have greater results you should be more than capable to sustain at least the same amount of employees as pre-AI era

[lodelux @LuxLode]

I don’t understand AI layoffs, if you can now do more with the same team why not, hear me out, do more?

Why do you need to cut your workforce in order to do the same but now using AI?

Seems to me AI is an excuse to simply save money by firing people

[Mitchell Amador @MitchellAmador]

Almost every single bug bounty program on Immunefi surfaces a live, critical vulnerability on mainnet.

The question is not if they are there; it's who's going to find them. Running a bug bounty program is the only proven way of surfacing them before hacks do.

At this point, I don't know what to say, beyond this: if you're not running a bug bounty program right now, you're not taking security seriously.

[lodelux @LuxLode]

@arsen_bt Couldn’t agree more

[lodelux @LuxLode]

The current Security model is flawed, it’s absurd that currently the path of least friction for a hacker is to go blackhat.

The only solution I can think of is that @battlechain goes mainstream.

[lodelux @LuxLode]

I've recently upgraded to the 100$ subscription for codex, and I have to say that llms for research purposes are extremely effective. I was able to perform analysis that would take a month in slighlty more than 3 days which is crazy.

Their capabilities to spin up a (sloppy) python script to validate or reject an hypotesis is super useful. I just say "can this beahviour be becuase of X,Y,Z ? " wait 15 mins and get actionable results.

Ofc, once the research phase is over and you need to build something "vertical", then you need to sit down and really start doing stuff manually.

[lodelux @LuxLode]

@winsznx You can DOS it by calling increment() enough times to reach the uint256 limit

Really easy DOS attack, just requires 3,67 * 1e69 years

[lodelux @LuxLode]

@d0rsky I had to make it easier for the attention span of the modern SR ahahah

[lodelux @LuxLode]

tldr:
5$ per submission is the equilibrium

[sashko.eth🇺🇦 @d0rsky]

Its almost a month, from the moment we enabled fees to test and see how it works. Here are some insights we have so far

We enabled submission fees across 11 bug bounty programs.

$1 - no measurable impact. Same as free. Some programs actually got more reports. Researchers assume fewer people participate, so give more interest for program.

$5 - ~80% drop in AI slop and low-quality submissions. The golden middle. High confidence in every submission.

$10 - the max we'd recommend. Whitehats tell us anything above $10 hits a mental barrier and starts pushing away legit researchers.

At $100, you're essentially restricting submissions to Critical-only. No one will risk $100 on a Medium finding, even a valid one. If the goal is to filter AI slop, $5 gets you 80% of the way there without losing real researchers. I don't know who recommended to place it for one big audit contest happening rn.

All 11 companies are satisfied with the results.

If you're still spending days sorting through AI-generated garbage reports - submission fees + our open-source MCP triage tools + skills is the combo that actually solves it.

DM us to enable it for your program.

[lodelux @LuxLode]

gpt-5.5 for 30$ per 1M tokens

[lodelux @LuxLode]

@0xSkas Would you say it was worth it?

[lodelux @LuxLode]

@HackenProof Understanding what’s in scope and what’s not

[lodelux @LuxLode]

Thanks to @sherlockdefi and @0xfluid for the opportunity. And a special thank to @AifosSi who’s truly the best judge around.

[lodelux @LuxLode]

Recent hacks have shown that state-sponsored attacks are extremely sophisticated, orchestrated by multiple skilled people, and executed over an extended period of time.

The next major hack by Lazarus is probably already in the making. If you are a founder, you must ask yourself:

- Is my protocol the next target?
Assume the answer is YES.

- What can I do today to mitigate this risk as much as possible?
Crucially, when thinking about this question, do not focus only on the correctness of your smart contracts. Reassess your entire architectural threat model, because black hats will strike at the weakest link, which is probably the one you are underestimating:

- Increase your multisig to AT LEAST 3/5.

- Instruct your security council to never blind-sign anything.

- If you integrate other protocols, reassess the risks they may introduce to your infrastructure.

- implement extensive circuit-breakers and rate limiters.

- Ideally, get a new audit if the last one was done a long time ago, sponsor a contest, and start or expand your bug bounty program.

[lodelux @LuxLode]

@0xZulkifilu Maybe, or maybe they just have better incentives?

[lodelux @LuxLode]

what's up with all these massive hacks in the last month ?

[lodelux @LuxLode]

@0xSkas 💀💀💀

[lodelux @LuxLode]

@adeolRxxxx @0xfrsmln @immunefi All the other contest platforms allow you to verify that your issue is really a duplicate. It happens quite a lot that it is indeed mis-grouped, on immunefi you kinda need to hope that it was grouped correctly and you have no way of verifying it yourself.

[lodelux @LuxLode]

@lonelysloth_sec AI is really useful to scale security horizontally, but if you stretch too much you end up covering a large area but effectively doing nothing.