Zer0day Sec 🗡

Security Research: #Web3 #DeFi #DLTs #AppSec & more | Zero-day hunter-finder. #0dayHI | PGP: C06C 0972 E7F1 8889 C5B5 E0D9 6115 241C E57C C932

[Zer0day Sec 🗡 @Zer0day_sec]

Found a Critical zero-day in @cosmoslabs_io IBC Eureka a live bridge drain bug, threatening tens of billions of $$ in TVL. Missed by two world-class audits. Fixed within days of my report (public).

The bounty? Still hasn't come. Who knows if it ever will. But I realized something: the bounty was never the real win. The fix was: Users protected. Cosmos' 5-year exploit-free bridge record protected. That's a win, that was my primary goal.

I'm taking that WIN!

Diary of a Whitehat #DOAW - Entry 002 is finally here!

Full report: "A Win for Responsible Disclosure: How a Single Line of Code Stood Between Cosmos IBC Eureka and Catastrophic Bridge Drain"

This special report recognizes the positive roles of every stakeholder in this responsible disclosure win:
@Hacker0x01 for providing the enabling platform, @cosmoslabs_io for the amazing #bugbounty program, Cosmos Labs leadership @BPIV400 and @0xMagmar for the unwavering commitment to user and ecosystem security, and the #Web3security community at large.

Read full article on Zer0day Research: https://t.co/LH8i9oZP2Q and X Articles.

🎩🔍 #DOAW #ResponsibleDisclosure #Web3Security #Cosmos

[Zer0day Sec 🗡 @Zer0day_sec]

@jasonfried Quite impossible. Money is the exchange medium of value that businesses create.

[Zer0day Sec 🗡 @Zer0day_sec]

“Then you get access, and you realize it's all held together by duct tape and prayers.”
- Ian Carroll @iangcarroll

Factual 🫡

[Zer0day Sec 🗡 @Zer0day_sec]

@suresh2spacex @getvaultpass Thanks for this fantastic opportunity. And yes, count us in! We'd love to make our voluntary contribution.
#securityresearch #0dayHI.

[Zer0day Sec 🗡 @Zer0day_sec]

@suresh2spacex @getvaultpass Thanks for this fantastic opportunity. And yes, count us in! We'd love to make our voluntary contribution.
#securityresearch #0dayHI.

[Zer0day Sec 🗡 @Zer0day_sec]

The bug bounty ecosystem genuinely needs researchers who hold the process accountable without burning it down.

Accountability will safe the ecosystem from its own inherent threats.

- @Zer0day_sec

[Zer0day Sec 🗡 @Zer0day_sec]

At https://t.co/LH8i9oZP2Q, we operate on a contingency model because we are CONFIDENT in our ability to find all & what others miss. If our research finds zero critical or high-severity vulnerabilities, you pay $0. DM open.

We find zero-days even after you think all angles are covered. We challenge every project today: request a free audit, and we will show you.

#freeaudit #adversarial #0dayHI #bugbounty #web3security #web2security #appsec

[Zer0day Sec 🗡 @Zer0day_sec]

Irony.

[Zer0day Sec 🗡 @Zer0day_sec]

Sometimes you got to remind the triage team:

"Hey! We're on the same side. We're the good guys. Remember?"

Come on! Why the whole we-dont-negotiate-with-terr0r1st treatment? Hmm?

😃 #GoodGuys #WhiteHat #SecurityResearch #BugBounty

[Zer0day Sec 🗡 @Zer0day_sec]

It's not all about money.

[Zer0day Sec 🗡 @Zer0day_sec]

https://t.co/hcopsI0Hdh

[Zer0day Sec 🗡 @Zer0day_sec]

https://t.co/8KniNgYnLO

[Zer0day Sec 🗡 @Zer0day_sec]

I found a Critical zero-day in @cosmoslabs_io IBC Eureka. A live bridge drain bug, threatened tens of billions $ in TVL. Missed by two world-class audits. Fixed within days of my report (public).

The bounty? Still hasn't come. Who knows if it ever will. But I realized something: the bounty was never the real win. The fix was: Users protected. Cosmos' 5-year exploit-free bridge record protected. That's a win, that was my primary goal.

I'm taking that WIN!

Diary of a Whitehat #DOAW - Entry 002 is finally here!

Full report: "A Win for Responsible Disclosure: How a Single Line of Code Stood Between Cosmos IBC Eureka and Catastrophic Bridge Drain"

This special report recognizes the positive roles of every stakeholder in this responsible disclosure win: @Hacker0x01 for providing the enabling platform, @cosmoslabs_io for the amazing #bugbounty program, Cosmos Labs leadership @BPIV400 and @0xMagmar for the unwavering commitment to user and ecosystem security, and the #Web3security community at large.

Read full article on Zer0day Research: https://t.co/LH8i9oZP2Q and X Articles.

🎩🔍 #DOAW #ResponsibleDisclosure #Web3Security #Cosmos

[Zer0day Sec 🗡 @Zer0day_sec]

Found a Critical zero-day in @cosmoslabs_io IBC Eureka a live bridge drain bug, threatening tens of billions of $$ in TVL. Missed by two world-class audits. Fixed within days of my report (public).

The bounty? Still hasn't come. Who knows if it ever will. But I realized something: the bounty was never the real win. The fix was: Users protected. Cosmos' 5-year exploit-free bridge record protected. That's a win, that was my primary goal.

I'm taking that WIN!

Diary of a Whitehat #DOAW - Entry 002 is finally here!

Full report: "A Win for Responsible Disclosure: How a Single Line of Code Stood Between Cosmos IBC Eureka and Catastrophic Bridge Drain"

This special report recognizes the positive roles of every stakeholder in this responsible disclosure win:
@Hacker0x01 for providing the enabling platform, @cosmoslabs_io for the amazing #bugbounty program, Cosmos Labs leadership @BPIV400 and @0xMagmar for the unwavering commitment to user and ecosystem security, and the #Web3security community at large.

Read full article on Zer0day Research: https://t.co/LH8i9oZP2Q and X Articles.

🎩🔍 #DOAW #ResponsibleDisclosure #Web3Security #Cosmos

[Zer0day Sec 🗡 @Zer0day_sec]

"If you cannot control what's on the inside, you will not control what's on the outside"
- #WarMachine

[Zer0day Sec 🗡 @Zer0day_sec]

fa fa-bug-critical-o

#fontawesome 🫡

[Zer0day Sec 🗡 @Zer0day_sec]

At https://t.co/LH8i9oZP2Q, we operate on a contingency model because we are CONFIDENT in our ability to find all & what others miss. If our research finds zero critical or high-severity vulnerabilities, you pay $0. DM open.

We find zero-days even after you think all angles are covered. We challenge every project today: request a free audit, and we will show you.

#freeaudit #adversarial #0dayHI #bugbounty #web3security #web2security #appsec

[Zer0day Sec 🗡 @Zer0day_sec]

@0xriptide Have good bug bounty, or dai!!!

[Zer0day Sec 🗡 @Zer0day_sec]

@BPIV400 Tnx for the clarification Barry.
Freeze and pause mechanisms failing to trigger is exactly what was documented in a Critical ICS07 freeze bypass I independently found and reported in IBC Eureka on April 1. Fixed April 9. Missed by 2 prior audits.
My report/research remains unacknowledged. The irony is not lost.

[Zer0day Sec 🗡 @Zer0day_sec]

@BPIV400 🤔

[Zer0day Sec 🗡 @Zer0day_sec]

This message urges triage teams to remember shared goals in improving security, using a lighthearted reminder that researchers are "the good guys"

[Zer0day Sec 🗡 @Zer0day_sec]

Sometimes you got to remind the triage team:

"Hey! We're on the same side. We're the good guys. Remember?"

Come on! Why the whole we-dont-negotiate-with-terr0r1st treatment? Hmm?

😃 #GoodGuys #WhiteHat #SecurityResearch #BugBounty