pks_

Web3 SR, always make mistakes. @immunefi All Star.

[raph @raphjaph]

Critical vulnerability in the bip322 Rust crate: BIP-322 proofs for P2WPKH and
P2SH-P2WPKH addresses could be forged with any attacker key. Full
address-ownership bypass. Fixed in 0.0.11, affected versions yanked. If you
verify Bitcoin address ownership, please upgrade now.

[barthazian.eth 巴特 @Barthazian]

zhipu absolutley nailing pursuing the element that played in oss models favour from the HF incident

masterclass in adpating goals and roadmaps to informatin as they come.

anthro and oai neuter you cause they believe humans are more bad than good and they need to control every outcome. kimi and zhipu are there to serve you cause they beleive the future is built toghther in the open and no one person or group can pursue that.

individualism and collectivism battling it out on the grand stage

[Vid Repar @vidrepar]

Friday I said 10 retweets and I ship it by Monday, and you delivered.

Duplicate detection is live in Studio. It checks the program's history for overlap before you submit.

Retweeters get first access. Ping me.

[pks_ @pks_eth]

@vidrepar studio

[Sipan V'artagnan ⚖️⚡️ @Hexen1337]

@Mudit__Gupta @hexens Btw, we wrote a kick-ass article about the vulnerability. A very interesting read:

https://t.co/NpCzUDd0A1

[Josselin Feist @Montyly]

Tough day for many security researchers. It is worth remembering that a lot of teams are still hiring:

- Senior Cyber Security Engineer at @aave (come work with me ;) ): https://t.co/JlvpRYffUN

- Information Security Engineer, Product, at @AptosLabs: https://t.co/Oit4gCEx1U

- Lead Security Engineer at @babylonlabs_io: https://t.co/skrqDvykn2

- Blockchain Security Engineer, Smart Contract Auditing, at @binance: https://t.co/v3Bw0z65MS

- Security Engineer, Product Security, at @chainlink: https://t.co/P9SpYIrAqV

- Security Engineering Lead at @EspressoSys: https://t.co/Z5VoHBOn8a

- Senior Infrastructure Security Engineer at @the_matter_labs : https://t.co/iU4yLkympv

- Senior Protocol Engineer (Verification) at @Morpho: https://t.co/YLTYgT8IlK

- Senior Security Engineer, Offensive, at @Offchain: https://t.co/WQw91mrqYn

- Senior Application Security Engineer at @0xPolygon: https://t.co/cMnijxFJEU

- Security Engineer at @tempo: https://t.co/IV44HtM0vN

- Onchain security engineer at @Wonderland : https://t.co/b6PtkkVz9s

And these audits firms are also hiring:

- @asymmetric_re, Security Engineer: https://t.co/XZP7vaaPBq

- @chain_security, Blockchain Security Engineer: https://t.co/gM8Gye0wLg

- @guardianaudits, multiple roles: https://t.co/ATqHAE81Qc

- @osec_io , Security researcher: https://t.co/fE5nTwnpqc

- @PashovAuditGrp, Security Researcher: https://t.co/C9J3OvZncN

- @Nethermind, Smart Contract Auditor, https://t.co/IkpQdID8E8

- @zellic_io, Security Researcher: https://t.co/ud7gtYC19g

[pks_ @pks_eth]

@0xTimofey @immunefi @MitchellAmador Thanks for everything you did ser, best luck to your next chapter🫡

[pks_ @pks_eth]

@Afriauditor @immunefi yup

[pks_ @pks_eth]

I just found a bug and got paid on @immunefi #immunefitribe https://t.co/vLZppWkAml

[Massimo @Rainmaker1973]

Solarpunk is a movement that imagines a sustainable and optimistic future where humanity thrives in harmony with nature.

[asymmetric research @asymmetric_re]

Today we're launching Crucible, a coverage-guided fuzzing framework for Solana programs. Built for Anchor, with v2 support from day one.

Just one example of what Crucible can find: a years-old bug in Solana's stake program, surfaced in seconds ↓

[OtterSec @osec_io]

We found a critical soundness bug in dusk-plonk that let a malicious prover forge proofs for arbitrary false statements.

The result: an attacker could mint arbitrary amounts of DUSK out of thin air and bypass every check protecting Dusk's shielded transactions.

[asymmetric research @asymmetric_re]

On Solana, events are often reconstructed from transaction traces, and failed transactions still emit data.

@Dooflin5 details a bug in Across that could have allowed attackers to spoof deposit events and trick relayers into filling orders with no real deposit behind them.

[antirez @antirez]

During the last week I executed very long autonomous sessions of Claude Code Opus 4.6 and Codex GPT 5.4 (both at max thinking budget), in cloned directories (refreshed every time one was behind). I burned a lot of (flat rate, my OSS free account + my PRO account) of tokens...

[Saw-mon & Natalie @sw0nt]

Interesting parts of this research

🌕 the appendix of the paper
🌗 GitHub repo
🌑 the undisclosed quantum algorithm

🔗 https://t.co/RfIJaTfD42

[hexens @hexens]

Cross-chain bridges remain critical infrastructure, proof verification is the core of their security model.

New disclosure on our research page: a vulnerability in the Polygon Plasma bridge that allowed transaction proofs to be forged.

At the time of discovery, $800M in POL was at risk, exploitable in a single transaction with no prerequisites.

The research covers how the proof verification breaks, how the exploit was built, and what it means for bridge security.

Full technical deep-dive: https://t.co/Zigi7VwNes

[Fede’s intern 🥊 @fede_intern]

If @ethereum continues with this nonsense of zkVM vibecoded we're gonna end with the L1 fully hacked.

We all make mistakes and I'm sure we will get hacked too. The difference is that we try to avoid it. Some irresponsible people have been proposing to vibecode cryptography like it has no cost.

[deebeez @deeberiroz]

This hacker is on a roll

6 hacks in 1 month

55 eth total earned

[f4lc0n @al_f4lc0n]

I Saved Injective's $500M. They Pay Me $50K.

I like hunting bugs on @immunefi . I'm decent at it.

- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)

Life was good. Then I found a Critical vulnerability in @injective .

This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.

I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.

Then — silence. For 3 months. No follow up. No technical discussion. Nothing.

A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.

I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.

I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.

Full Technical Report: https://t.co/lki2tL9bxw

[tintinweb @nicht_tintin]

Let's give pi-coding-agent a heartbeat 🤖♥️

Add Memory + Messenger + Skill Discovery 🦞. Make it autonomous. #OpenClaw-level chaos included 🙂🔥

https://t.co/7AnkOUql87
#AI #DevTools #pi