Dmitriy Shagov

[Dmitriy Shagov @dmi3sh]

@Jhaddix Studio Ghibli museum in Mitaka (Tokyo) is wonderful. Awesome museum, built with great love to details. Would 100% recommend if family have seen or heard about Miyazaki cartoons.

PS If you cant buy tickets using the english version of the website, try switching to japanese

[Dmitriy Shagov @dmi3sh]

@BuildHackSecure @MiniMjStar @GodfatherOrwa @Hacker0x01 @h4x0r_dz ChatGPT says basically the same. There are restrictions against some individuals and some organisations (GPT mentioned banks).

If you are not one of the sanctioned individuals and are not trying to get paid via the sanctioned bank — then legally you are ok.

[Dmitriy Shagov @dmi3sh]

@MiniMjStar @BuildHackSecure @GodfatherOrwa @Hacker0x01 @h4x0r_dz There is a list of restrictions regarding a number individuals and organisations. I doubt there were Russian h1 users who had their names listed in the OFAC sanctions.

[Dmitriy Shagov @dmi3sh]

@BuildHackSecure @GodfatherOrwa @Hacker0x01 @h4x0r_dz That's BS. There are no sanctions against doing this type of business. There was no legal pretext. "Sanctions" is not some vague thing that gives one an excuse to do all kinds of bs and steal researchers money.

What they did was not motivated by any OFAC decree.

[Dmitriy Shagov @dmi3sh]

@MrTuxracer @synack Hey! What happened? Can i find more details somewhere?

[Dmitriy Shagov @dmi3sh]

@MitchellAmador Big respect for diving into history and Cuban missile crisis analogy. It is very pleasing to see someone willing to speak calmly about such topic in the world full of hysteria.

[0xDjango @0xDjangoOnChain]

In November, I submitted a critical bug to Cronos (@cronosapp) which they downplayed and have since been kicked off Immunefi. Here's some info about the bug and an example of how projects can simply not pay a fair amount.

Report: https://t.co/Kwiv9RYzkP

tl;dr:
- It's a simple staking contract where you stake your TONIC and receive xTonic at the current exchange rate.
- The vulnerability lies in a function called performConversionForERC20() which allows anyone to convert other tokens held by the contract into TONIC.
- This function is vulnerable to reentrancy because the caller sets an arbitrary swap path and can inject a malicious token in the middle to gain control of execution.
- The contract determines the estimated amount of TONIC that should be received by the swap, and any extra goes to the caller as a reward.
- But since there is reentrancy, the caller can also STAKE their TONIC prior to the above function completion.
- The caller's stake is honored AND they are transferred back their TONIC, essentially receiving free staked tokens.

Caveat:
There is a 10 day unstaking delay. So the exploiter would not be able to actually convert the staked tokens back into TONIC until the cooldown period had passed.

What Cronos said:
Thank you for reporting this issue.

The team has verified that the exploit described can indeed work. From our side, we have safeguards in place to mitigate these risks; such as a 10 days delay period for the xTonic minted. As such, there is a low possibility of the exploit realising; as the issue will be rectified before the exploiter can launder the gotten funds.

However, we do appreciate your effort in identifying this issue and plan to update the contract to eliminate the risk entirely. In addition, we are happy to reward you with USD1,600 as a token of appreciation.

Actions:
Cronos fixed the vulnerability immediately, before even responding to the report.

My thoughts:
Obvious lowball. Cronos's max bounty was $250,000 and they offered $1,600. I understand the technicality with this attack, and would have agreed to a payout less than the max, but the payout would have to accurately represent the value of this report.

Mediation:
Immunefi mediated twice and confirmed that this report deserved the max bounty. Immunefi told Cronos that a simple unstaking delay is not an adequate means of protection.

Cronos claimed:

"We have implemented a robust monitoring framework, consisting of internal systems, protocols, and strategic third-party partnerships, which promptly respond to any anomalies within our smart contracts. This is the standard of any big organization, and we refrain from disclosing further specifics to maintain the integrity of our security protocols."

When Immunefi asked them to provide any information regarding their automated detection and mitigation processes, Cronos would not comply.

Result:
Cronos was kicked off Immunefi.

Final thoughts from Django:
'Tis the life of a bug hunter.

[Dmitriy Shagov @dmi3sh]

@0xTib3rius OpenCart related joke? :)

[Dmitriy Shagov @dmi3sh]

@_s1m3on_ @InsiderPhD Lol. I attached links to RFCs and MDN docs :)

[Dmitriy Shagov @dmi3sh]

•Attack Complexity: High
•User Interaction: Required

What?!

[publiclyDisclosed @disclosedh1]

HackerOne disclosed a bug submitted by @bebiksior: https://t.co/823Zu8cvVw - Bounty: $2,500 #hackerone #bugbounty

[Dmitriy Shagov @dmi3sh]

@DeanEigenmann love the word-play here :)

[Dmitriy Shagov @dmi3sh]

@0xTib3rius Thanks! You are right.

I just checked the rfc and it says that empty signature is required for "alg": "none".

[Dmitriy Shagov @dmi3sh]

@pmnh_ Imo, the best preparation for real-world bug hunting is real-world bug hunting. Read write-ups, look for bugs, try to repeat ideas, research, reiterate :)

[Dmitriy Shagov @dmi3sh]

@pmnh_ I have a controversial opinion about CTFs. Imo, CTF is bug hunting without bounties. So why do CTFs when there are rewardable bugs everywhere? Why focus on flags when there are identical real bugs?

[Dmitriy Shagov @dmi3sh]

@nnwakelam Depends. I’d take into consideration timeframe and what is happening on the backend. For example, 1M requests bruteforcing static js files don’t look bad. But 1M requests to some dynamic stuff is too much imo.

[Roman Buzko @roman_buzko]

Greetings, everyone! Happy to share that https://t.co/qUXYExyJ7v is transitioning from an invite-only platform to a public alpha.