undefined

Building and Breaking

[undefined @megalo_Pj]

I miss when I use to brainstorm to solve a bug. Late night fixes and all that.

I am currently working on a WhatsApp Bot and tbh, I haven't written a line of code myself. Just prompting away my requests and manually testing.

[undefined @megalo_Pj]

Absolutely (Yes) Not.

[DJ SNAKE @djsnake]

THE WORLD WAS FINE WITHOUT A.I

[floppy.md @1440000bytes]

The 'whitehat' hacker chose 598 BTC over a thank-you email and a hoodie.

[undefined @megalo_Pj]

I think I should do some hackathons to get funds to pay for submissions.

cause at this point, I have exhausted my money paying for duplicate submissions that don't get refunded.

Who knows, I might build something that actually makes me leave web3 security for good.

[Rektoff @rektoff_xyz]

C5 is officially complete.

An hour ago, we held the graduation ceremony, where Rektoffians also showcased projects they've been working on.

Thank you to all 125 students who put in the hours and made it to the finish. You came in writing Rust, and you're leaving as security researchers.

Thank you to our mentors Jack Stodart, @m4rio_eth and @danielkcumming, who set the bar every week and held everyone to it.

And thank you to the @SolanaFndn for backing this work and making it real, cohort after cohort.

The Rust and Solana world just gained a new class of security researchers.

We're already prepping C6. Details soon.

[undefined @megalo_Pj]

Thank you God for keeping things running smoothly.

[undefined @megalo_Pj]

Right now, you need money to hunt in web3 security.

Scratch that, you need money, patience and luck.

[undefined @megalo_Pj]

at this point, security is becoming a joke.

Try bounty, projects will try downgrading your issue if the dups wave doesn't catch it beforehand.

public contest are like thanksgiving (once a year), when it comes, your finding ends up as a dup alongside 150+

[JOSH KRESH™ Sweep 🦈 @JoshKresh]

@encrypt_wizard Guy omo

$10 for 10 people you go see 1.7k submissions 😭😭

[undefined @megalo_Pj]

Lol

[undefined @megalo_Pj]

I tried Opus 5.

1. I just closed two issues I opened in a contest (it gave me a good review of why there are lows. I was even confident I got a good Medium)
2. If you are not careful, it will keep leding you on a goose trail
3. That shit is expensive mehnnnn

[undefined @megalo_Pj]

You just have to be smart with how you use it. There are helpful though.

[undefined @megalo_Pj]

One thing with LLM's, if you are not careful, it will lead you on a goose chase.

You see statements like "That's the gap I'd attack next if you want another pass"

When you as person know fully well, that gap path will be invalid. They just want you to keep buying tokens.

[undefined @megalo_Pj]

This Tare contest is just so........

You have AI scanned reports, Contest reports, AI scanned reports again.....like about 15 files about past audits. Every lead you follow is already known.

Let me go and eat first. We will come back.

[undefined @megalo_Pj]

@buildanythingso @kacieahmed Let’s build.

[undefined @megalo_Pj]

Everyone is making the field hard for beginners.

From paid subs, invite only contest, private audits......now, invite only bug bounties platform.

[CertiK @CertiK]

Today, we're excited to announce the launch of CertiK Hunt - our new invite-only platform connecting elite security researchers with trusted Web3 projects.

CertiK Hunt brings together bug bounty programs, audit competitions, and AI security challenges in one place.
🧵👇

[undefined @megalo_Pj]

Mannnnnnn.

[GiuseppeDeLaZara @windhustler]

I also notice I'm becoming 10x bitter and angry since I started doing bug bounties

[undefined @megalo_Pj]

at least you be de london

[Dr Joe Abah, OON @DrJoeAbah]

The first and only time I ever bet on football was in 1990, when I bet that Cameroon would beat Argentina in the World Cup. The odds were 20-1. I bet £1 (that was all I could afford then) and won £20! Madam and I were living in one room in Seven Sisters, London, then. We were finally able to order egg fried rice and beef in oyster sauce from the local Chinese restaurant. Before then, it was just egg fried rice with chilli sauce and no protein.

I don’t suffer before for this my life o. And this woman suffered with me. Some days, we could only afford one meal and she would lie that she had eaten and give me the meal to eat when I came back from work. I grew up with many relatives living with us. So, by upbringing, I was raised not to finish everything on my plate. It was by watching how she wolfed down everything left on my plate that I finally realised that this woman had not eaten and had sacrificed herself to make sure I ate.

So, now, when anybody says “She’s the one eating all his money, I ask: “Before nko? Were you there when we were eating egg fried rice with no protein from Red Square Chinese Restaurant in 1990?” 😂

[undefined @megalo_Pj]

You will submit an issue, wait days to get feedback that it is a dup.

How do you guys know which project to hunt for bugs? Cos this my second duplicate this month. It's now looking like I hunt only to get dups.

I just need one confirmed report to at least keep the energy going.

[undefined @megalo_Pj]

Try and submit this in a contest and they will argue - “intended design”

They just love that sentence.

[Parallel @ParallelMoney]

Follow-up to our earlier post:

On May 7, 2026 at 19:50:47 UTC, an attacker attempted to exploit an accounting edge case in the sUSDp savings vault on Ethereum.

The attempt failed. No funds were lost. User funds are safe.

The vector was an ERC4626 inflation / donation-style attack against the sUSDp vault's accounting. In simple terms, the attacker tried to capture an inflated share of the vault's assets by first accumulating a very large percentage of the sUSDp vault supply, then attempting to trigger an inflation event and redeem against an accounting imbalance.

This type of attack only becomes economically viable under very specific conditions, all of which had to hold simultaneously:
1. The attacker must control a very high percentage of the vault supply (>99% of totalSupply on the target chain), so that most of the inflated assets accrue to them rather than being diluted across other holders.
2. The vault must have had a long inactivity window (several weeks with no interaction), so that the dormant accrued yield accumulates and is minted in a single lump during the next interaction.

These conditions were uniquely met on the Ethereum sUSDp vault: a small total supply (~2.7k sUSDp), no accrual for ~40 days (since March 29, 2026), and an attacker who had spent the previous 57 days quietly building a position of 2,672 sUSDp (~99% of the Ethereum supply), split across two independently funded addresses:
- 0xfa8ba3b8ee8691847fbbc9532116ba3f21278b49 (372 sUSDp)
- 0xb6747DF4D24338fD8e1C2b366D23825B35ADc4F3 (2,300 sUSDp)

These two positions were funded from sources not directly linked on-chain to the attacker's operating address, which is the address used to deploy the exploit contracts and submit the attack transactions: 0x6375c37761a26fac9b201af9f527caa9627aea11

Estimated impact. Based on our auditors' analysis of the attack transaction, had the exploit succeeded, the attacker would have ended up with over 1.52M USDp. The mechanism would have unfolded as follows:
1. The attacker contract first transfers the sUSDp shares from the two preparation wallets, giving it 99.88% of the vault's totalSupply.
2. The contract then deposits 223.83M USDp into the savings vault.
3. The dormant fixed-rate interest accrual on the inflated balance mints an additional 1.525M USDp into the vault, bringing total assets to 225.355M USDp.
4. The contract redeems its 99.88% share, walking away with approximately 1.52M USDp.

Forensic timeline (UTC):
- A few hours before the attack: the attacker created a Safe (https://t.co/mudd1LXwuq). We are not certain of the intent, but our working hypothesis is that this was an attempt to disguise the on-chain pattern from monitoring systems such as Hypernative.
- 19:50:47: The attacker initiated his first attempt by deploying an exploit contract (https://t.co/v3932U5aoK). The attack transaction was submitted shortly thereafter and reverted on-chain. Based on our current analysis (still being confirmed), the revert was caused either by insufficient gas to cover the LayerZero fee for the bridge leg of the exploit, or by attempting to bridge an amount exceeding our daily cross-chain limit (2.5M USDp). Either way, the exploit did not execute.
- ~30 to 45 seconds later: @HypernativeLabs' live monitoring detected the pattern, and the relevant contracts were paused within a few blocks of the failed transaction.
- 20:52:23: The attacker deployed a second exploit contract (https://t.co/NN3Fwa5krh) and submitted a second attack transaction. This one reverted because the contracts were already paused.
- After the second failure: the attacker forwarded his remaining ETH through several intermediary wallets in sequence before sending it to what we believe to be a KuCoin address (https://t.co/kJB95cSYEo). This appears to be another attempt to obscure the trail.

Why the attack failed: defense in depth. The attempt was stopped by three independent layers, any one of which would have been sufficient on its own.
1. The attacker's own attack transaction failed on-chain. Based on our preliminary analysis (still being confirmed), the failure was caused either by insufficient gas for the LayerZero fee, or by hitting the 2.5M USDp daily cross-chain bridge limit. The exploit therefore never executed.
2. @HypernativeLabs' live monitoring detected the pattern shortly after, and the relevant contracts were paused within a few blocks (~30 to 45 seconds) of the failed transaction. By the time the attacker re-attempted at 20:52:23 UTC, the contracts were already paused.
3. Bridge finality would have trapped the funds. Even in the counterfactual where the first transaction had succeeded and the bridge had been triggered, LayerZero finality from Ethereum to Base takes ~4 minutes. The pause of lz-USDp (within ~30 to 45 seconds) would have caught the in-flight bridge message well before delivery on Base, and the exploited USDp would have been frozen in the bridge.

In other words, the attacker needed his transaction to land, the contracts to stay live for the next 4+ minutes, and the bridge to deliver. All three failed.

Status of the attacker's position. With sUSDp paused, the attacker's 2,672 sUSDp are frozen. He cannot redeem, transfer, or otherwise access these funds. The address at the end of the on-chain trail, which we believe to be a KuCoin address, is subject to KYC, so the attacker is potentially identifiable.

Why this is bounded. The same conditions that made sUSDp on Ethereum exploitable (small supply, multi-week inactivity, adversary holding ~all of it) do not currently exist on our other deployments: Base, HyperEVM, and Avalanche. The attack vector requires both a supply concentration and a dormancy window that are easy to monitor and prevent.

Current status:
- No funds were lost
- User funds are safe
- USDp remains transferable
- The Savings Module (sUSDp) remains paused
- The Bridging Module (lz-USDp) and Parallelizer Module remain paused for now as a precaution

Based on the auditors' recommendations, the Bridging Module and Parallelizer Module will be unpaused once the DAO multisig signers tighten the bridging, minting, and burning limits.

The Savings Module will remain paused until the vault accounting patch is finalized and audited. As an immediate operational measure, on the auditors' recommendation we have already issued a setRate() call across all four deployments (Ethereum, Base, HyperEVM, Avalanche) to reset the accrual state and clear any accumulated dormant lump. Two independent audits will be performed on the patched contracts, by @bailsecurity and @cyfrin, before redeployment. The module will only resume once we and our partners are fully confident the vector is closed.

This is exactly why we operate with multiple layers of security: audits, bug bounty, live monitoring, emergency pause procedures, backup domains, and additional operational safeguards. Today, every layer was tested and held.

A full post-mortem will follow in the coming days with the complete technical write-up, timeline, remediation steps, and next actions.