Kit

I find bugs: Immunefi All-Time Top 30

[Kit @riproprip]

Solana fixed the bug long ago ...

The tech side went perfect:
- It was easy to get in touch
- 1 day to acknowledge the bug
- 3 days to fix in prod

Not so great:
- 5 weeks to get a payout number
- 12 months lockup
- no props

Overall: 7.5/10. I did disclose with them again.

[Kit @riproprip]

Here goes nothing. Witness me fellow bountyhunt3rz :)

[Kit @riproprip]

Hashes for the Hashgod.
Bounties for the brave.
Fate pending.

abcee4e2538c0cf76475b5e8b7c24963ce5ffdc18e88c123fa0f3aefe6e1620f

[Kit @riproprip]

If you want to try and discover the bug yourself, check out the following and focus on the zk-ops: https://t.co/asO7v7TNz2

If you want to check my report:
https://t.co/kHZkJvibbW

[Kit @riproprip]

Solana fixed the bug long ago ...

The tech side went perfect:
- It was easy to get in touch
- 1 day to acknowledge the bug
- 3 days to fix in prod

Not so great:
- 5 weeks to get a payout number
- 12 months lockup
- no props

Overall: 7.5/10. I did disclose with them again.

[Kit @riproprip]

Here goes nothing. Witness me fellow bountyhunt3rz :)

[Kit @riproprip]

@WhiteHatMage Since you were being reasonable I had no choice but to follow …

[Kit @riproprip]

How do we get “trillion dollar security”?

[Ethereum Foundation @ethereumfndn]

During Devconnect Buenos Aires, the Ethereum Foundation and @TheSecureum TrustX brought together Ethereum security practitioners for Trillion Dollar Security Day.

Here are the top takeaways from the event.
https://t.co/Q1vUKulW7E

[Kit @riproprip]

@WhiteHatMage Yes. Fun fact: Certain europoors get even less 😂

[Kit @riproprip]

@0xriptide @AngleProtocol Congratz on finding a bug!
Also: I am sorry for your loss.

Weird how they still advertise a bbp on their homepage ...

[Kit @riproprip]

@pldespaigne @immunefi This is awesome! Maybe also let us sort by that value?

[Kit @riproprip]

@lonelysloth_sec @bytes032 Re the undercutting/not paying:

Still think preventing this is the main feature hunters should care about when selecting a bbp platform. Whomever solves this wins.

[Kit @riproprip]

@lonelysloth_sec @bytes032 Agree: Alignment does not come for free!

My claim is that bughunters are aligned with projects when they report. By starting a bbp a project gains an advantage.

Keeping the advantage is another matter … but it’s hard to value what you don’t get. Hence me blabbing about it.

[Kit @riproprip]

@bytes032 @GchTrivs Summoning @elyx0.

[Kit @riproprip]

@bytes032 @r0bre Imho the relationship between reputational damage and auditor income is not very direct.

There is also a difference between being positively aligned by default vs being negatively aligned by choice:

Why not team up with everybody vs picking just a few to maybe suffer with?

[Kit @riproprip]

@bytes032 We only get paid if and when we find a live actionable bug. Sometimes not even then.

The input to payment relationship between projects and other security providers is a bit more lossy imho.

[Kit @riproprip]

Love the attitude.

Haters will say it’s because there will be a lot of bugs.

But I genuinely think this attitude is what is gonna make Sol win.

[Dean 利迪恩 (⚛️,🐱) | sbpf/acc @deanmlittle]

why are all the cracked devs writing assembly? 2025 is the year 100% independent community-led open source tooling will make it a first class citizen amongst many other extremely well-resourced languages that will never be able to match its performance. never fade @solana_devs 🫡

[Kit @riproprip]

@WhiteHatMage Not wise. You and others helped me!

Thanks for opening my eyes to my unusual bug hunting history.

Before chatting with you I just assumed everybody would deliver like @raydiumprotocol. Turns out they are what every bughunter should hope for. Absolute professionals.

[Kit @riproprip]

Here goes nothing. Witness me fellow bountyhunt3rz :)

[Kit @riproprip]

5 weeks and 4 days to get a payout number.

Meanwhile I had to do the trustfall and submit another POC to the same project .

NGL to you. The wait wasn't easy.
But hey: All is well that ends well.

Thx to everyone that kept me from going insane due to heisenbergian payout angst!

[Kit @riproprip]

@LanceAddison17 @PatrickAlphaC Why am I rambling on this while the ecosystem at large has provided plenty for me?

1) Stayed too long in the sun

2) I worry that “assuming the people smart enough to find the bugs are also wise enough to choose cooperation” is not a sufficient survival strategy.

I’m out. GL+HF

[Kit @riproprip]

@LanceAddison17 @PatrickAlphaC … the perfect last response that will finally convince them to kill the bug.

I have no idea why I am doing this other than that my brain is irked by knowing that vuln is still live.

Pretty sure I won’t get paid even if they fix due to [redacted, maybe ok reasons].