Ulaş Anıl

Smart Contract Auditor @nethermindsec + appsec enjoyer ex @Bugcrowd @rootstock_io

[Ulaş Anıl @_ulasanil]

@lcfr_eth @Walodja1987 @LefterisJP @dumbnamenumbers @gabe_onchain This bug was reported by me. I didn’t expect them to pay anything let alone 100k for this bug tbh. The reward was greatly appreciated 🙂

[Ulaş Anıl @_ulasanil]

@MihailVarich @0xaudron @immunefi Question: Is it the client or Immunefi triagers that decide the issue is a duplicate? Lets say my report is in “Escalation”, can it still be marked as duplicate to another issue on Immunefi?

[Ulaş Anıl @_ulasanil]

@0xLupin @KonSpycio my bad. I replied without reading your blog. It adds something different to an already known dependency confusion

[Ulaş Anıl @_ulasanil]

@0xLupin @KonSpycio https://t.co/BqMmxcdzIJ 5 years old research btw. but congrats on rediscovering it on your own research

[Ulaş Anıl @_ulasanil]

@only01Essential @VagnerAndrei98 @immunefi Weird… Chainlink should have been made aware regardless. I am sure they wouldnt want to deploy their contracts to mainchain with critical bugs in it.

[Ulaş Anıl @_ulasanil]

@only01Essential @VagnerAndrei98 @immunefi Hey @only01Essential , according to Chainlink’s Immunefi bb page, as long as the version is released it should be in-scope. Maybe the version you were checking was part of pre-release? https://t.co/QVB92PAgXN

[Ulaş Anıl @_ulasanil]

@kevin_mizu @_Worty @BitK_ Can you share a link to the CTF?

[lukasschor.eth @SchorLukas]

Unfortunately we still see large-scale hacks and loss of funds on a regular basis.

Multisig alone is not enough. UI warnings help but can be easily circumvented.

So we've built something new. A protocol that enforces security checks onchain.

🧵 1/6

[f4lc0n @al_f4lc0n]

the figures referenced in the post are entirely misleading. There was no impact realized from this issue. Zero user funds were affected and zero addresses were compromised.

My response: Are you suggesting I should have actually exploited the bug and caused real damage before coming to talk to you?

For the stated vulnerability to work in practice, it would require execution of several suspicious transactions that would have an extraordinarily limited impact.

My response: You should know better than anyone that on a Cosmos-based chain, a single transaction can pack multiple messages. Just one transaction is more than enough to completely drain multiple whale accounts.

Injective has dynamic rate limiting functionalities which are applied automatically based on our live monitoring systems. This functionality has been live on mainnet since last year and is publicly available in our code base.

My response: First, this has nothing to do with the vulnerability itself. Rate limiting doesn't stop attackers from stealing funds. It only slows them down when they try to bridge those funds over to Ethereum. Second, when I submitted my report, the mainnet configuration for this feature was not set. In other words, this feature wasn't even turned on!

In addition to all of the above, this report was reviewed against the clearly defined terms of our Immunefi program. Based on those terms, issues such as those raised in this report that DO NOT impact block production or consensus are categorized outside of the Blockchain/DLT tier and carry a maximum payout of $50,000.

My response: First, Immunefi has always put the impact of direct fund theft at the very top of its priority list. This is a fact that everyone knows. Second, you changed your bug bounty page after I submitted my report. Here’s the snapshot from November 8, 2025: https://t.co/ykKckJVrVM . And now, there’s an extra line added to your bug bounty page: “IMPORTANT: Within the Assets in Scope table, the injective-core folder is listed for both Blockchain/DLT and Web/App due to overlap between the two within the same folder. However, for a report to be categorized as Blockchain/DLT, the resulting impact has to be directly involved with the block production process or with consensus failures. All reports not dealing directly with either of these are to be categorized as Web/App.” I’d really like to know when this line was added. and do you really value chain consensus more than users' funds?

We remain committed to fair, transparent, and consistent handling of all reports, and to maintaining the highest standards of security for the ecosystem. Injective has done so since its mainnet inception in 2021 and will continue to do so in perpetuity, always putting builders and security first.

My response: You never even replied to my messages, and now you’re blaming me for not requesting mediation? I can post the original report if you agree. I left many messages, but you haven't replied to a single one.

----------

Finally: Stop making excuses from every angle and trying to use technical jargon to confuse people who aren't developers. That doesn’t work anymore these days. Anyone can just ask an AI to fact-check what both of us are saying. I have no ill intentions toward your project. All I'm asking is for you to be honest and handle this transparently.

[f4lc0n @al_f4lc0n]

I Saved Injective's $500M. They Pay Me $50K.

I like hunting bugs on @immunefi . I'm decent at it.

- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)

Life was good. Then I found a Critical vulnerability in @injective .

This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.

I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.

Then — silence. For 3 months. No follow up. No technical discussion. Nothing.

A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.

I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.

I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.

Full Technical Report: https://t.co/lki2tL9bxw

[Ulaş Anıl @_ulasanil]

@thedawgyg @immunefi Good luck mate 🙏 Let me know if you have any questions on how the process works. I have some experience working with them 🙃

[Ulaş Anıl @_ulasanil]

@bri_samed @0xjonah1 @immunefi Congratz legend 🎉

[Nethermind Security @NethermindSec]

Congratulations to @_ulasanil, one of our expert auditors, for earning a $150,000 bug bounty for a critical vulnerability report on @immunefi.

Our team lives and breathes security. This kind of work happens behind the scenes every day through audits, deep research, and real-world impact.

[Ulaş Anıl @_ulasanil]

@trimkadriu Thank you broooo ❤️

[Ulaş Anıl @_ulasanil]

@xKeywordx Thanks bro 🙏

[Ulaş Anıl @_ulasanil]

@baxteragu @immunefi Thank you 🙏

[Ulaş Anıl @_ulasanil]

Just got a confirmed bug on @immunefi https://t.co/GW6vQ7i3BF BUT..It wasn't a smooth ride. Not at all. Constantly got ignored by Immunefi. Questions were left unanswered. Mediation was concluded with 0 explanation to me. Not a good start for me. Hope the next one will be better.

[Pierre @pldespaigne]

On June 24th, I saw @_ulasanil’s tweet and reported it on our internal Slack.

Five weeks later: it was classified as critical and awarded $150K.

Don’t lose faith, sometimes it takes a while, but it’s worth it!

https://t.co/gGgV9XfxKF

[ljj @ljjeth]

Legend @_ulasanil

[Ulaş Anıl @_ulasanil]

@k_smarter @immunefi Thank you so much legend ❤️

[Ulaş Anıl @_ulasanil]

@shealtielanzz @0xriptide @immunefi Hell nah.