Joes Experiences

I Travel the World, Trade Stocks, Build Applications, Invest and Live in South East Asia

[Joes Experiences @JoesExperiences]

So locked in, my damn eyes are bleeding from staring at codebases.
This is the grind I live for.
#Web3 #BugBounty #CodeLife #Web3Security

[Immunefi @immunefi]

It's January 2026…

Your inbox is overflowing with “ser pls I need a private audit” from protocol founders you’ve never met.

You remember 6 months ago when you stayed up past midnight chasing that first bug on Immunefi

Now you’ve stacked seven figures in bounties

Life is good

[chrisdior @chrisdior777]

I get up, train, and work in Web3 security. Sleep. Repeat.

That’s it - I’m fully locked in. I don’t even go out with friends in the evenings, only on weekends.

I want to become one of the leading experts in Web3 security.

[Joes Experiences @JoesExperiences]

@0x1engineer @0xGreed_ Consistency is good for being slighty better than average. After that you need intensity, persistence and maybe even a bit of insanity to go over that level

[Joes Experiences @JoesExperiences]

@0x1engineer @0xGreed_ It's really hard to say which one is better and probably depends on the person. But I would say most aha moments happen when you're completely going crazy at something for a lot of hours in one day. That's when you have the most context stored in your brain to connect the dots.

[Joes Experiences @JoesExperiences]

@DevDacian @giovannidisiena @strata_money Amazing! Was already reading some of these findings on solodit today, incredible that its there already :)

[Joes Experiences @JoesExperiences]

@panditdhamdhere GM!

[Joes Experiences @JoesExperiences]

@m4rio_eth Best would be to have the separate device only for crypto operations and have it completely air gapped.

[Peter / 1k(x) @pet3rpan_]

types of adults now working in crypto:

runescape kids
call of duty kids
minecraft kids
habbo hotel kids
world of warcraft kids
counterstrike kids

[Joes Experiences @JoesExperiences]

Real-world auditing is 95% adversarial reasoning and 5% bug hunting.

If you understand the system better than the developers → you will find bugs.

[Joes Experiences @JoesExperiences]

90% of audit difficulty = unclear intent
10% of audit difficulty = actual vulnerability hunting

[Joes Experiences @JoesExperiences]

Assume every function can be called with garbage
Even if the doc says "only called by X" — check if that's enforced on-chain.

and

Look for invariants
You ask:
“What must always be true?”
“Where can these invariants break?”

[Joes Experiences @JoesExperiences]

Most people give up at the 80% mark.
The ones who push through that last 20% where all the real debugging, edge cases, and learning happen.

[Joes Experiences @JoesExperiences]

It has happened to me so many times now that it's commical. I think I have something and then try to write a PoC and be proven wrong, brutal haha. Gotta love it tho, makes me fired up

[Joes Experiences @JoesExperiences]

Damn just proved with a PoC that 2 of my findings are actually invalid. This is why its important to write PoCs, you never know if a validation of inputs doesn't happen in some external contract called by the function you think is vulnerable.

[Joes Experiences @JoesExperiences]

Complacency is the new poverty line.

[Joes Experiences @JoesExperiences]

@andrewcmonte Banks only care about one thing. Having your money sit queitly at their place. Once you start trying to move the money out, you're gonna have a bad time.

[Joes Experiences @JoesExperiences]

@ygorz01 @CyfrinUpdraft Have fun while you still can haha. What's the plan after you get succeed in getting certified?