One year in web3 security. The biggest lesson wasn’t technical. In a few weeks it will be a year since I left software engineering and became a web3 security researcher. Estimated earnings for that first year: around $200k. This past month I’ve been looking back at all of it: the findings, the misses, the dry spells, the discipline, and how I built my days so I could hunt hard and still live a healthy life. And honestly, the number isn’t the main thing I took away. The biggest lesson was about control. Most of the game is outside your hands In this space a lot gets decided after you hit submit. Someone finds the same bug and yours becomes a duplicate. The judge downgrades your severity. A project goes quiet and never pays. Someone on your timeline posts a five figure payout in the same week you found nothing. If your mood depends on those things, this job will eat you alive. I learned that the hard way. Epictetus put it simply. Some things are up to us and some are not. Our effort, our judgments and our actions are ours. Results, reputation and other people’s decisions are not. Most suffering comes from confusing the two. Your report is your arrow Think of an archer. He controls the preparation, the aim, the breath and the release. Once the arrow leaves the bow, it belongs to the wind. In bug hunting the arrow is the report. Everything before submit is yours: how deep you read the code, how many edge cases you test, how clear your PoC is. Everything after is not. So I changed how I define success. A good day is not a day with a finding. A good day is one where I did the work with full focus. If that’s the measure, you can’t fail. Aim high, then let go You have to aim at something, otherwise you don’t move anywhere. Aim with everything you have, but don’t tie your peace of mind to whether you hit. Stop comparing yourself to other hunters. Leaderboards and payout screenshots show someone else’s journey. The only fair comparison is you a year ago. When I look at that version of me, the gap is huge. That’s the real result. And before you complain about judging, ask yourself if your report was really as clear and complete as it could be. Usually there’s something you could have done better. Emotions are information, not orders The hardest part was emotional. Frustration when a valid finding gets rejected. Envy when others hit big. The rush when you think you’ve found a critical, then the crash when it turns out to be a known issue. Doubt in the middle of a long dry spell. Most of my worst days weren’t caused by what happened. They came from the stories I told myself about it: “I’m not good enough.” “I wasted a whole month.” You can’t choose the judging outcome. You can choose what you do the next morning. Self-control lives in the boring parts Discipline isn’t one heroic all-nighter. It’s the daily structure: fixed blocks of deep work, phone away going through past contest reports and what I missed sleep, training and real food good books time completely offline Your system decides your results more than your goals do. The hunter with the better system beats the hunter with the bigger dream. And health isn’t separate from the work. A tired brain misses bugs. Taking care of your body is part of the process. What I control: how much I work and study how precise and persistent I am how I react when things go wrong What I don’t control: whether someone finds the bug before me whether it gets paid what the final result will be One year in, I don’t feel calmer because the results got better. I feel calmer because I stopped asking the results to tell me who I am. Focus on the process. Let the rest go.