Lead Security Partner @sherlockdefi @blackthornxyz
Portfolio →
Joined January 2024
- Tweets650
- Following650
- Followers2.5K
- Likes3.2K
Pinned Tweet
Thanks for having me @opensensepw 🫡
How do you go from "no clue what audits are" to becoming a top Web3 security researcher?
We just dropped a 🔥 interview with @sammyaudits, one of the sharpest minds in smart contract auditing.
Full journey, no fluff.
youtube.com/watch?v=Pl3c8bL8…
sammy retweeted
Cryptocurrencies go up 20% and your entire timeline is filled with anime characters quoting Socrates
sammy retweeted
How to actually earn $ as a web3 security researcher in 2026 xitter.cf/i/broadcasts/1NGarrMVn…
sammy retweeted
Today at 14:00 UTC
How to earn $ as a web3 security researcher in 2026 With @GuildAcademy_, @sammyaudits and @RealJohnnyTime
Join us here:
Tune in for some crazy alpha🔥
How to actually earn $ as a web3 security researcher in 2026
We're getting @RealJohnnyTime, @sammyaudits, and @GuildAcademy_ together with the Remedy team to talk through it honestly:
→ Bug bounties vs contests vs going in-house - what's worth your time
→ How to pick targets that'll actually pay you
→ Competing when everyone has the same AI agents
→ Where independent researchers go from here
We see this differently, so come ready to push back.
June 4, 14:00 UTC
Live discussion on @xyz_remedy
sammy retweeted
pretty crazy if true
tl:dr - hackers casually gained trust via irl conference meet, setup tg channel and became a customer, started building integrations over 6 months and then got one person with a testflight link to show off what they built
sammy retweeted
the figures referenced in the post are entirely misleading. There was no impact realized from this issue. Zero user funds were affected and zero addresses were compromised.
My response: Are you suggesting I should have actually exploited the bug and caused real damage before coming to talk to you?
For the stated vulnerability to work in practice, it would require execution of several suspicious transactions that would have an extraordinarily limited impact.
My response: You should know better than anyone that on a Cosmos-based chain, a single transaction can pack multiple messages. Just one transaction is more than enough to completely drain multiple whale accounts.
Injective has dynamic rate limiting functionalities which are applied automatically based on our live monitoring systems. This functionality has been live on mainnet since last year and is publicly available in our code base.
My response: First, this has nothing to do with the vulnerability itself. Rate limiting doesn't stop attackers from stealing funds. It only slows them down when they try to bridge those funds over to Ethereum. Second, when I submitted my report, the mainnet configuration for this feature was not set. In other words, this feature wasn't even turned on!
In addition to all of the above, this report was reviewed against the clearly defined terms of our Immunefi program. Based on those terms, issues such as those raised in this report that DO NOT impact block production or consensus are categorized outside of the Blockchain/DLT tier and carry a maximum payout of $50,000.
My response: First, Immunefi has always put the impact of direct fund theft at the very top of its priority list. This is a fact that everyone knows. Second, you changed your bug bounty page after I submitted my report. Here’s the snapshot from November 8, 2025: web.archive.org/web/20251108… . And now, there’s an extra line added to your bug bounty page: “IMPORTANT: Within the Assets in Scope table, the injective-core folder is listed for both Blockchain/DLT and Web/App due to overlap between the two within the same folder. However, for a report to be categorized as Blockchain/DLT, the resulting impact has to be directly involved with the block production process or with consensus failures. All reports not dealing directly with either of these are to be categorized as Web/App.” I’d really like to know when this line was added. and do you really value chain consensus more than users' funds?
We remain committed to fair, transparent, and consistent handling of all reports, and to maintaining the highest standards of security for the ecosystem. Injective has done so since its mainnet inception in 2021 and will continue to do so in perpetuity, always putting builders and security first.
My response: You never even replied to my messages, and now you’re blaming me for not requesting mediation? I can post the original report if you agree. I left many messages, but you haven't replied to a single one.
----------
Finally: Stop making excuses from every angle and trying to use technical jargon to confuse people who aren't developers. That doesn’t work anymore these days. Anyone can just ask an AI to fact-check what both of us are saying. I have no ill intentions toward your project. All I'm asking is for you to be honest and handle this transparently.
Security is paramount at @injective and we take our bug bounty program very seriously.
First and foremost, the figures referenced in the post are entirely misleading. There was no impact realized from this issue. Zero user funds were affected and zero addresses were compromised.
For the stated vulnerability to work in practice, it would require execution of several suspicious transactions that would have an extraordinarily limited impact. Injective has dynamic rate limiting functionalities which are applied automatically based on our live monitoring systems. This functionality has been live on mainnet since last year and is publicly available in our code base.
In addition to all of the above, this report was reviewed against the clearly defined terms of our Immunefi program. Based on those terms, issues such as those raised in this report that DO NOT impact block production or consensus are categorized outside of the Blockchain/DLT tier and carry a maximum payout of $50,000.
If the poster had requested a mediation we would explain to him the dynamic rate limiters and monitoring systems we have in place and why his stated figures are misleading. However, he did not do so. We always follow the procedures set forth by the Immunefi program and expect the submitter to do so as well.
We remain committed to fair, transparent, and consistent handling of all reports, and to maintaining the highest standards of security for the ecosystem. Injective has done so since its mainnet inception in 2021 and will continue to do so in perpetuity, always putting builders and security first.
I think this would be one of the more complex exploits of 2025.
Like the Swiss cheese model in aviation, many things had to be wrong at the same time for this exploit to happen.
Flow Network Exploit Post-mortem
On December 27, 2025, an attacker exploited a vulnerability in the Flow network to counterfeit tokens, extracting approximately $3.9 million USD across bridges. No existing user balances were accessed or compromised. The attack duplicated assets but did not touch legitimate holdings, with the vast majority of counterfeit assets being contained onchain or frozen by exchange partners before they could be liquidated. Network validators have ratified a decentralized governance action authorizing the permanent destruction of 100% of counterfeit assets. The network resumed operations on December 29th and is operating as expected with full transaction history preserved.
Attack Vector
The attack demonstrated significant technical sophistication. The attacker deployed over 40 malicious smart contracts in a coordinated sequence, exploiting a three-part attack chain:
1) Attachment import validation bypass
2) Circumvention of defensive checks on built-in types
3) Exploitation of contract initializer semantics.
The root cause was a type confusion vulnerability in the Cadence runtime (v1.8.8), now patched (v1.8.9 and later). The flaw allowed the attacker to disguise a protected asset (which should be non-copyable) as a standard data structure (which can be copied), bypassing the runtime's safety checks and enabling token counterfeiting.
Remediation
Beyond bridging assets out of Flow, the attacker attempted to deposit counterfeit FLOW across several CEX, with many exchange partners freezing the deposits upon receipt due to the abnormal size and internal AML protocols. Approximately 50% of those counterfeit FLOW deposits have already been returned by cooperative exchange partners (OKX, Gate, MEXC) and destroyed, and the Foundation is actively coordinating with remaining exchanges.
The network was restored on December 29, 2025, via an Isolated Recovery Plan that preserves all legitimate transaction history. This approach was selected following ecosystem-wide consultation with exchanges, bridge operators, and infrastructure partners. The Isolated Recovery Plan was chosen specifically to avoid reconciliation risk for off-chain custodial systems and cross-chain protocols maintaining independent state.
The Foundation is cooperating with blockchain forensic partners including zeroShadow and Find Labs and relevant law-enforcement authorities to support ongoing investigations.
Full technical details of the vulnerability, exploit mechanism, forensic analysis, and remediation architecture are linked in the comment.
Just a few thousand more years till AI can catch bugs like these 🔥💪
Breaking down the @flow_blockchain exploit that occurred today, a critical type confusion vulnerability in the Cadence runtime was exploited. The as! operator failed to validate resource types, allowing @[AnyResource] to be cast to
@[{FungibleToken.Vault}] without proper checks
Oof, this has to be the first execution layer exploit in a while. Hackers are getting better everyday.
This is the verified update from the Flow Foundation.
INCIDENT CONFIRMED
On December 27, 2025, an attacker exploited a vulnerability in Flow's execution layer and moved approximately $3.9M in assets off-network before validators executed a coordinated halt.
Critically, this exploit did not access existing user balances. All user deposits remain intact.
The Foundation's security team has mapped the exit path. Current status:
CONFIRMED FUNDS EXITED TO DATE: ~$3.9M
→ Primarily routed through bridges (Celer, Debridge, Relay, Stargate)
→ Attacker wallet identified and flagged
→ Active laundering via Thorchain/Chainflip being tracked in real-time
→ Freeze requests submitted to Circle, Tether, and major exchanges
→ Forensic analysis ongoing
CONTAINMENT: Complete
→ Network halt severed all exit paths
→ No further unauthorized activity possible
→ Remediation in progress
The confirmed funds exited represent a manageable amount that does not threaten network solvency or user funds. The immediate priority is remediation and safe restart.
RESTART TIMELINE
The protocol fix has been developed and is entering final validation.
→ Target restart: Within 4-6 hours, pending successful testnet validation
→ Next status update: Within 2 hours
→ Full technical post-mortem: Within 72 hours
The network will not be restarted until the fix has been fully validated.
The Foundation will provide updates every 2 hours until restart is complete.
@FindLabs is publishing the Foundation's forensic data below, including transaction hashes and the attacker's Ethereum wallet.
The Foundation thanks the community for its patience during the investigation.
I think this prediction is starting to play out, with many platforms recently increasing friction for new accounts like PoCs, fees for BBP, report limits, etc. It seems likely that this friction will only increase from here.