Vaibhav | v1c7

let's break everything |

[André Baptista @0xacb]

If your hacking method looks like everyone else’s, so will your findings. My advice is to get weird.

Bug bounty wins come from being different. Everyone checks the basics. You need to hunt the edges, the overlooked, the strange. Go past the checklist, and you'll land what others miss.

[Vaibhav | v1c7 @vaib25vicky]

Won 1st position in neutrl protocol contest 🏆

Coverage was 100% and I’m happy with the results

Now onto the next contest 🫡

[pashov @pashov]

Even if you are the best auditor, you can still miss bugs

Even if a project got 25 audits, it can still be vulnerable

Even if everything is perfect today, a chain/compilator/infra upgrade can be the reason for an exploit

Web3 security is HARD

[0xCharlesDCheerful @carlos__alegre]

Should you get into web3 security? The real nature of the job. A little reflection on a Saturday afternoon.

Software security, specially the current state of smart contracts' security, is a weird chimera of a philosophical and technical job.

Even in the future of the industry, where manual reviews will likely be decreased thanks to automation. You will still need the analysis, the paranoia mindset. The development of thoughts.

I'm a security researcher because I like protecting code, yet, the ultimate reason of why I like that is because I love developing thoughts, not software.

In fact, I hate developing software. But designing software, I love it. Because it involves the same creativity and pure development of thoughts process.

Security researchers' nature is not that much the one of builders, more the one of philosophers.

What I love is thinking, imagining, analyzing, reaching conclusions. And that is what security research is all about. I meant it has the word research on the name. xd

I always wondered, if I hate software development so much, why didn't I hate designing it or attacking it? Turns out it is because I love thinking.

Software architecture roles are often left for senior software engineers. Security seemed the only branch I accidentally found that promotes pure development of thoughts without requiring you to be a junior developer for years.

To be honest, I would be a parachuting instructor if the security research branch did not exist.

Now I understand better why I enjoy my job. I hope it granted you some insight.

Have a nice day! :)

[Vaibhav | v1c7 @vaib25vicky]

@carlos__alegre Beautifully put💯

[Vaibhav | v1c7 @vaib25vicky]

@shealtielanzz 💯
most of my creative bugs are from shower thoughts 😂

[Vaibhav | v1c7 @vaib25vicky]

@0xGondarxyz 💯

[Vaibhav | v1c7 @vaib25vicky]

@0xfrsmln True 💯
If the issue is severe enough and impacts admin functionality, it should be considered valid in contests

[Vaibhav | v1c7 @vaib25vicky]

Great advice 🔥
Focus on fundamentals and attacker mindset

[Dacian @DevDacian]

I don't think this is correct; eg recently I audited an on-chain game. It was very unique, nothing quite like it so no basis for comparison. Yet in 6 days I produced a stacked report with 3 Crit, 5 High, 9 Medium & 7 Low.

In your view where you have to first understand a similar protocol, this wouldn't be possible since there is no similar protocol.

The key is mastering the fundamentals; learning attacker mindset, heuristics, thinking in invariants etc. Then you can find vulns in anything, even totally new things.

That being said if you are auditing your 10th Dex/Perpetuals/Lending/Borrowing protocol etc then yes ofcourse it helps that you've audited 9 previous versions of the same core thing.

But you shouldn't rely on this crutch or think this is the only way, cause then you'll be like a fish out of water when having to audit something totally new.

[Vaibhav | v1c7 @vaib25vicky]

@0x15_eth Lol 😂

[Vaibhav | v1c7 @vaib25vicky]

Reading a top security firm's audit report and most bugs in it? Wouldn't even count in a contest! 😕

[Vaibhav | v1c7 @vaib25vicky]

@Pelz_Dev @GluexProtocol Great work 🔥

[Vaibhav | v1c7 @vaib25vicky]

@0xfrsmln Frying my mind with symbiotic 😅 what about you?

[Vaibhav | v1c7 @vaib25vicky]

@InfectedCrypto @eigencloud @cantinaxyz Great work 🔥

[zokyo @zokyo_io]

1) Unsafe Type Casting in Solidity

One of the most overlooked pitfalls in smart contracts.

Casting between data types without proper checks can silently break logic, overflow values, and open the door to exploits.

Here’s what every dev and auditor should know 👇

[SHERLOCK @sherlockdefi]

🚨 Picture this: a labyrinth of code, a ticking clock, and 100,000 USDC in rewards dangling just in reach.

@symbioticfi's contest will launch on Thursday, June 19th at 15:00 UTC.

Will you unravel the mystery and claim victory, or watch others bask in glory?

[Vaibhav | v1c7 @vaib25vicky]

@AkshayBabhulkar I’m interested

[7h3h4ckv157 @7h3h4ckv157]

Started hacking…?

Remember: NeverGiveUp

[ₕₐₘₚₜₒₙ @hamptonism]

Become obsessed with working hard.

The rest will fall into place.

[Vaibhav | v1c7 @vaib25vicky]

@InfectedCrypto Agreed!! I only use claude 3.7 as I feel its more accurate then others and also dont hallucinate like chatgpt 😂