Ben Timor

Isn't it funny how day by day nothing changes but when you look back everything is different?.. -C.S. LEWIS.

[Ben Timor @bentimor]

@samthewhitehat Yes, it got escalated. The program were the ones to reject it, not immunefi.

[Ben Timor @bentimor]

Reported a bug on Immunefi weeks ago. All of this time - No response at all.
Today's morning it got rejected as "Duplicate of an invalid report" while the comment doesn't explain why it's invalid. While clearly their docs explain that my report is a real bug.

[Ben Timor @bentimor]

What are some good sources you read to improve your Web3 security knowledge?

[Ben Timor @bentimor]

@ibrahimatix0x01 Completely agree. It's either way an AI bot, so it won't waste Immunefi's or the program's time if it asks questions.

[Ben Timor @bentimor]

I decided to try creating graphs for smart contracts, not sure if it's gonna help with finding bounties but I decided it's worth trying. Does anyone else here trying similar techniques?

[Ben Timor @bentimor]

I found an exploit on @pixels_online allowing you to steal victim's payouts.
After I reported it - they closed the ticket without responding. And when I asked about it they finally told me "It's not a bug".
I emailed them saying that unless they change their mind, I'll post the details on social media in 48 hours. If it's not a bug, it should be completely okay to post it.

[Ben Timor @bentimor]

@j4ycked @immunefi Nice!

[Pyro @0x3b33]

The other day @immunefi got a lot of hate, so today lets say something positive about them

> A project hasn't responded on 2 Hs for over 1 month
> I post on X and tag IMU
> IMU DMed me 2 hours later saying they're looking into it
> The project responded a few hours after that

Credit where credit is due

[Ben Timor @bentimor]

@0x3b33 @immunefi Immunefi is the best place to hunt Web3 bugs on. I just started working with them lately and their team is great and helpful as much as they can.
It's completely worth a small payment to submit bug reports with a service like that.

[Ben Timor @bentimor]

@immunefi @Firelightfi It was a great competition. Thank you everyone!

[Ben Timor @bentimor]

Shout out to @immunefi !
I submitted a report last week that got rejected because it's "an intended design choice" although it was a real bug.
But after talking to Immunefi's team on Discord, They resolved it quickly and confirmed the report.
So I got another valid finding!

[Ben Timor @bentimor]

Sherlock required a $250 deposit to submit a bug report. I decided to search the protocol and found that they're listed also on Cantina which required only $20.
I reported through Cantina.
$250 will make researches to keep reports to themself. It's too much. @sherlockdefi

[Ben Timor @bentimor]

Usually I work with Immunefi, But for the first time I submitted a report to @cantinasecurity . Hopefully one of many.

[Ben Timor @bentimor]

@S_C_Lam @dimulskiatanas @immunefi @sherlockdefi What's BBP?

[Ben Timor @bentimor]

What Web3 bug bounty programs are legit other than Immunefi? Where do you hunt?

[Ben Timor @bentimor]

@sudo_a7med Sounds like a legit finding. They should have accepted it imo.

[Ben Timor @bentimor]

One of the most annoying things in bug bounties is waiting for response for your report.

[Ben Timor @bentimor]

I just submitted a bug report to @immunefi and it was determined as a duplicate.
Now my accuracy dropped down although their website notes "Paid and confirmed reports count as valid - including duplicates of other valid findings".
And I'm also down $25. But that's a known risk.

[Ben Timor @bentimor]

@Jiri123_eth They really should refund the payment in this case. You submitted a valid bug and you had no way of knowing someone submitted it right before you.
If they want researchers to submit their findings instead of keeping it to themself, they need to improve this process. @immunefi