t0x1388

[t0x1388 @t0x1388]

@Al_Qa_qa one more reason to go grey

[m4rio @m4rio_eth]

In the era of AI-powered triage, paying more than $10–$20 just to report a bug is EV-negative for both sides.

I've been in this industry for years, on both sides of the table.

If processing a report costs you more than $20, that's a triage problem. Passing that cost on to researchers just rigs the process against them.

This was an issue when we first started the AI slop submissions, now it's not about that anymore, fix your triaging bots and ease your process for to the defending side!

I can't believe i have to write this, tbh, lol!

[t0x1388 @t0x1388]

@m4rio_eth well said!

[OtterSec @osec_io]

In 2026, no program is closed source.

We decompiled a propAMM into Rust that recompiles to the exact on-chain binary, then used it to find a critical bug that put $6.1M at risk.

[ControlZ @ControlZ_1337]

And here I am, having reported vulnerabilities throughout my career that could have resulted in a total of several billions (yes, with a B, > $2B) being *stolen*, while my total earnings are around $2M.

So what's the lesson the industry is teaching researchers?

That next time we should steal the funds first, then negotiate a "responsible disclosure," return 80–90%, and walk away with 10–20%?

Obviously, no. But it's insane that the incentives can make that rhetorical question even possible.

The bounty world is broken.

Blackhats exploit a protocol and get treated like kings in negotiations. Meanwhile, whitehats disclose the exact same kind of vulnerability privately, prevent any damage from happening, and then spend months arguing with projects that try to downgrade the finding and pay the bare minimum.

I'm fighting several cases like this right now. Millions of dollars protected, vulnerabilities responsibly disclosed, and yet projects still don't want to pay the amounts they themselves advertised.

We should be making responsible disclosure the overwhelmingly obvious choice.

Instead, the current state of Web3 is doing its absolute best to discourage whitehats while creating increasingly attractive incentives for blackhats and "grayhats".

Those incentives are backwards, and eventually the ecosystem pays the price.

[t0x1388 @t0x1388]

@IronsideSec hit 560 submissions and SR could host their own contest :)

[TrustSec @TrustSecAudits]

Disclosing a critical theft of funds exploit we identified and disclosed to @AlchemixFi in June!

Their ETH MYT vault integrated unsafely with Tokemak strategy - we chained several primitives to trigger loss of $3M within a consecutive 1-min attack. 🧵

[t0x1388 @t0x1388]

There will be always bugs.

Found a High a year ago, and found another High today in the same codebase.

[WhiteHatMage @WhiteHatMage]

The only real cybersecurity problem is misaligned incentives. You set up a competition where the prizes are:

- Hundreds of millions of dollars for blackhats
- A personalized mug for whitehats

Guess who finds the exploit first.

[t0x1388 @t0x1388]

hey, Is someone building a zk tool for privacy mixers that lets legitimate users prove they aren't part of an exploit on the sender side?

[t0x1388 @t0x1388]

@vidrepar Mr. @lonelysloth_sec

[t0x1388 @t0x1388]

0xfa0760ee09071098664d7757c1c5ffaacac74f8d0211ccf37f7406ae82bfaff9

[t0x1388 @t0x1388]

so many hacks?? so what, just as many rescues🫡

[Immunefi @immunefi]

This Security Researcher just earned a $110k bounty.

congrats @_blockian

[Immunefi @immunefi]

This Security Researcher has earned $3,612,409 hunting bugs on Immunefi.

32+ live critical vulnerabilities found, saving hundreds of millions of dollars from hacks.

Meet @lonelysloth_sec, ranked Top 5 all-time on @Immunefi.

We asked him how he does it.

One practical bug bounty strategy that has helped him find better bugs: "Protocols share a lot of code. When you find a bug that isn't exploitable, take some times to check if the same bug doesn't show up in other protocols where it might be. Study families of protocols, compare their code. Things are getting more and more interconnected."

The habit, routine, or mindset that has made him more consistent as a researcher: "Curiosity. I don't rest until I understand every part of the system. Even if I end up not finding a bug, I want to understand it."

A memorable bug or win, and what helped him find it: "I have quite a few public disclosures, but for one project between '24 to '25 I got paid for 9 critical bugs. I spent months getting to know every last detail of their (very large) code base. More than a breakthrough it was about persistence in one target, learning everything about it, and using everything I knew on it. They weren't the highest paying bugs I found, but I'm very proud of that achievement. I still find bugs in that project."

His advice to a researcher trying to level up or land their first bounty: "Find motivation in the journey, because it's a long one. Enjoy understanding something that previously was mysterious to you, the feeling of knowledge accumulating. It compounds and will eventually lead to your bounties. Keep trying -- you need to give luck a chance to find you."

[QED Audit @QED_Audit]

Defenders will win when whitehats find and report vulnerabilities before attackers do. The industry is still adapting, but teams that adopt scalable security processes will be able to move at AI speed without sacrificing security. Hopefully, we're not too far away. (7/8)

[t0x1388 @t0x1388]

@0xaudron some worst programs out there, talking over x about how much they value security, but when it's time to validate, the response is nothing like you'd expect

[t0x1388 @t0x1388]

@ArxiaLayerOne @lilygo9 👀

[t0x1388 @t0x1388]

@lonelysloth_sec Merry chirstmas ser!

[t0x1388 @t0x1388]

@PatrickAlphaC smooth!