Secure0x

#1 Hacker on @xyz_remedy, #2 Whitehat Top 10 HackenProof SUI , Top 30 @Immunefi (90 days)

[Secure0x @Secure0x]

If a web3 project has a revenue model but can’t fund basic security, do they even care about users funds at all?

[Sadik @0xsadikbaba]

Black hats always win

Whitehat spends weeks on a PoC, gets it accepted, saves the project $800M walks away with ~$4k.

Meanwhile, the Verus bridge attacker drains $11.58M, returns $8.5M after negotiation, and pockets $2.8M as bounty with no charges.

The system is not fair enough.

[Secure0x @Secure0x]

@pashov FR

[Secure0x @Secure0x]

@pashov https://t.co/A4bpXNjzWx

[Secure0x @Secure0x]

reported a critical vulnerability that could've drained nearly over $1M.

Project: "Thanks! We fixed it. Here's $5,000."

: You made $ x,xxx,xxx in revenue last year and this is what you offer?

Project: "Gotcha, April Fools. Here's additional $45,000."

[pashov @pashov]

Hyperbridge exploit story:

>single audit, no bug bounty
>rude to whitehats, publicly mocking their efforts
>April Fool's - "Security Incident Report xD lolllz"
>claims they're unhackable
>gets hacked 2 weeks later - "Bridge update!"

Always respect the whitehat efforts, always🙏

[Secure0x @Secure0x]

reported a critical vulnerability that could've drained nearly over $1M.

Project: "Thanks! We fixed it. Here's $5,000."

: You made $ x,xxx,xxx in revenue last year and this is what you offer?

Project: "Gotcha, April Fools. Here's additional $45,000."

[Nolan | Exvul @ma1fan]

Check out this article: HB Token Exploit Analysis: ~$193K Lost to AMM Reserve Manipulation via Reward Path https://t.co/aZ8FlT8Upt

[Secure0x @Secure0x]

@zachxbt @arc the real problem now projects just patch the bug and offer zero room to negotiate a fair reward. not even the bare minimum.

[Secure0x @Secure0x]

@zachxbt @arc the real problem now projects just patch the bug and offer zero room to negotiate a fair reward. not even the bare minimum.

[ZachXBT @zachxbt]

@arc I can match your lowball joke of a Circle bug bounty program with my personal funds if a grey hat researcher chooses to exploit it for themselves.

[William | bugduino.eth @bugduino]

Thanks to @Secure0x for flagging a misconfiguration on an old, unused legacy subdomain from the pre-rebrand Idle era. No active Pareto infrastructure or production user flow was affected, but we appreciate the responsible disclosure and have taken care of it.

[Secure0x @Secure0x]

Secure0x. Same team. Still hunting. Last year’s vulnerabilities didn’t stop us. Neither will this year’s.
Projects we touched stayed off the breach headlines. That’s the only metric.

[Secure0x @Secure0x]

@lonelysloth_sec majority them don’t know how to handle situations… panic rules highlight

[LonelySloth @lonelysloth_sec]

If you’re running a BBP

Someone reports to you a bug that puts your entire TVL at immediate risk

And your number one concern is “how can I pay less for the bounty? 0.05% of funds at risk is too much!”

Why do you have a BBP?

Why are you even in web3 actually?

[Poscidon @PoSciDonDAO]

Shout out to community members such as @Secure0x that work hard to keep web3 safe.

Together, we protect and fuel the future of DeSci!

[Secure0x @Secure0x]

@sandypeng bounty + $33k extra from pockets 🌛👍

[Immunefi @immunefi]

🎉 The $20,000 Invite Only Program with @zano_project has officially wrapped!

All rewards have been distributed to the participating security researchers.

🏆 Winners:
1️⃣ @0xiamkunal9 – $7,194
2️⃣ @Secure0x – $3,971
3️⃣ @hacker_ – $2,835

👏 Big congrats to all the winners!
🔗 Leaderboard: https://t.co/aETEJ4FtVT

[Secure0x @Secure0x]

Yes, this is how we monitor projects w bug bounty programs.

Secure0x, always reporting the unexpected first ;-;

[Secure0x @Secure0x]

Secure0xd Projects: It took years of contributing (:

The `IMPACT` factors are based on the overall report's impact, not just isolated bug severity.

Really! Awesome projects!!

https://t.co/IzBVd41GSU

[Secure0x @Secure0x]

1 CRITICAL and #1 @xyz_remedy

[Secure0x @Secure0x]

Users aren’t test subjects. Fund security or don’t build.

[Secure0x @Secure0x]

If a web3 project has a revenue model but can’t fund basic security, do they even care about users funds at all?