S.C.Lam

Web3 Security Researcher

[S.C.Lam @S_C_Lam]

Europe and the United States? The Chinese government and Huawei are not currently promoting Huawei GPUs in these two regions. Their two real targets are countries with relatively stable and secure political situations in regions such as Africa, South America, the Middle East, and Asia Minor.

[S.C.Lam @S_C_Lam]

@mdam10x Since Fireworks hasn't been released yet, all the models and cursors currently available in China are purchased from Fireworks. If you go to the pricing section for models in their documentation, you'll find a line that says, "This model is provided by XXX Company."

[S.C.Lam @S_C_Lam]

@immunefi Then can get “This is part of our design. Also, POC doesn't allow for scenario-based settings; it's calculated based on the amount of funds on-chain”. This is the result after I spent $60 and revised the POC and report three times based on the feedback I received.

[S.C.Lam @S_C_Lam]

@leerob @cursor_ai Ok, but now I want kimi k3

[S.C.Lam @S_C_Lam]

@jun_song Is GLM 5.5 this powerful because it was fine-tuned by users after being released as open source, or is it inherently this powerful?

[S.C.Lam @S_C_Lam]

@painfultruth78 @robinebers In agent use, cursor is better than https://t.co/bnMj4fiOv3

[S.C.Lam @S_C_Lam]

@Krypto_Whitehat @ZixuanLi_ This seems to be a common issue with all models, doesn’t it? It’s just like when I write a proof of concept (POC) for a smart contract: if the POC has a certain degree of practicality, the model immediately flags it with a security warning.

[S.C.Lam @S_C_Lam]

I had once considered selling it to the BlackHat，I’m starting to lose interest in finding critical vulnerabilities; all I ever get is that the preconditions for exploitation can be circumvented (even if I’ve proven that the preconditions have been triggered) or some nonsense like ‘this is simply part of the protocol’s design’.

[S.C.Lam @S_C_Lam]

@pashov Can I say it’s just for the money?

[S.C.Lam @S_C_Lam]

@KalpShah_eth @HackenProof I don't even know how to pay 😂😂😂😂

[S.C.Lam @S_C_Lam]

@chrisdior777 Meanwhile. The bounty team: ‘This so-called vulnerability is part of our design.’ Blimey, every time this happens, I feel like packing up the vulnerability report and selling it to the black hats on the spot—at least they’d actually pay me.

[S.C.Lam @S_C_Lam]

@yoursbyte @asen_sec No way, man. You've got to be kidding. Even I, as a Chinese person, wouldn't dare say something like that.

[S.C.Lam @S_C_Lam]

@ElliotSecOps @immunefi Why is yours $75? And that price is still subject to change 🤯

[S.C.Lam @S_C_Lam]

@0xsadikbaba So, should I pay the twenty dollars or not?

[S.C.Lam @S_C_Lam]

Yeah. I recently discovered a vulnerability that involves three contracts. If I chain the vulnerabilities together, the vulnerability can now reach a critical severity level. But I'm not sure how to write the report, because the financial impact of the final vulnerability isn't in the contract where I initially found the flaw, so I'm not sure how to go about it. 🫠🫠🫠🫠

[S.C.Lam @S_C_Lam]

@ElliotSecOps @immunefi Don’t they have a feature called “Comments” that allows for pre-moderation? Why don’t you try submitting your report there?

[S.C.Lam @S_C_Lam]

@pashov This is an organization in DC Comics made up of people with insatiable appetites. What I mean is, once acquired enough money, need a new desire to drive you forward—just like joining the Orange Lantern.

[S.C.Lam @S_C_Lam]

@MitchellAmador @asen_sec @immunefi Since I switched platforms after my last verification failed, I haven’t looked at the others. Thanks for the heads-up; I’ll check them out later.

[S.C.Lam @S_C_Lam]

@MitchellAmador @asen_sec @immunefi So it's time to renew my passport, even though it hasn't expired yet (old Hong Kong passports don't pass KYC).