Satya Bhaskar

Blockchain Developer | AI × Web3 | RWA Tokenization | Smart Contracts | Solidity • Rust • Move | Canton • Hyperledger Fabric | Web3 Security | IIITN

[Satya Bhaskar @SatyaPeruri9]

Really enjoyed the challenges—happy to place in the Top 15 at Wonderland CTF with the team!
🫡

[Satya Bhaskar @SatyaPeruri9]

Why are institutions preferring @CantonNetwork for RWAs instead of public blockchains?

It’s not about decentralization vs centralization.
It’s about compliance, privacy, and deterministic settlement.

Here’s why 👇:

[Satya Bhaskar @SatyaPeruri9]

@CantonArmy @cantontools @digitalasset

[Satya Bhaskar @SatyaPeruri9]

Wall Street already runs on a blockchain most people have never heard of.

On Oct 28, DTCC's tokenization service for stocks, ETFs and Treasuries went live on Canton.

Here's my post on it 👇

https://t.co/niFaARc6MZ

@CantonFdn #CantonResearchNov26

[LordAlive @LordAlive_]

Everyone who's moving from EVM/SVM to @CantonNetwork
here is a Technical writeup.
https://t.co/iMLYRNd9qk

#CantonResearch #CantonNetwork #CantonSecurity

[Canton Foundation @CantonFdn]

AI can write Daml.

Daml Reason, from @ChainSafeth, checks it.

It compares your agent’s code against proven, compiler-validated patterns, shows where each match comes from, and tells you when it doesn’t have one.

👉 https://t.co/yCJwxSRbM2

[Surya Prakash Akula @D4r3_D3v1L_]

a solidity compiler bug i found and reported is now public

contracts compiled with via-ir and the optimizer on could read a stale storage value.. affects 0.8.19 to 0.8.37, fixed in 0.8.38.

i explained the bug here: https://t.co/sNyyWEbiAn

[OtterSec @osec_io]

In 2026, no program is closed source.

We decompiled a propAMM into Rust that recompiles to the exact on-chain binary, then used it to find a critical bug that put $6.1M at risk.

[gss1 @gosasu1]

I’ve been researching @Zcash security as part of our internal work at @osec_io.

Today, I’m happy to share that the total amount I’ll be receiving in bug bounties from @Zcash has finally been confirmed at $972K.

I’m really proud of what came out of this research. More importantly, I’m glad our work contributed to improving Zcash’s security and got more security researchers interested in Zcash. It’s especially great to see that many researchers are still looking into Zcash, finding and reporting bugs, and keeping an eye on its security.

Huge thanks to the teams across the Zcash ecosystem, including @Zcash, @zodl_co, @ZcashFoundation, @ValarGroup, @ShieldedLabs, @TachyonZcash, and @ZcashCommGrants, for taking security seriously and rewarding researchers, and to the entire Zcash community for all the support.

I’ll keep doing my best to find more bugs.

[Hi Hero 😎 @HiHerooooo]

పలుకే బంగారమాయే పిలచినా పలుకవేమి 🙏🙏

[The Math Flow @TheMathFlow]

Solving a Rubik's Cube with graph theory.

[MTS @MTSlive]

Hacktron founder @S1r1u5_ reveals how his team hacked into OpenAI starting with a single HEIC image and ended with Codex opening a PR under an employee’s token:

"The main one was an SSO misconfiguration in OpenAI's identity system. The other bug is a remote code execution on community.openai."

"By just uploading an HEIC image, an image format that you might have noticed in iPhone, we were able to get remote code execution there."

"Every employee that logins to Discourse, we can use their token and use it on Codex."

"We asked Codex to update the README with, Hacktron AI team is here. Don't change anything else. And then we clicked on open PR, which led to opening a PR in OpenAI."

"When you create Codex environments, you can give your own Bash scripts. You can write a Bash script that can exfil the source code of those internal repositories. You don't even need to ask Codex to interact with the repo."

"We can technically do this with every single repository that was on github .com/openai."
@HacktronAI @rootxharsh

[s1r1us @S1r1u5_]

On July 25, we hacked OpenAI.

Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.

We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

[s1r1us @S1r1u5_]

"3 random dudes”

1. hacked apple, again and again.
https://t.co/5aZcB0RbjF
https://t.co/UdsKrmfFJW
https://t.co/hWDQaimW8c

2. your github enterprise is our github enterprise.
https://t.co/u3UjajnBKq

3. get a discord message from me, get pwned.
https://t.co/pX3RkjxNOX
https://t.co/noscPNmZm9

4. oh yeah, at one point we basically had shells across the electron ecosystem. check the DEF CON research.
https://t.co/1Th5fvpa21

5. your supabase database is my database.
https://t.co/nOIKthdDnM

6. we got the posthog prod database.
https://t.co/VIeGJz1hKq

7. react2shell? vercel paid us $170k for helping secure their waf.
https://t.co/Y2RgQSdl3g

8. your palo alto vpn is my vpn.
https://t.co/oVB068UhST

9. ai ides? we got shells for you, antigravity
https://t.co/tsvSXQuSS0

10. windsurf rce.
https://t.co/DpdGqmNRvu

11. turning cluely into malware.
https://t.co/8QcIYhXQfS

12. ai browsers? sure, uxss: your perplexity browser is my browser.
https://t.co/WVXlHzY0CB

13. openai atlas too. kinda uxss
https://t.co/jkQWnLD7rV

14. hey, it’s not even our first time hacking discourse.
https://t.co/viI1op7aMf

15. adobe coldfusion: pre-auth rce. because apparently we needed another one.
https://t.co/aFILo3suP2

there’s a lot more. go dig.

anyway, yes: “3 random dudes.”

and @HacktronAI is full of more random dudes like these.

[Deedy @deedydas]

Here are the LinkedIns of the 3 Indian guys who hacked OpenAI with Opus 5 in 2 days for <$3000:
Rahul Maini, Mohan Pedhapati and Harsh Jaiswal

No brand name colleges or companies. Just raw curiosity and skill.

You can just do things.

[Harsh Jaiswal @rootxharsh]

We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.

It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵

[yAudit @yAuditDAO]

GM! Applications for yBorg are now open!

https://t.co/mru83ppxXC

[Samuel Zeng @SamuelZengML]

A 35B language model running on an iPhone using only 1–2.5 GB of peak memory.

No cloud. No remote server. No desktop GPU.

Today, we’re open-sourcing Edge0 — a framework for running large AI models fully on-device.

[Jay Cummings @LongFormMath]

I...worked on this proof for a year...and...they just…tweeted it out.

[PraneshASP @0xasp_]

wtf this is crazy: https://t.co/LQ3Mvtdtlm

[Zaevlad @RightNowIn]

23 625 smart contract vulnerabilities — open sourced

I collected these findings over the past year from private audit reports and contest platforms

Hopefully, it’ll be useful for security researchers and people working on AI for smart contract security

https://t.co/SgY7J1crlr