Albert

Blockchain & Protocol Engineer
Security Researcher & Bug Bounty Hunter
Solidity/EVM | DeFi Security | Rust/Anchor
Prev @rss3_

[Albert @iavldev]

Immunefi平台有22%+的项目需要付费提交报告，费用 $10–$100 USDC 不等，新手再额外加$100

[Albert @iavldev]

为啥币价上去了，岗位没回来啊

[Albert @iavldev]

Balancer 要退出了。
2025 年 11 月的 Critical 漏洞造成$121.1M损失，此后 TVL 、协议收入和市场信心一直没能真正恢复。
据 9 月 14 日 wind-down 提案，团队每月 burn 约 15 万美元，而 8 月协议收入仅约 3 万美元，继续消耗 treasury 等待增长恢复，已经不是他们认为合适的选择。

[Albert @iavldev]

Chatterfly三个邀请码

[Albert @iavldev]

5小时和神对话了一次，他告诉我的是这个

[Piyush Shukla 🇮🇳 @PiyushShukla__]

Bug bounty these days is very interesting.

You’ll spend hours finding an issue, building a PoC, and writing detailed reports, making sure you haven’t missed anything that could cause the report to be marked invalid.

Then you also have to think about the possibility of a duplicate.
After all that, you may end up paying $100+ just to submit reports because of submission fees. And even after paying, an AI triager can spend 10–20 minutes on the report and close it with an unnecessary reason without actually understanding the core issue.

Of course, once the report is closed, you can’t properly discuss or demonstrate the issue further. Then you may have to pay another ~$200 for mediation, after which they might escalate the issue if it is eventually confirmed.

And there’s still no guarantee that you’ll be rewarded or even get your money back.

So you can end up paying $300+ just to make sure your issue gets properly validated.

At this point, it feels less like bug bounty and more like gambling.

[Albert @iavldev]

有些项目的 bug report 必须先支付 submission fee，而且不退款。
你：找到漏洞 → 支付 submission fee → 提交 → 可能 Valid / Invalid / Duplicate。
如果最后是 Invalid，那么：研究时间 + AI/API 成本 + submission fee = 全部亏掉

[Albert @iavldev]

@dtzy_88 重置完 pro 就去睡了，刚刚醒来把 plus 重置了

[ControlZ @ControlZ_1337]

And here I am, having reported vulnerabilities throughout my career that could have resulted in a total of several billions (yes, with a B, > $2B) being *stolen*, while my total earnings are around $2M.

So what's the lesson the industry is teaching researchers?

That next time we should steal the funds first, then negotiate a "responsible disclosure," return 80–90%, and walk away with 10–20%?

Obviously, no. But it's insane that the incentives can make that rhetorical question even possible.

The bounty world is broken.

Blackhats exploit a protocol and get treated like kings in negotiations. Meanwhile, whitehats disclose the exact same kind of vulnerability privately, prevent any damage from happening, and then spend months arguing with projects that try to downgrade the finding and pay the bare minimum.

I'm fighting several cases like this right now. Millions of dollars protected, vulnerabilities responsibly disclosed, and yet projects still don't want to pay the amounts they themselves advertised.

We should be making responsible disclosure the overwhelmingly obvious choice.

Instead, the current state of Web3 is doing its absolute best to discourage whitehats while creating increasingly attractive incentives for blackhats and "grayhats".

Those incentives are backwards, and eventually the ecosystem pays the price.

[Albert @iavldev]

solidity官方建议使用 via-IR 或特殊 storage layout 的项目升级到 0.8.36+

[Albert @iavldev]

之前对 compiler version 的策略一直是“除非有新语言功能否则不升”。但 compiler correctness bug 和普通 library bug 不同：源代码审计可以完全正确，最终 bytecode 仍可能错，尤其 via-IR 正越来越常见。

[Albert @iavldev]

Smart contract security ≠ protocol security.

代码审计只是其中一层。
运营安全实践、密钥管理、社会工程防御、signer / relayer / oracle / bridge，以及整个 off-chain infrastructure，都属于协议的真实攻击面。
https://t.co/Rgk7GfqpIU

[Albert @iavldev]

开发一个代码库时出现了 exploit、交易 trace、反编译、漏洞复现、Foundry PoC 等内容，触发了OpenAI的safeguard🤣

[Albert @iavldev]

24/7 monitor看起来也没有

[Albert @iavldev]

Assets Under Management ≠ Assets Securing Governance
治理接管成本太低了，攻击者没有绕过权限控制，而是用 0.5 ETH + 25 USDC 左右的成本，合法的买到了绝大多数治理投票权，控制了约 850 万美元资产 https://t.co/eviD9c6icN

[Albert @iavldev]

哦草！

[cvh @cvhessert]

🚨Critical security update for LEDGER hardware wallets

A critical vulnerability has been identified in the Ethereum app on Ledger hardware wallets. It could allow a malicious application to alter the details of a transaction during signing, without this being visible on the device screen.

This has been fixed in Ethereum app version 1.22.2. If you use a Ledger device, please update ASAP

While you're in there, it's also good practice to make sure Ledger Live and your device firmware are fully up to date.

[Albert @iavldev]

@SoonCrush 全世界最贵的链就是波场

[Albert @iavldev]

@OneKeyCN 和railgun相比，优势在哪里？

[Albert @iavldev]

@MEJ50749 小狐狸的 tron 钱包私钥不支持导出导入和 dapp 连接，如果导强行用 evm 钱包私钥，生成的 tron 地址和别的 tron 钱包地址不一样，这设计逆天了

[Albert @iavldev]

@taresky typeless：青一块，紫一块
微信输入法：青一块，紫一块
iOS：青¥1紫¥1