@taichiaudit Founder | Whitehat doing mediations @Immunefi | Core Member @DeFiHackLabs
GMT+8
Joined January 2018
- Tweets3.1K
- Following3.9K
- Followers2.6K
- Likes8.3K
Submitted 2 High severity bounty reports to Cantina and let's see how it goes😜Wish me luck and mental health
Like what I always say, in web3 everyone will be scammed, including security researchers. This is called the Fundamental Theorem of Web3.
I will never understand why a fund loss bug is private known issue, but I guess that is life, you will never understand everything, just move on with confusion and accept it.
It was my mistake that I didn’t see this tweet earlier
Also I found this rule was added after my submission time and before mediation time. We quote things based on mediation time instead of submission time now? Why?
Paid $250 bucks for a mediation and got closed after 25 minutes with this response, stay away from this scam. Do not pay for mediation.
Paid $250 bucks for a mediation and got closed after 25 minutes with this response, stay away from this scam. Do not pay for mediation.
Immunefi can refund this, no big deal. The real problem is "private known issue" can't be proved. Studio says report is good, triager says report is good, protocol closes your report with private known issue but no evidence whatsoever and it is over.
I decided to give Immunefi Studio Review a shot before submitting a High severity finding.
The submission for this particular program costs $75 so I decided to pay $20 for a Studio review first to sanity-check the report.
Immunefi Studio came back with "Ready" - "meets standard escalation criteria with no blocking technical flaws".
To be fair, it suggested a couple of improvements to the PoC which I applied to the report before submitting.
So I paid the $75 and submitted.
15 minutes later, my favorite guy Andrew closed it as a duplicate of a report submitted 9 days earlier.
So that's $20 for Studio Review + $75 submission fee = $95 to have one Immunefi bot tell me "send it" and another Immunefi bot tell me "duplicate report".
That's the part I'm struggling with.
Immunefi Studio is explicitly advertised as checking duplicate risk too.
If a duplicate has already been sitting in your system for 9 days and the Review bot can't catch it, but the triage bot catches it almost immediately after submission, then what exactly is the value proposition here?
@immunefi / @MitchellAmador - I genuinely think this is useful feedback if you're still iterating on Immunefi Studio.
But from the whitehat side, this flow feels pretty broken.
Especially when it costs $95 to get to this outcome.
My 16th bug bounty on @immunefi (haven't posted for a month because I have several confirmed but downgraded severity reports and I am waiting for free mediation slots, paid too many, won't pay anymore) #immunefitribe immunefi.com/s/ss/?severity=…
One of my bounty report was closed for being a “duplicate of some internal finding” and I can’t see the content. Opened a ticket and got response saying I should do mediation which means I will have to pay 250 bucks. In such case I guess I should just forget about it right?😂
Very useful repo where you can collect evidence, but I still recommend to save a snapshot like wayback machine, in my understanding that snapshot is more convincing. It doesn't hurt to have more evidence.
You might find this helpful: github.com/infosec-us-team/I…
Bug bounty tip learned the hard way: when you submit report, save a wayback machine snapshot or similar public evidence to avoid unnecessary arguing. Protocol can ghost your report and add "out of scope" rules during that time and close your report, you need evidence to flip it
I remember you froze fund in a recent hack, how you suddenly turned permissionless?😂
We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved.
THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain.
What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?
@star_okx @GracyBitget
Yeah my ranking will be much higher if confirmed bugs are paid faster😂Please!
In just six weeks, @ret2basic has had 17 confirmed or paid reports. That is almost three per week.
He has found bugs across a range of attack surfaces, including Web/App, Smart Contracts, and Blockchain/DLT.
He now sits at 45 on the 90-day leaderboard, but with multiple confirmed but unpaid reports still in the pipeline, he'll likely break into the top 20 very soon.
Do you think you can take a spot on the leaderboard?
If you build really good private tools, at some point you will have to figure out how to hide it from ai companies or even github
>sam altman: "we tried this because there were rumor on the internet"
>rumor: math professor close to solving navier-stokes
>the professor: using codex for a year
>openai: has all his logs
>checked every codex session tagged to N-S
>found the most promising one
>spun up 10,000 agents to finish the proof where he couldn't
>they got caught
>told the guy if you say anything you'll destroy your own career
>he ruins his career over this
>openai: "we did not see his work"
>also openai: "we cannot rule out that de-identified data from their usage helped improve our models"
they stole it lmao
Whitehat turned greyhat to protect onchain asset, otherwise that critical report will be sitting in queue for at least a week waiting for triaging🤪
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.
Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident.
Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.
Liquid wallets will be impacted, and we're sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.
You can monitor the situation via @mempool's liquid.network site below:
mempool.space/address/bc1qdl…
