Kris RenZo

Building @audix_hq | Security Researcher | Educatoor | Portfolio: Join:

[Kris RenZo @KrisRenzo]

With Audix, we don’t want to be seen as an idea, an abstract, a faceless machine, or product; we are your friends and colleagues, squatting by your side through your Web3 security and development journey.

We are humans and want to be seen as such.

Be vulnerable with us, as we will be with you.

[Kris RenZo @KrisRenzo]

Dear God. The abuse of “skills” I have seen on this agentic front.

[Kris RenZo @KrisRenzo]

The last time I saw this level of copium, people were still buying NFT JPEGs for $100k

[CP🇵🇹 @UtdCitypriest]

Croatia aren’t the same team they used to be.

Spain look far less effective without Yamal, and even he isn’t at his best right now.

Portugal can beat Morocco through sheer hatred, revenge, and the right mentality.

Mbappe might not even be at his best because of his admiration for Ronaldo.

I’ve also never really seen Germany as a major threat cos they’re still inexperienced, and they also have Kai Havertz.

Guys, Portugal might actually go on to win this after all.🥺❤️

[Kris RenZo @KrisRenzo]

I love how they are now increasing the heat under the bounty sponsors

[Immunefi @immunefi]

In case you missed it, here are five things Immunefi shipped this month:

1. IronScore
A free security score for any protocol, rated from 0 to 100 and ranked on a public leaderboard.

It also includes a wallet scanner that shows how much of your value is sitting in weakly secured protocols.

2. Immunefi Studio
A new toolkit built with and for top security researchers.

It includes Studio Reviews and Studio Signals.

3. Studio Reviews
Get structured feedback on your bug report before you submit it, so a real finding doesn’t get weakened by a weak writeup.

4. Studio Signals
Access real program data before committing your hours, including which programs pay and how fast they move.

5. Dark mode
Easier on the eyes. Finally.

Some of these shipped in limited release first, but we’ll be rolling them out to everyone soon.

[Kris RenZo @KrisRenzo]

@VittoStack Interested

[Kris RenZo @KrisRenzo]

@adeolRxxxx Yeah, I'll give them that

[Kris RenZo @KrisRenzo]

To a KuCoin address???
Maybe we overrate these guys

[Parallel @ParallelMoney]

Follow-up to our earlier post:

On May 7, 2026 at 19:50:47 UTC, an attacker attempted to exploit an accounting edge case in the sUSDp savings vault on Ethereum.

The attempt failed. No funds were lost. User funds are safe.

The vector was an ERC4626 inflation / donation-style attack against the sUSDp vault's accounting. In simple terms, the attacker tried to capture an inflated share of the vault's assets by first accumulating a very large percentage of the sUSDp vault supply, then attempting to trigger an inflation event and redeem against an accounting imbalance.

This type of attack only becomes economically viable under very specific conditions, all of which had to hold simultaneously:
1. The attacker must control a very high percentage of the vault supply (>99% of totalSupply on the target chain), so that most of the inflated assets accrue to them rather than being diluted across other holders.
2. The vault must have had a long inactivity window (several weeks with no interaction), so that the dormant accrued yield accumulates and is minted in a single lump during the next interaction.

These conditions were uniquely met on the Ethereum sUSDp vault: a small total supply (~2.7k sUSDp), no accrual for ~40 days (since March 29, 2026), and an attacker who had spent the previous 57 days quietly building a position of 2,672 sUSDp (~99% of the Ethereum supply), split across two independently funded addresses:
- 0xfa8ba3b8ee8691847fbbc9532116ba3f21278b49 (372 sUSDp)
- 0xb6747DF4D24338fD8e1C2b366D23825B35ADc4F3 (2,300 sUSDp)

These two positions were funded from sources not directly linked on-chain to the attacker's operating address, which is the address used to deploy the exploit contracts and submit the attack transactions: 0x6375c37761a26fac9b201af9f527caa9627aea11

Estimated impact. Based on our auditors' analysis of the attack transaction, had the exploit succeeded, the attacker would have ended up with over 1.52M USDp. The mechanism would have unfolded as follows:
1. The attacker contract first transfers the sUSDp shares from the two preparation wallets, giving it 99.88% of the vault's totalSupply.
2. The contract then deposits 223.83M USDp into the savings vault.
3. The dormant fixed-rate interest accrual on the inflated balance mints an additional 1.525M USDp into the vault, bringing total assets to 225.355M USDp.
4. The contract redeems its 99.88% share, walking away with approximately 1.52M USDp.

Forensic timeline (UTC):
- A few hours before the attack: the attacker created a Safe (https://t.co/mudd1LXwuq). We are not certain of the intent, but our working hypothesis is that this was an attempt to disguise the on-chain pattern from monitoring systems such as Hypernative.
- 19:50:47: The attacker initiated his first attempt by deploying an exploit contract (https://t.co/v3932U5aoK). The attack transaction was submitted shortly thereafter and reverted on-chain. Based on our current analysis (still being confirmed), the revert was caused either by insufficient gas to cover the LayerZero fee for the bridge leg of the exploit, or by attempting to bridge an amount exceeding our daily cross-chain limit (2.5M USDp). Either way, the exploit did not execute.
- ~30 to 45 seconds later: @HypernativeLabs' live monitoring detected the pattern, and the relevant contracts were paused within a few blocks of the failed transaction.
- 20:52:23: The attacker deployed a second exploit contract (https://t.co/NN3Fwa5krh) and submitted a second attack transaction. This one reverted because the contracts were already paused.
- After the second failure: the attacker forwarded his remaining ETH through several intermediary wallets in sequence before sending it to what we believe to be a KuCoin address (https://t.co/kJB95cSYEo). This appears to be another attempt to obscure the trail.

Why the attack failed: defense in depth. The attempt was stopped by three independent layers, any one of which would have been sufficient on its own.
1. The attacker's own attack transaction failed on-chain. Based on our preliminary analysis (still being confirmed), the failure was caused either by insufficient gas for the LayerZero fee, or by hitting the 2.5M USDp daily cross-chain bridge limit. The exploit therefore never executed.
2. @HypernativeLabs' live monitoring detected the pattern shortly after, and the relevant contracts were paused within a few blocks (~30 to 45 seconds) of the failed transaction. By the time the attacker re-attempted at 20:52:23 UTC, the contracts were already paused.
3. Bridge finality would have trapped the funds. Even in the counterfactual where the first transaction had succeeded and the bridge had been triggered, LayerZero finality from Ethereum to Base takes ~4 minutes. The pause of lz-USDp (within ~30 to 45 seconds) would have caught the in-flight bridge message well before delivery on Base, and the exploited USDp would have been frozen in the bridge.

In other words, the attacker needed his transaction to land, the contracts to stay live for the next 4+ minutes, and the bridge to deliver. All three failed.

Status of the attacker's position. With sUSDp paused, the attacker's 2,672 sUSDp are frozen. He cannot redeem, transfer, or otherwise access these funds. The address at the end of the on-chain trail, which we believe to be a KuCoin address, is subject to KYC, so the attacker is potentially identifiable.

Why this is bounded. The same conditions that made sUSDp on Ethereum exploitable (small supply, multi-week inactivity, adversary holding ~all of it) do not currently exist on our other deployments: Base, HyperEVM, and Avalanche. The attack vector requires both a supply concentration and a dormancy window that are easy to monitor and prevent.

Current status:
- No funds were lost
- User funds are safe
- USDp remains transferable
- The Savings Module (sUSDp) remains paused
- The Bridging Module (lz-USDp) and Parallelizer Module remain paused for now as a precaution

Based on the auditors' recommendations, the Bridging Module and Parallelizer Module will be unpaused once the DAO multisig signers tighten the bridging, minting, and burning limits.

The Savings Module will remain paused until the vault accounting patch is finalized and audited. As an immediate operational measure, on the auditors' recommendation we have already issued a setRate() call across all four deployments (Ethereum, Base, HyperEVM, Avalanche) to reset the accrual state and clear any accumulated dormant lump. Two independent audits will be performed on the patched contracts, by @bailsecurity and @cyfrin, before redeployment. The module will only resume once we and our partners are fully confident the vector is closed.

This is exactly why we operate with multiple layers of security: audits, bug bounty, live monitoring, emergency pause procedures, backup domains, and additional operational safeguards. Today, every layer was tested and held.

A full post-mortem will follow in the coming days with the complete technical write-up, timeline, remediation steps, and next actions.

[Parallel @ParallelMoney]

Follow-up to our earlier post:

On May 7, 2026 at 19:50:47 UTC, an attacker attempted to exploit an accounting edge case in the sUSDp savings vault on Ethereum.

The attempt failed. No funds were lost. User funds are safe.

The vector was an ERC4626 inflation / donation-style attack against the sUSDp vault's accounting. In simple terms, the attacker tried to capture an inflated share of the vault's assets by first accumulating a very large percentage of the sUSDp vault supply, then attempting to trigger an inflation event and redeem against an accounting imbalance.

This type of attack only becomes economically viable under very specific conditions, all of which had to hold simultaneously:
1. The attacker must control a very high percentage of the vault supply (>99% of totalSupply on the target chain), so that most of the inflated assets accrue to them rather than being diluted across other holders.
2. The vault must have had a long inactivity window (several weeks with no interaction), so that the dormant accrued yield accumulates and is minted in a single lump during the next interaction.

These conditions were uniquely met on the Ethereum sUSDp vault: a small total supply (~2.7k sUSDp), no accrual for ~40 days (since March 29, 2026), and an attacker who had spent the previous 57 days quietly building a position of 2,672 sUSDp (~99% of the Ethereum supply), split across two independently funded addresses:
- 0xfa8ba3b8ee8691847fbbc9532116ba3f21278b49 (372 sUSDp)
- 0xb6747DF4D24338fD8e1C2b366D23825B35ADc4F3 (2,300 sUSDp)

These two positions were funded from sources not directly linked on-chain to the attacker's operating address, which is the address used to deploy the exploit contracts and submit the attack transactions: 0x6375c37761a26fac9b201af9f527caa9627aea11

Estimated impact. Based on our auditors' analysis of the attack transaction, had the exploit succeeded, the attacker would have ended up with over 1.52M USDp. The mechanism would have unfolded as follows:
1. The attacker contract first transfers the sUSDp shares from the two preparation wallets, giving it 99.88% of the vault's totalSupply.
2. The contract then deposits 223.83M USDp into the savings vault.
3. The dormant fixed-rate interest accrual on the inflated balance mints an additional 1.525M USDp into the vault, bringing total assets to 225.355M USDp.
4. The contract redeems its 99.88% share, walking away with approximately 1.52M USDp.

Forensic timeline (UTC):
- A few hours before the attack: the attacker created a Safe (https://t.co/mudd1LXwuq). We are not certain of the intent, but our working hypothesis is that this was an attempt to disguise the on-chain pattern from monitoring systems such as Hypernative.
- 19:50:47: The attacker initiated his first attempt by deploying an exploit contract (https://t.co/v3932U5aoK). The attack transaction was submitted shortly thereafter and reverted on-chain. Based on our current analysis (still being confirmed), the revert was caused either by insufficient gas to cover the LayerZero fee for the bridge leg of the exploit, or by attempting to bridge an amount exceeding our daily cross-chain limit (2.5M USDp). Either way, the exploit did not execute.
- ~30 to 45 seconds later: @HypernativeLabs' live monitoring detected the pattern, and the relevant contracts were paused within a few blocks of the failed transaction.
- 20:52:23: The attacker deployed a second exploit contract (https://t.co/NN3Fwa5krh) and submitted a second attack transaction. This one reverted because the contracts were already paused.
- After the second failure: the attacker forwarded his remaining ETH through several intermediary wallets in sequence before sending it to what we believe to be a KuCoin address (https://t.co/kJB95cSYEo). This appears to be another attempt to obscure the trail.

Why the attack failed: defense in depth. The attempt was stopped by three independent layers, any one of which would have been sufficient on its own.
1. The attacker's own attack transaction failed on-chain. Based on our preliminary analysis (still being confirmed), the failure was caused either by insufficient gas for the LayerZero fee, or by hitting the 2.5M USDp daily cross-chain bridge limit. The exploit therefore never executed.
2. @HypernativeLabs' live monitoring detected the pattern shortly after, and the relevant contracts were paused within a few blocks (~30 to 45 seconds) of the failed transaction. By the time the attacker re-attempted at 20:52:23 UTC, the contracts were already paused.
3. Bridge finality would have trapped the funds. Even in the counterfactual where the first transaction had succeeded and the bridge had been triggered, LayerZero finality from Ethereum to Base takes ~4 minutes. The pause of lz-USDp (within ~30 to 45 seconds) would have caught the in-flight bridge message well before delivery on Base, and the exploited USDp would have been frozen in the bridge.

In other words, the attacker needed his transaction to land, the contracts to stay live for the next 4+ minutes, and the bridge to deliver. All three failed.

Status of the attacker's position. With sUSDp paused, the attacker's 2,672 sUSDp are frozen. He cannot redeem, transfer, or otherwise access these funds. The address at the end of the on-chain trail, which we believe to be a KuCoin address, is subject to KYC, so the attacker is potentially identifiable.

Why this is bounded. The same conditions that made sUSDp on Ethereum exploitable (small supply, multi-week inactivity, adversary holding ~all of it) do not currently exist on our other deployments: Base, HyperEVM, and Avalanche. The attack vector requires both a supply concentration and a dormancy window that are easy to monitor and prevent.

Current status:
- No funds were lost
- User funds are safe
- USDp remains transferable
- The Savings Module (sUSDp) remains paused
- The Bridging Module (lz-USDp) and Parallelizer Module remain paused for now as a precaution

Based on the auditors' recommendations, the Bridging Module and Parallelizer Module will be unpaused once the DAO multisig signers tighten the bridging, minting, and burning limits.

The Savings Module will remain paused until the vault accounting patch is finalized and audited. As an immediate operational measure, on the auditors' recommendation we have already issued a setRate() call across all four deployments (Ethereum, Base, HyperEVM, Avalanche) to reset the accrual state and clear any accumulated dormant lump. Two independent audits will be performed on the patched contracts, by @bailsecurity and @cyfrin, before redeployment. The module will only resume once we and our partners are fully confident the vector is closed.

This is exactly why we operate with multiple layers of security: audits, bug bounty, live monitoring, emergency pause procedures, backup domains, and additional operational safeguards. Today, every layer was tested and held.

A full post-mortem will follow in the coming days with the complete technical write-up, timeline, remediation steps, and next actions.

[Kris RenZo @KrisRenzo]

@0xenzo_eth @immunefi @CyfrinUpdraft I really like your work ethics

[Hunter @Huntoor]

80%+ of ai found BB that got paid well were simple bugs.

Is this called luck?, or called "my ai tool is ultra intelligent".

[Kris RenZo @KrisRenzo]

I've always imagined the list of invalid issues as a treasure trove for black hats.
Go to any contest, search for highly contested issues, and build upon them. With AI, it's even easier.

[playboi.eth @adeolRxxxx]

Ekubo was hacked after a public contest audit at c4. Man, I have been thinking.

Those black hats would probably have been laughing at our ass during those times.

insane skill gap.

[Kris RenZo @KrisRenzo]

@0xenzo_eth @sherlockdefi Happy birthday Enzo 🥂

[AlexSR @0xAlexSR]

Glad to see the interest in ProofOfRep!

Now it's your turn. Go submit a report on your experience with bug bounties or audit contests (positive or negative).

https://t.co/SVqh6CNb0h

[Kris RenZo @KrisRenzo]

@smartdeckk @0xAlexSR I had to go offline for a while. Had too much going on.
But I'm back now.

How have you been?

[Kris RenZo @KrisRenzo]

@0xAlexSR It's a much-needed public good. I'm confident it will take off.

[AlexSR @0xAlexSR]

Been wanting this to exist for a while, so I built it.

ProofOfRep, a reputation board for bug bounty programs and contests.

Report your unfair or dishonest experiences, with proof, and I'll manually review everything.

Hope it helps SRs focus on projects that actually take security seriously.
Still early. Let me know if this sucks or if it's useful. All feedback welcome.
https://t.co/AfBU7vCwmA

[Kris RenZo @KrisRenzo]

Have you heard of shameless marketing before?

No?

Just wait until this next Audix feature drops 🚀

[Kris RenZo @KrisRenzo]

I came here to see what all the fuss about this Bitcoin was about,

Now, I’m deep diving into PBFT simulation and byzantine failures.

[Kris RenZo @KrisRenzo]

@Pelz_Dev @sherlockdefi Congratulations Pelz 🥂

[CharlesWang @0xCharlesWang]

If you book @bailsecurity you get the highest standard of security reviews. This includes uncovering a large amount of issues.

And uncovering a large amount of issues is uncomfortable, so this is something you need to be prepared for.