Manish | Smart Contract Security

Smart Contract Security Researcher

Learning Solidity, Foundry, and Protocol Auditing.

Sharing audit notes and protocol research.

[Manish | Smart Contract Security @royysd]

@kalyan__tr Thanks bro , i tried messaging you, but X says I can't send you a DM , could you DM me when you get a chance?

[chrisdior @chrisdior777]

💰🚨 $1.4M from Web3 bug bounties in 2026!

Meet @0xvivekd and learn about his journey, mindset, AI workflow, and the lessons he's learned along the way.

Part 1: The Journey

- Vivek didn't come from a software engineering background.

- He was a Chartered Accountant (licensed financial and tax professional) running his own firm.

- In 2021, a friend who traded crypto came to him for help filing taxes. That's how he got introduced to crypto and started investing, mainly participating in IDOs (Initial DEX Offerings).

- When the bear market arrived, he didn't leave the industry. He pivoted into data analysis.

- Then in 2023, as the market became active again, he started airdrop farming.

- In June 2024, he entered Web3 security through public audit contests.

- The next 15 months were difficult.

- He kept participating in contests but struggled to achieve consistent results.

- Around August/September 2025, he made a decision that completely changed his career.

- He switched from public audit contests to bug bounties.

Today, he has earned over $1.3M in bug bounties in 2026 alone, including another $250,000 critical bounty announced yesterday.

Part 2: The Mindset

- "Bug bounties are not difficult in the technical sense. They are difficult from a psychological point of view."

- He explained what led him to leave audit contests:

- During a White Hat Mastermind, everyone was asked what they were working on.

- Around half of the researchers were working on the contest with the smallest scope and the lowest payout.

- Vivek realized he was always choosing the easiest targets because they offered the fastest and most predictable payouts.

- Bug bounties were different. There was no guarantee of finding anything. No guaranteed payout. Sometimes weeks of work could lead to nothing.

- That was exactly why he switched.

- As he put it:
"Bug bounty hunters are paid handsomely for dealing with uncertainty."

Part 3: AI

- AI has completely changed Vivek's workflow.

- Today, he gives AI a target while he spends that same time building a high-level understanding of the protocol.

- Once AI surfaces potential issues, he validates them, removes false positives, and determines whether they're actually valid vulnerabilities.

- His estimate surprised me.
Today, around 70-80% of the issues are initially surfaced by AI.

- But he doesn't believe AI will replace security researchers. His reasoning is simple.

- AI is excellent at spotting unusual behavior. It still struggles to understand intended behavior. That's why human validation remains essential.

- He also believes the learning process has changed.

- Reading audit reports and recent hacks is still fundamental, but today researchers should also follow AI developments and continuously experiment with AI tools.

Part 4: Advice

- According to Vivek, DISCIPLINE is what separates the best researchers from everyone else.

- His advice was straightforward:
Don't expect meaningful results during your first 12 months. Focus on the inputs, not the outputs. Don't compare yourself to researchers who have been building their skills for years. Stay disciplined. Don't chase shiny objects. Keep adapting as the industry evolves.

- One detail I really liked was how he dealt with difficult periods.

- Whenever he went through a dry spell, he listened to podcasts from other top white hats.

- Not because they never struggled. But because they did.

- It reminded him that even the best researchers experience periods without finding bugs.

Congratulations on the incredible journey! @0xvivekd. 👏

[0xSimao @0xSimao]

1/ How I use AI in smart contract audits (2026)

From 2023–2026, I entered 57 contests, reached top-3 30 times, won 21 and earned $627k in prizes.

109 highs + 156 mediums. 53 of them solos.
86 private audits.

This came from reading every line and building the mental model.

[0xasen @asen_sec]

We are SO back

Almost as if we have never left

Let's see who takes the win in these contests🫡

[Manish | Smart Contract Security @royysd]

Weekly Challenge Results:
AI found 5 candidates.
✅ 1 High
⚠️ 1 Low
❌ 3 Rejected
Lesson:
AI generates hypotheses. Tests generate evidence.
No finding survives without:
• Attack path
• State transition
• Impact
• PoC
#Web3Security #Foundry

[Tammy.eth @jvst_tammy]

someone with 6 months of experience just got paid $100,000 for a single bug bounty finding.
i'm at roughly that same point in my journey and haven't found anything yet.
no valid findings. no contest payouts. just months of studying, breaking things in practice environments, and slowly learning to read code the way an attacker would.
on the days it feels pointless, a post like that is the thing that resets the perspective.
because it proves the timeline isn't as long as it feels from inside the grind. 6 months is enough, if those months go into the right things. reading real code, not just tutorials. building the instinct, not just the knowledge.
i don't know when my first finding comes. but i know it's closer than it was yesterday.

[Manish | Smart Contract Security @royysd]

@Ziusz @immunefi Congratulations 🎉 bro

[Radcipher - Security Services @radcipher]

🏆 Audit Arena Week 19 results are inBig congrats to this week’s top performers:

🥇 @mibunna 17 pts
🥈 2nd place:
@SyedGhufranHas1 @zriym17 9.5 pts
🥉 3rd place:
@yun0hu @0xbube @mr_nob0dye @0xEzed 8.5 pts

4th place:
@devmukhtar @maFa_686 @254Oti_ 7 pts
5th place:
@acyutaharidas 5 pts
6th place:
@GeorgievWeb3_ @royysd 3.5 pts

Big congrats to everyone who took part this week.Keep pushing.
Keep learning.
Keep climbing.⚔️
See you in the next arena.

[Manish | Smart Contract Security @royysd]

Starting a new audit contest today.

Focusing on understanding the protocol, improving my testing skills, and learning as much as possible from the codebase.

Back to reading contracts.

[A3R4H4M @abrahamonchain]

The Reality of Becoming a Top 1% Security Researcher

Most people think it's about intelligence.

It's not.

It's about surviving years of confusion, rejection, self doubt, and failure long enough to become dangerous.

Here's what nobody tells you

Let's dive in

➪ The internet only shows the wins.

You see:

➣ Accepted bug bounties

➣ Audit reports

➣ Conference talks

➣ Hall of Fame achievements

➣ Research publications

You don't see:

➣ 100+ rejected findings

➣ Failed exploit attempts

➣ Weeks spent understanding one vulnerability

➣ Thousands of lines of code read for nothing

Success is visible.

The struggle isn't.

➪ Security research will make you feel stupid.

A lot.

You'll open a protocol and understand absolutely nothing.

You'll read a Solidity function 20 times.

You'll stare at an exploit writeup for hours.

And you'll wonder if everyone else is smarter than you.

They're not.

They've just been confused longer.

➪ One lesson I learned:

Feeling lost is not a sign you're failing.

It's usually a sign you're learning.

The best researchers aren't the ones who avoid confusion.

They're the ones who stay with it long enough for understanding to emerge.

➪ Nobody talks about the 3 AM reality.

The monitor glow.

The cold coffee.

The failed PoC.

The endless transaction traces.

The attack path that doesn't work.

Then doesn't work again.

Then finally works.

The world sees the report.

You experience the thousand failures before it.

➪ Security research is mostly being wrong repeatedly until you're finally right.

That's the job.

Not glamour.

Not recognition.

Investigation.

➪ Most people don't fail because they lack talent.

They fail because they quit too early.

The learning curve is brutal.

Progress feels invisible.

Validation is rare.

Rewards are delayed.

So people leave.

The few who stay become dangerous.

➪ Consistency beats talent more often than people want to admit.

Read code every day.

Study exploits every week.

Write research publicly.

Repeat.

Small efforts compound.

➪ The most underrated security skill isn't intelligence.

It's curiosity.

Elite researchers ask questions longer than everyone else.

Why is this here?

Why is this unchecked?

Why did this exploit work?

Why did nobody notice?

Curiosity uncovers vulnerabilities.

➪ Most vulnerabilities hide inside assumptions.

Attackers know this.

Researchers should too.

➪ Another uncomfortable truth:

Security research is mostly pattern recognition.

The best auditors don't magically spot bugs.

They've simply studied enough failures to recognize familiar attack surfaces.

Experience is pattern recognition in disguise.

➪ Want to improve faster?

Study:

➣ Historical hacks

➣ Audit reports

➣ Post mortems

➣ Exploit writeups

➣ Attacker behavior

Every exploit teaches a lesson.

Every lesson becomes intuition.

➪ Let's talk about the emotional cost.

Nobody warns you about this part.

Security can be lonely.

You miss events.

You skip outings.

You spend weekends reading code.

Sometimes you become obsessed.

And sometimes that obsession is exhausting.

➪ Then imposter syndrome arrives.

You compare yourself to famous auditors.

Respected researchers.

Top bug bounty hunters.

You feel behind.

Here's the truth:

Even experts feel this way.

They just keep moving anyway.

➪ Top 1% doesn't mean:

➣ Knowing everything

➣ Finding every bug

➣ Never making mistakes

➣ Being a genius

Top 1% means:

➣ Showing up consistently

➣ Learning relentlessly

➣ Staying curious

➣ Refusing to quit

➪ If I could give one piece of advice to aspiring blockchain security researchers:

Stop chasing shortcuts.

Read code.

Study exploits.

Think like attackers.

Build things.

Break things.

Write about what you learn.

Depth beats hype.

Every time.

➪ One day people will see your audit reports, findings, and achievements.

They'll assume you were naturally gifted.

They won't see:

➣ The confusion

➣ The failures

➣ The rejected reports

➣ The late nights

➣ The moments you almost quit

But that's the reality of becoming a top 1% security researcher.

Not brilliance.

Persistence.

➪ The researchers who change the industry are rarely the smartest people in the room.

They're the ones who refused to leave the room.

If you're building a career in Smart Contract Security, Blockchain Security, or Web3 Security:

Keep going.

Your future expertise is being built in today's confusion.

Repost if you're on the journey.

[Manish | Smart Contract Security @royysd]

Got my first valid high severity bug on CodeHawks First Flight

Huge thanks to the Cyfrin team ❤️

Still learning, improving, and continuing.

#SmartContractSecurity #Web3Security #CodeHawks #Cyfrin #Audit

[Manish | Smart Contract Security @royysd]

@xKeywordx Congratulations 🎉 🎉

[Manish | Smart Contract Security @royysd]

@arsen_bt Defendor

[Manish | Smart Contract Security @royysd]

@arsen_bt Security