Black hats always win
Whitehat spends weeks on a PoC, gets it accepted, saves the project $800M walks away with ~$4k.
Meanwhile, the Verus bridge attacker drains $11.58M, returns $8.5M after negotiation, and pockets $2.8M as bounty with no charges.
The system is not fair enough.
reported a critical vulnerability that could've drained nearly over $1M.
Project: "Thanks! We fixed it. Here's $5,000."
: You made $ x,xxx,xxx in revenue last year and this is what you offer?
Project: "Gotcha, April Fools. Here's additional $45,000."
reported a critical vulnerability that could've drained nearly over $1M.
Project: "Thanks! We fixed it. Here's $5,000."
: You made $ x,xxx,xxx in revenue last year and this is what you offer?
Project: "Gotcha, April Fools. Here's additional $45,000."
@arc I can match your lowball joke of a Circle bug bounty program with my personal funds if a grey hat researcher chooses to exploit it for themselves.
Thanks to @Secure0x for flagging a misconfiguration on an old, unused legacy subdomain from the pre-rebrand Idle era. No active Pareto infrastructure or production user flow was affected, but we appreciate the responsible disclosure and have taken care of it.
Secure0x. Same team. Still hunting. Last year’s vulnerabilities didn’t stop us. Neither will this year’s.
Projects we touched stayed off the breach headlines. That’s the only metric.
If you’re running a BBP
Someone reports to you a bug that puts your entire TVL at immediate risk
And your number one concern is “how can I pay less for the bounty? 0.05% of funds at risk is too much!”
Why do you have a BBP?
Why are you even in web3 actually?
🎉 The $20,000 Invite Only Program with @zano_project has officially wrapped!
All rewards have been distributed to the participating security researchers.
🏆 Winners:
1️⃣ @0xiamkunal9 – $7,194
2️⃣ @Secure0x – $3,971
3️⃣ @hacker_ – $2,835
👏 Big congrats to all the winners!
🔗 Leaderboard: https://t.co/aETEJ4FtVT
Secure0xd Projects: It took years of contributing (:
The `IMPACT` factors are based on the overall report's impact, not just isolated bug severity.
Really! Awesome projects!!
https://t.co/IzBVd41GSU