@stuxfdev

co-founder and ceo @verialabs (yc f25) | hack things @smiley_ctf

verialabs.com/
Joined September 2025
  • Tweets83
  • Following342
  • Followers603
5Media
More info on our blog soon!
XRP Ledger Operations
@XRPLOperationsOct 10
XRP Ledger version 3.4.1 is now the minimum required version after the recent amendments were activated. This release patched critical parts of the XRP Ledger. The vulnerability report can be found here: xrpl.org/blog/2026/vulnerabi… Public release notes: github.com/XRPLF/rippled/rel…
1
5
24
3,573
stuxf retweeted
.;,;.@smiley_ctfSep 3
Our first team won DiceCTF Finals, with our second team placing 7th place. Thanks to @dicegangctf and @QuendCon for hosting such an amazing ctf! Next time we'll spell out smi - ley properly on the leaderboard.
2
8
37
1,322
🧵Veria AI autonomously found and demonstrated a critical vulnerability in Aleo, finding a proof forgery in Aleo's snarkVM. The project awarded us the maximum bounty of $65,000 for the find.
6
5
3
53
12,264
stuxf retweeted
Immunefi
@immunefiJun 2
Another 5-figure win for an Immunefi SR. Congrats to @verialabs and @Cayden_Liao.
6
11
1
202
9,743
Anotha one I just found a confirmed bug on @immunefi #immunefitribe immunefi.com/s/ss/?severity=…

I just found a confirmed bug!

Crypto and smart contract bug bounty programs. Immunefi has paid $140M+ across 650+ protocols, more than the rest of the market combined.

immunefi.com
13
7
2
152
8,228
stuxf retweeted
LakeCTF@LakeCtfMay 3
🏆#EPFL #LakeCTF 2026 — it's a wrap! 🚀 Another year, another amazing battle of brains of creativity!🧠💻 Congratulations to this year's winning team pls carry :3! And thank you to every participant for making this edition such a success.👏 🥇 pls carry :3 🥈 .;.;. 🥉 FluxFingers
10
1
46
3,581
I just found a confirmed bug on @immunefi #immunefitribe immunefi.com/s/ss/?severity=…

I just found a confirmed bug!

Crypto and smart contract bug bounty programs. Immunefi has paid $140M+ across 650+ protocols, more than the rest of the market combined.

immunefi.com
7
3
1
154
6,067
Part 2 of @verialabs Securing Open Source series: We found 2 bugs that could be chained together in Kraken Wallet: Chaining both, a malicious dApp could impersonate a trusted one and disguise transactions as messages, silently draining user funds. Blog: verialabs.com/blog/securing-…

Securing Open Source Part 2: Cracking Kraken

Malicious dApps can impersonate trusted apps and disguise Solana transactions as harmless message signatures, allowing potential fund theft when chained together.

verialabs.com
1
7
1,002
We wrote up everything we do to secure our open source projects at Astral
10
39
2
357
23,385
recently onboarded to @verialabs (F25) to help with our security Highly recommend working with them! Super professional, clean UI, and well worth the investment The product lives within our CI/CD, and it's a super easy github integration 🥂
3
3
20
2,081
stuxf retweeted
jayden
@0jayden_Mar 24
Starting a series where we write up interesting vulns our agent at @verialabs finds: First up, 1-click RCE in Goose, Block's coding agent with 33k+ stars: verialabs.com/blog/securing-… Goose was vulnerable to CSWSH, allowing an attacker-controlled website to run arbitrary commands.

Securing Open Source Part 1: Goose 1-Click RCE

We found a 1-click RCE in Block's Goose AI agent: any website could silently execute commands on your machine.

verialabs.com
5
7
25
2,530
stuxf retweeted
.;,;.@smiley_ctfMar 8
We just qualified 2 teams for DiceCTF Finals, with one of our teams getting 2nd place overall! Congrats @BunkyoWesterns on winning and we'll see everyone in NYC! insert line about llms ruining ctfs here
3
7
3
32
5,854
We hacked a Times Square billboard! jk! @brexHQ put us up there for YC F25. Back to actually finding security vulnerabilities.
2
3
1
21
3,519
🧵 Broke Eigen Network's zkVM Found a missing check in its FRI implementation that lets attackers forge arbitrary proofs.
1
3
11
1,515
We're officially top 3 in the world on CTFtime for 2025, up from 13th last year! yay This year, we also: - hosted the first ever smileyCTF, with 1,000+ teams playing - went to in-person CTFs in Switzerland, Las Vegas, NYC * 2 - qualified for SECCON and LakeCTF 2026 finals
2
8
3
39
5,478
🧵 We just discovered critical RCE vulnerabilities in popular AI coding tools including Claude Code and Gemini CLI. The issue: These tools use OAuth for MCP (Model Context Protocol) authentication, but don't validate authorization URLs from servers.
4
5
3
40
4,376
Load more