Zero Cipher

Senior Blockchain Security Researcher. Move/EVM/Rust.
#15 All time Cantina Leaderboard.
Founder @VulsightSec

[Zero Cipher @zerocipher002]

$300,000 from a single bounty.

Also yes, it was Move related.

Move helps, but it doesn’t magically make protocols safe.

The real bugs still live in assumptions, invariants, and integrations.

Proud of what VulSight has been doing too. We’ve cleared over $500k in bounties in the last 2 months.

If you’re a founder and you want an audit team that consistently finds criticals, we’re a DM away.

[Immunefi @immunefi]

Big congratulations to @VulsightSec for scoring their very first paid report on Immunefi.

And it's huge, huge payout.

Well done!

You can pledge behind them here to earn IMU when they find bugs:

https://t.co/D5bSZTEWUb

[Zero Cipher @zerocipher002]

@__nnez @WhiteHatMage Crazy. Was it a critical?

[Zero Cipher @zerocipher002]

@secorizon Only if cantina had sway over the bug bounty amounts, I would have bribed cantina to award me more favourable ones.

[Zero Cipher @zerocipher002]

@0xnirlin @hrkrshnn Context

[Zero Cipher @zerocipher002]

@GalloDaSballo Quite interesting stuff. I am curious on how likely do you think there are some extreme edge case critical vulnerabilities in smart contracts that neither manual auditing or LLM based auditing can find?

[VulSight @VulsightSec]

🌴 The @VulsightSec team has landed in Miami for @consensus2026!

May 5–7 | Miami Beach Convention Center

If you're building in Web3, let's talk:
🔐 Smart Contract Audits
🛡️ Protocol/Infra Security Audits
🤝 Security Partnerships

DM us to grab coffee or meet up on the beach. ☀️

#consensus2026 #Miami #web3 #Security

[Zero Cipher @zerocipher002]

@0xT1MOH @DevDacian Context 👀

[Zero Cipher @zerocipher002]

@immunefi Kim Jon un

[Zero Cipher @zerocipher002]

When you know that projects are scamming by self donations on giveth programs but can't prove it

[Zero Cipher @zerocipher002]

@pashov If a person wants to do excellent Business Development, what tips do you have.

[Zero Cipher @zerocipher002]

@0xriptide Protocols would use any way available to them to scam whitehats out of their hard earned rewards.

[Zero Cipher @zerocipher002]

Name drop any protocol that in your opinion that one should never hunt on its bug bounty 👀

[Zero Cipher @zerocipher002]

Wild thought:

When you train for lucid dreaming, you learn to check things like your hands or the time on a clock because dreams mess those up.

AI image/video models make very similar mistakes (extra fingers, broken text, inconsistent details).

Feels like AI is mimicking human consciousness on a level.

[Zero Cipher @zerocipher002]

@bugarela @quint_lang @informalinc Congratulations. Best of luck to you :)

[Zero Cipher @zerocipher002]

@ScrewCopper Havent worked on them.

[Zero Cipher @zerocipher002]

After doing extensive Bug Bounty and interacting with dozens of protocols. In the Infra Space among the major blockchains, I believe only these protocols (currently) actually care about security:
1. Solana
2. Ethereum
3. Monad
4. Sei

Most of the other blockchains don't care about either security or respecting whitehats.

[Zero Cipher @zerocipher002]

@DefiGodwin_ Just something I experienced personally.

[Zero Cipher @zerocipher002]

@0xSpearmint I wouldn't say so 👀

[Zero Cipher @zerocipher002]

@_wdm33 Not really. The conclusion is based on how protocols react after someone reports a "problem"

[Zero Cipher @zerocipher002]

@revofusion @Optimism @zksync @Starknet Haven't worked on them so didn't add them. Btw great work on ethereum :)

[Zero Cipher @zerocipher002]

@BensonDynasty_ The problem is that at the end he has the entire funds.

[Zero Cipher @zerocipher002]

Suppose we have a critical drain vulnerability that two whitehats find at the same time.

One reports it to the bbp.
Meanwhile when the report is being reviewed, the other whitehat executes a whitehat attack to secure the funds.

Who gets the bounty 👀