Security Researcher(smart contracts) Solidity | Move | Rust | Formal Verification

🇮🇳 INDIA
Joined May 2021
Pinned Tweet
Low-key proud of this one. Found an exploit in a codebase that had been audited by not one, but two top-tier firms. Part of me wants to tag them and ask for work 😅 Def a confidence boost, or maybe I just got lucky. I’ll take the W either way. GG. Thanks @HackenProof 🙌
20
2
132
4,839
70% of its backruns land at tx_index + 1 (the rest within ~5ms) and almost none use Jito bundles. leaders stream shreds after executing the tx,no gRpc or shredstream gets you the very next spot. this is likely access to pre-execution orderflow or validator-level queuing.
Found a @solana arbitrage bot making ~$52k/day over 34 days :) → Live since Sep 4, running its own on chain program → ~23k txs/day; ~60% revert as it rejects unprofitable trades → 15,616 SOL (~$1.76M) swept to its payout wallet in 34 days Axiom shows $11M profit in 30 days I traced the on chain money flow: closer to ~$1.6M over that same period
1
4
186
Don't you think forcing researchers to improve their Issues Ratio within 120 days could actually encourage rushed submissions, potentially increasing the very false positives you're trying to eliminate? How exactly does putting researchers under that pressure protect your clients on Audit Engine? You mentioned researchers who don't meet the threshold as if they're automatically a burden. Let's say a researcher submitted 1 valid, unique vulnerability and 5 invalid findings. Does that make their valid discovery worthless? Does that researcher suddenly contribute nothing to security simply because their Issues Ratio falls below your threshold, even though they discovered a unique vulnerability? Nobody is arguing that false positives should be rewarded or that researchers who consistently spam invalid submissions should face no consequences. That's an entirely different discussion. The issue is that Sherlock is deprecating its contest platform while giving researchers only 120 days to unlock previously accumulated rewards through a system they aren't even guaranteed access to. You established those rules, allowed researchers to accumulate rewards under them, and now you're introducing an expiration date while removing the very contest model through which researchers could improve their ratio. And regarding your statement that "unearned money that can be unlocked by improving the Issues Ratio is not an SR's money," your own team previously stated: "The payments will never be ours and it will be waiting for you to pass the threshold. You can do so by competing in Audit Engine engagements (they will affect the Sherlock contest thresholds as well soon)." So which is it? Your team explicitly communicated that those payments would never belong to Sherlock and would remain available for researchers to unlock by improving their ratio. Now you're introducing a deadline while not even guaranteeing those researchers access to the engagements required to meet that condition. You can protect your clients from false positives without retroactively closing the door on researchers who were operating under your own established rules. Nobody is asking Sherlock to reward spam. We're asking Sherlock to honor the system it created instead of CHANGING the exit conditions when shutting it down.
Replying to @kuprumxyz
This is very wrong Kuprum. Sherlock wants 100% signal in every engagement it does. We have an entire judging system so we can deal with occasional false positives here and there. What we’re talking about is participants who have delivered so many false positives that they’ve overloaded our systems and judges and risked our relationships with our clients. I had a call just yesterday with a client who doesn’t want to do a contest-style engagement with Sherlock because it took them so long to sort through false positives last time (even though Sherlock judged and triaged, they wanted to go through all the submissions). We will likely lose their business. Sherlock and I have been crystal clear on this throughout the years: unearned money that can be unlocked by improving the Issues Ratio is not an SR’s money. They literally did not earn it. It’s as if we hired a security guard and the guard has called the police on every person who walked in the door. Is that security guard doing a good job? Should we hire them again? Should they be paid for that work? Of course not. Do not be swayed by SRs who are lobbying to try to get a free airdrop out of Sherlock. It will not happen. And besides, it would make Sherlock’s contest-style engagements much worse in the future by rewarding the exact behavior we are trying to discourage.
1
2
21
820
How many contests will we have on @sherlockdefi in the next 120 days? Def not many. Bro what's stopping you from letting SRs withdraw their money just this once? It's not your money to keep. Disgusting!
1
1
46
2,087
Trusting a "Ledger" with all your crypto is risky enough. Buying one from a reseller makes it worse. A dedicated iPhone, properly secured and used as a cold wallet, is a much better alternative. also aren't there any open-source hardware wallet projects with DIY build guides? 🧐
5
295
If you are learning Zk, def check this out. Best resource out there. As usual great job @RareSkills_io @Jeyffre 🫡
2
2
1
48
2,836
Did we just find an underflow bug @HackenProof? 😂
1
52
2,559
Credit where it’s due: @HackenProof has improved significantly over the past year or so, at least from my personal experience. The overall experience has gotten much better. Can’t say the same about another platform that charges $250 for mediations, with no refund whatsoever.
3
1
2
45
4,115
this is amazing and also terrifying.
Replying to @JeffLadish
The agents initially had very limited access to the internet: they could load URLs but not send any data. Agents created a series of workarounds, using a link-shortener site to create almost a million URLs that, when chained together, let them execute code to hack Hugging Face.
1
5
606
Killua retweeted
🚨 DoinGud (@DoinGudHQ) has just been hacked for ~$35K USDC 🚨 I had discovered the vulnerable contract around a week before the hack. 🧵Here's what happened: (1/15)
6
5
1
102
8,413
Any interesting ideas for building DeFi bots ? Looking beyond the usual liquidation and arbitrage bots. Curious what else is out there.
3
236
"Tokenized Stocks": Often defined as “digital tokens tracking stock prices.” But do issuing platforms actually hold the underlying stock as inventory? Or can you just launch a token and sync it with the real-time stock price? Feels like a scam . Enlighten me, fellas!
1
207
Burden of uncertainty! Have you forgotten the BalancerV2 ComposableStablePool OR the Yearn yUSDT legacy pool hacks, anon? It is not only relevant to BB but to everything in life: seeking a "definite and 100% certain" result when committing your time and effort to XYZ, or delegating your critical thinking instead of developing your own, out of fear of being left behind or becoming outdated (or getting some average result "right now"). It is always freedom (and possible flourishing) vs certainty (and boundaries): essentially an egocentric perception of your actions, always expecting quick results, seeking certainty in life, and maintaining this unhealthy attachment of actions-->expectations (attachment, upādāna, is indeed the root of suffering!). "In the end they will lay their freedom at our feet and say to us, Make us your slaves, but feed us." "Man is tormented by no greater anxiety than to find someone quickly to whom he can hand over that great gift of freedom with which the ill-fated creature is born." "But did it never occur to You that man would disregard Your example, even question it, as well as Your truth, when he was subjected to so fearful a burden as freedom of choice" ("the Brothers Karamazov") "creativity requires the courage to let go of certainties." "The quest for certainty blocks the search for meaning. Uncertainty is the very condition to impel man to unfold his powers." (Erich Fromm) Burden of freedom!
Bug hunting requires discipline and a willingness to sacrifice your time for an adventure with no guaranteed outcome. You’re searching for something that shouldn’t exist yet, it does EXIST. I can honestly say I’ve only been doing bug bounty the right way for the past two months only. During that time, I’ve spent countless hours studying, learning, and writing down every valuable insight I could gather from top hunters. It’s a journey filled with enjoyment, wealth, and sacrifice. If you want to become truly good at it, you have to eliminate most of the distractions around you, then and only then you can dedicate at 80% of your focus to hunting (80% is enough to catch good vulns) . Distractions are a topic for another day, but I just wanted to share what has been on my mind lately.
3
4
25
1,732
Today is the first time I’ve heard of a block builder called Bombora Builder @bomborabuilder
4
284
I've been using Muse Spark 1.3 (Free) , it's really good in terms of reasoning and long tasks. I'm using it for dev work, research and analysis, no auditing stuff though. - I'm only using it cos it's free and Idgaf if they train on my data.
1
6
593
Killua retweeted
How to make it big in crypto? Learn in public 1. Pick 1 skill and go deep - dev, auditor, BD, etc... 2. Learn in public - post what you learn, even the basic stuff 3. Build proof of work - projects, client wins, findings, all public 4. Be your own biggest shiller - nobody will do it for you 5. Play the numbers - more reps, more DMs, more posts = more luck
1
7
58
1,651
After today, Whites will turn grey, but from grey, black isn't a leap. Tornado 🌪️ , perhaps crypto's most beautiful paradox!
9
257
𝗚𝗿𝗮𝗱𝘂𝗮𝘁𝗲𝗱 𝗳𝗿𝗼𝗺 the Solana Sec Bootcamp. Report Card: 𝗥𝗲𝗸𝘁𝗼𝗳𝗳 𝗚𝗿𝗮𝗱𝗲: 𝗔+ “The strongest submission in the cohort. 22 findings. 14 canonical issues. 21 PoCs. Best test discipline in the cohort.” Thank you everyone at @rektoff_xyz @solana @danielkcumming
C5 certificates are going out today, which makes it official. This cohort is done. If you earned one, don't let it sit in your inbox. Post it. Tag @rektoff_xyz. Show the world you made it through. Every cert that goes up is one more name in a growing line of Solana security researchers who came through this program. We want to see how big the Rektoff army actually is, and so does everyone deciding whether to join the next one. C6 registration is already in the works, and it's coming soon. Follow us and turn on notifications so you catch the window when it opens. To C5: proud of every one of you. Go make some noise.
4
62
1,963
With LLMs, everything is BUILDable. Spent the last 35 days building 3–4 DeFi bots(searchers/MEV/arb) across different chains. Learned a ton, kept iterating. today one of them finally landed its first txn . Feels good.[Could've made a lot more $$ if not for the builder bribes] 😅
8
361
sudden spike in hacks across chains, all in millions. meanwhile SRs paying(25$-250$) to report bugs. this is amazing!
7
3
1
67
3,472
Big companies make average work look impressive. Spend enough time in their core codebase, and you’ll know what I mean
1
10
430