Taking 1–2 triage slots. Automated scan plus my own manual read. Line citations. Prioritized leads only. Explicitly not a full audit, and not a completeness guarantee. $150 for the first one so you can judge the output. After that, $300–500 by size. DM the repo.

I have experienced a lot of delay in triage and reviews.....SLAs are not followed and it really tests ur patience. The key I think is move on to next one and keep in touch with the support team.

I engaged in a few hunts and audits recently across different chains. Here is what actually stood out. I ran basically the same process on three systems: - An EVM prediction market - A Clarity lending protocol on Stacks - NEAR core-contracts None of them produced high or medium findings. That made them useful for a different reason. I could clearly see which parts of how I audit transferred cleanly and which parts broke when the chain changed. WHAT STAYED ALMOST THE SAME I always start by mapping every entry point and trust boundary before reading anything deeply. Who can move value or state, and from where. This step looks nearly identical whether it is Solidity, Clarity, or NEAR methods. It quickly shows the real attack surface instead of what the docs claim. I keep a running list of adversarial hypotheses. I only promote something to a real finding if it creates a new capability an actor did not already have. This single filter removed most of the noise. On the prediction market side I started with 23 hypotheses. The filter plus adjacent defense checks killed all of them. The highest signal work on every review was writing down the accounting and safety invariants and then trying to break them. - On the EVM side this was structured manual review. - On Clarity I ran a 150-run randomized invariant campaign in Clarinet simnet. I deliberately injected a mutant to confirm the campaign was not vacuous. - On NEAR I paired the same thinking with 6,000 targeted fuzz cases around share conversion, vesting, and rounding. WHAT HAD TO BE REBUILT Clarity has no classic reentrancy and is not Turing-complete, so a lot of usual checks disappear. New ones appear instead. Differences between tx-sender and contract-caller. as-contract changing the effective principal. Traits resolved at call time. How unwrap! and try! can change control flow. I had to write a short Clarity-specific supplement. The core process stayed the same. The authority checklist did not. NEAR is asynchronous. Promises, callbacks, and storage staking create failure modes that do not exist on the other two. I needed a separate checklist for: - Private callbacks and every result branch - Who pays for storage growth - Full-access keys versus function-call keys - Predecessor versus signer I also scanned 1,908 live DAOs on-chain to test hypotheses against real deployed state instead of only the code. On the EVM prediction market the hard part was cross-component integration between Conditional Tokens, the neg-risk adapter, per-user vaults, and the two-phase oracle. The most useful thing that came out was not a bug list. It was an 8-class defense catalog covering: - Reentrancy - Oracle manipulation - Accounting inflation - Privilege escalation - Emergency abuse - Cross-market contamination - Resolution manipulation - Token rigidity Each one includes the defenses that were present and the attack that appears when they are missing. That catalog has already been more useful than the review itself. WHAT I WOULD ACTUALLY KEEP When moving between chains the highest leverage move is to keep the structure of the process fixed and treat the chain-specific model as a checklist you write once. The rough flow that survived all three: 1. Map entry points, roles, and fund flows. 2. Write the accounting and safety invariants. 3. Generate hypotheses and apply a capability filter. 4. Attack the interactions and sequencing, not just individual functions. 5. Produce a defense catalog or chain-specific checklist so the next review starts higher. People who stand out across ecosystems are usually not the ones who know the most syntax of one language. They are the ones who can clearly say which parts of their process stay the same and which parts they had to rebuild. Full writeups with the hypothesis lists, the invariant campaigns, and the defense catalog are here: samarthshukla17.github.io/se… If you have been jumping between chains too, curious which parts of your process have transferred cleanly and which ones keep breaking.

Read @asen_sec’s Module 3. The useful part is not “add more agents.” Five specialists plus the hunter, each looped, then one judge. Recall went from 32.6% to 57.6% on the same 23-bug key. High was already 3/3. The gain is Medium bugs the single hunter kept skipping. Two details I keep coming back to. The specialists were picked from bugs that actually appear in the key, and the prompt describes the bug type, not the answer. That is what makes the number transferable. A lens written against a known finding will not survive the next repo. The judge is one call over every lane. A few exact specialist hits got dropped or merged into a vaguer finding. Trust Boundary hit 0% and 25% on its own set while Arithmetic sat at 75–100%. More hunters without a judge that can keep an exact hit just makes a longer wrong list. Batching that judge is the next constraint. Not a sixth lens. 0xasen.xyz/from-one-ai-agent…

This is the right next module. One hunter was already finding the highs. The specialists are what moved Medium, from 32.6% to 57.6% on the same key. State and Lifecycle catching the cross-contract highs in both runs is the clean result. Same evidence rules, different lens, and the bug Module 1 missed finally shows up. The judge note is the useful constraint, not a knock. One call can dilute an exact hit, so batching it is the natural Module 4 fix. Measured, same answer key, code in the repo. Great stuff by @asen_sec

Nothing gets submitted unless I can explain it unaided. The harness is good at the mechanical work: diffing a fork against upstream, ranking untested branches, killing weak candidates. In one run the judge killed every candidate, and it was right. It is bad at the bugs that matter. Absences. Cross-subsystem interactions. Griefing instead of theft. It reads one function at a time and is primed to find a drain. On a 23-bug public answer key, two latest runs landed at about 11-13% recall. When it was near a bug, it named the right mechanism 3 out of 16 times in one run and 3 out of 22 in other. Small sample. Derived, not a named metric. Useful index. Not an audit.

Surely gonna try this out!

A month into the journey on @HackenProof 5 reviewed → 2 Duplicates, 2 Informative, 1 Out of Scope 1 still In Review. A few more sitting New. No valid finding yet. Still grinding for that first solid one.First report submitted Sept 1. Its slow and requires depth and patience

A month of going all-in. Took theory, built my own tooling, pressure-tested it, and turned it into real submissions. 12 reports to @Hacken_io so far. Slow, messy, real.