Solana fixed the bug long ago ...
The tech side went perfect:
- It was easy to get in touch
- 1 day to acknowledge the bug
- 3 days to fix in prod
Not so great:
- 5 weeks to get a payout number
- 12 months lockup
- no props
Overall: 7.5/10. I did disclose with them again.
If you want to try and discover the bug yourself, check out the following and focus on the zk-ops: https://t.co/asO7v7TNz2
If you want to check my report:
https://t.co/kHZkJvibbW
Solana fixed the bug long ago ...
The tech side went perfect:
- It was easy to get in touch
- 1 day to acknowledge the bug
- 3 days to fix in prod
Not so great:
- 5 weeks to get a payout number
- 12 months lockup
- no props
Overall: 7.5/10. I did disclose with them again.
During Devconnect Buenos Aires, the Ethereum Foundation and @TheSecureum TrustX brought together Ethereum security practitioners for Trillion Dollar Security Day.
Here are the top takeaways from the event.
https://t.co/Q1vUKulW7E
@lonelysloth_sec@bytes032 Re the undercutting/not paying:
Still think preventing this is the main feature hunters should care about when selecting a bbp platform. Whomever solves this wins.
@lonelysloth_sec@bytes032 Agree: Alignment does not come for free!
My claim is that bughunters are aligned with projects when they report. By starting a bbp a project gains an advantage.
Keeping the advantage is another matter … but it’s hard to value what you don’t get. Hence me blabbing about it.
@bytes032@r0bre Imho the relationship between reputational damage and auditor income is not very direct.
There is also a difference between being positively aligned by default vs being negatively aligned by choice:
Why not team up with everybody vs picking just a few to maybe suffer with?
@bytes032 We only get paid if and when we find a live actionable bug. Sometimes not even then.
The input to payment relationship between projects and other security providers is a bit more lossy imho.
why are all the cracked devs writing assembly? 2025 is the year 100% independent community-led open source tooling will make it a first class citizen amongst many other extremely well-resourced languages that will never be able to match its performance. never fade @solana_devs 🫡
@WhiteHatMage Not wise. You and others helped me!
Thanks for opening my eyes to my unusual bug hunting history.
Before chatting with you I just assumed everybody would deliver like @raydiumprotocol. Turns out they are what every bughunter should hope for. Absolute professionals.
5 weeks and 4 days to get a payout number.
Meanwhile I had to do the trustfall and submit another POC to the same project .
NGL to you. The wait wasn't easy.
But hey: All is well that ends well.
Thx to everyone that kept me from going insane due to heisenbergian payout angst!
@LanceAddison17@PatrickAlphaC Why am I rambling on this while the ecosystem at large has provided plenty for me?
1) Stayed too long in the sun
2) I worry that “assuming the people smart enough to find the bugs are also wise enough to choose cooperation” is not a sufficient survival strategy.
I’m out. GL+HF
@LanceAddison17@PatrickAlphaC … the perfect last response that will finally convince them to kill the bug.
I have no idea why I am doing this other than that my brain is irked by knowing that vuln is still live.
Pretty sure I won’t get paid even if they fix due to [redacted, maybe ok reasons].