HackerBane

Software audits, security and research. Reports at

[HackerBane @hackerbane]

This week our team found high-sev vulnerabilities in ZeroDev's Bastion session wallet. Replaying a signature refills a factory budget that was already spent.

Full report: https://t.co/D9Dk1cFNoG

[HackerBane @hackerbane]

@Harvesto12 Enough to make it not worth it. I'd say 9/10 genuine findings get ignored, called "known" or "intended", or straight up rejected for no good reason.

[HackerBane @hackerbane]

@p_tsanev Public bounties are a scam these days

[HackerBane @hackerbane]

This week our team reviewed @Shipfox_HQ. We found four vulnerabilities, one critical.

Communication with the team was excellent, and all findings were resolved within 48 hours.

Full report: https://t.co/z9OsLxRLGB

[HackerBane @hackerbane]

@Samaytwt Happens to the best of us

[HackerBane @hackerbane]

@0x15_eth Public bug bounties are almost always a scam

[HackerBane @hackerbane]

@iitz_ctfguy This is how it goes with public bounty programs these days unfortunately

[HackerBane @hackerbane]

@0zSchnack Public bug bounties are very low yield now that anyone with a claude sub can join the party unless you have some very sophisticated techniques

[HackerBane @hackerbane]

@LoopandPixels Software security and penetration testing. Never been a better time.

[HackerBane @hackerbane]

We found 2 Critical vulnerabilities in a live token protocol this week. The findings have not been resolved.

100% of the protocol's live TVL is currently at risk, and the team have not yet responded to our report.

[HackerBane @hackerbane]

@osec_io This is state of the art in auditing excellence, bravo

[HackerBane @hackerbane]

Our researcher found 6 high-severity vulnerabilities found in a Web3 bridging platform. Multiple attempts to contact the team via DMs, email and Discord. Still no response.

If you're handling user funds, ignoring security disclosures is unacceptable.

[HackerBane @hackerbane]

@pickover Why would I want -$1/12?

[HackerBane @hackerbane]

This week our team audited oksolc, the Zig implementation of the Solidity compiler.

Writing a secure and correct compiler code is one of the most technically challenging areas in Computer Science.

full report: https://t.co/DbZRHErlMH

[HackerBane @hackerbane]

@CodeWithAmann We've seen a metric tonne of AI slop in Go and Rust projects in our auditing work

[HackerBane @hackerbane]

@okcontract It was a pleasure working with you

[HackerBane @hackerbane]

Our lead security researcher has contacted @OpenAI about a vulnerability in ChatGPT, allowing full nudity imagery through the chat UI.

We've notified OpenAI and are withholding reproduction details while the issue is assessed.

More to follow

[HackerBane @hackerbane]

HACK: Ledger asked CryptoBilis to pause sales and shipments of their hardware wallet.

If you bought a device there in the last 90 days, do not set it up. If you already did, move the funds to a new device with a new seed immediately.

[HackerBane @hackerbane]

@forevermoney_ai @chainlink Code quality was excellent, it was a pleasure to work with you.