Ouicate

Security enthusiast. I play chess, not checkers.

I build, I break, then I write up the lessons.

[WhiteHatMage @WhiteHatMage]

If you're interested in catching chain halts, here are some ideas:

Consensus critical paths:
- Check consensus invariants and how to break them -> halt
- Check functions that should always succeed, but you find a way to make them fail or revert for everyone every time -> halt
- Check functions that should always return a response (success or failure), but you can make them panic -- unexpected side effect or missing recovery mechanism.
- Look for possible sources of non-determinism -- may lead to chain halt or fork

Risk profiles:
- Halt the production of blocks
- Halt the production of proposals
- Halt the processing of transactions
- Halt the p2p communications
- Halt the processing of txs
- Crash validators consistently
- Crash critical dependencies consistently

Attack Surface:
- Trace back the critical paths, and the components that could be broken
- It may be a malicious transaction by any user, or a malicious p2p message relayed to the nodes
- It could be a rogue validator with a malicious proposal
- The chain might read events from contracts. It could have a light client checking things happening on other chains.
- It could be time based, or something that happens on specific blocks, or during some special event.
- There might be issues in dependencies that aren't critical anywhere else, but they lead to a more severe impact in some specific flow
- The chain could have special roles that could be vulnerable to specific attacks

Resource exhaustion:
- CPU: make validators spend too much time computing transactions or blocks -- they won't make it in time for agreeing on the block
- Memory: crash validators with OOM errors
- Storage: bloat the disk space
- Invariants: bloat some resource invariant, like consistently surpassing the block size, or tx size, making proposals fail.

Caveats:
- Most bugs aren't vulnerabilities. Learn how to code an e2e PoC for a network.
- Not every panic leads to a crash. They're often gracefully caught.
- Not every crash leads to a chain halt. You may crash the RPC node, but not the validators
- A chain might have different clients, and the overall impact may not lead to a chain halt
- Permissionless attacks are more dangerous than ones that require a validator
- Panics in transactions are usually caught by the execution layer
- If the impact is that your tx reverts, there's no impact. If the impact is that your proposed block is rejected, there's no impact.
- Chains have different consensus mechanisms and caveats. The same vulnerability won't necessarily lead to the same impact.

There's a huge overlap with other impacts. The same core vulnerability could be exploited for a chain halt, or could be used to take down validators to gain consensus, or could be abused to lead to a chain fork, or other issues. It's also possible that it doesn't lead to any real impact too.

It's up to you to assess the most critical impact.

[Ouicate @ouicate]

@TammyBuilds the jump from "no findings" to "first finding" feels impossible right up until it isn't. one thing that helped me: stop hunting for "a bug" and start hunting for one specific assumption the devs made and never checked. narrows everything down. you're closer than it feels.

[Ouicate @ouicate]

Bug bounty inboxes are drowning in AI-generated "criticals" right now — a few programs have shut down over it.

My standard: reproducible PoC, honest severity, respect the embargo. Signal, not noise.

The kind of report a team is relieved to get. 🐈‍⬛

[Ouicate @ouicate]

@WhiteHatMage @lonelysloth_sec bro was running GPT-9 in '23, im starting to think @lonelysloth_sec is the AGI they keep warning us about😅

[Ouicate @ouicate]

@lonelysloth_sec Found with Fable 5?

[Ouicate @ouicate]

@lonelysloth_sec This maps onto security right now. The reliable LLM win isn't "find the 0day" — it's triaging and deduping reports so humans only see signal. Programs are drowning because everyone chased the sexy version. Where's your line between "reliably outsource" and "needs a human"?

[Ouicate @ouicate]

Bug bounty inboxes are drowning in AI-generated "criticals" right now — a few programs have shut down over it.

My standard: reproducible PoC, honest severity, respect the embargo. Signal, not noise.

The kind of report a team is relieved to get. 🐈‍⬛

[Ouicate @ouicate]

@dethSCA Best bugs aren't "this code is wrong" — they're "this code is correct, given an assumption that isn't."

Consensus is full of them: "the order here doesn't matter" is true in one process and a chain halt across validators.

[Ouicate @ouicate]

7/ The fix is almost insulting: sort the keys before use. One line.
But the lesson isn't the fix — it's the mindset. In a consensus system, a "cosmetic" ordering detail is a critical liveness bug. Determinism is the attack surface.
More breakdowns coming. Follow. 🐈‍⬛

[Ouicate @ouicate]

1/ How a single unsorted list can halt an entire blockchain 🧵 🐈‍⬛

No crash. No exploit payload. No memory corruption — just two validators that quietly disagree on the order of some bytes, and the whole network stops finalizing.

(Generalized from a bug I reported privately.)

[Ouicate @ouicate]

6/ How I hunt this class:

1. Find every map you range over
2. Trace whether its output reaches state, a hash, or serialized bytes
3. Look for a sort before that point — if it's missing, flag it
4. Map ALL sources of non-determinism: maps, time, rand, floats, error strings