Ex-Petroleum Engineer | Solidity Developer | Chief of Security @BurraSec | Security Researcher @spearbit, @zenith256 | Mentor @TheSecureum
Profile →
Joined December 2021
- Tweets4.3K
- Following942
- Followers4.3K
- Likes11.9K
Pinned Tweet
i've been quiet on X for the past 2 months but very busy with finding high and critical bugs on bug bounties
have a lot more to announce 🤫
Massive shoutout to @windhustler - who received a $50,000 bounty for two reports across bounty programs 💪
Huge congratulations on the payout!
I did high box squat 2x5 reps this morning: 140kg 🎉
Couldn't believe that before starting out I would be able to push so many reps, but the half movement does make it a lot easier.
Great exercise variation for building overall strength 💪
today I had the wildest realization
no matter in what way I talk to my wife about web3 security and crypto she simply doesn't find it interesting
it's too abstract and impossible to relate to
i don't blame her
one solution I can think of is having an in-person office where I work with good-looking women for sales/BD positions
have a feeling it would make her more interested and willing to hang around more just to "keep an eye on me"
the poll results are very inaccurate imo, hard to believe 70% of devs would be dishonest or exploit the protocol
as Nietzsche would say, "all morality is cowardice"
some have strong moral integrity; others would never do such a thing just because they're afraid of the potential consequences
we're probably looking at 1/100 instance when something like this occurs
but it's still a big problem that is hard to solve
Time for some real talk about the ethics of your internal dev/security team.
In one of my interviews (w @PabloSabbatella), the following dilemma was raised
⬇️ Options explained below
30%A - dev is honest
50%B - dev is dishonest
20%C - dev is a blackhat
30 votes • Final results GiuseppeDeLaZara retweeted
A year ago, I talked with Josselin Feist (@Montyly)
> Hacker since his teens
> PhD in Program Analysis for Security
> 8 years at Trail of Bits, led engineering
> Built Slither, used across web3 security
> Advised top DeFi protocols on secure design
> Currently internal security @aave
Watch the full interview 👇
A year ago, I talked with Josselin Feist (@Montyly)
> Hacker since his teens
> PhD in Program Analysis for Security
> 8 years at Trail of Bits, led engineering
> Built Slither, used across web3 security
> Advised top DeFi protocols on secure design
> Currently internal security @aave
Watch the full interview 👇
What's covered:
> Road to web3 security research
> Slither tool genesis story
> AI vs static analysis
> Why juniors should avoid AI while learning
> Designing protocols around invariants
> What makes a great security researcher
youtu.be/P5ZbgHvMbs0
Time for some real talk about the ethics of your internal dev/security team.
In one of my interviews (w @PabloSabbatella), the following dilemma was raised
⬇️ Options explained below
30%A - dev is honest
50%B - dev is dishonest
20%C - dev is a blackhat
30 votes • Final resultsImagine a senior dev working for a company with a good salary. He’s been working on some code that’s live on mainnet and has a TVL of $100M.
There’s a public bounty for that code, but employees aren’t eligible for it.
One day, he discovers a critical bug in the code that could allow around $20M to be drained.
What can he do?
A) Report it to the company, without receiving any additional reward for doing so.
B) Share the discovery with someone outside the company. That person reports it, collects the bounty, and splits it with the dev.
C) Exploit the bug and get the $20M.
How often do you think either B or C happens? (poll)
• Very rarely
• Occasionally
• Frequently
• Not sure
Have you seen or heard of this happening? How would you design incentives to make B or C less likely? Share your thoughts below.
posted this back in May
the situation has somewhat escalated, with more complaints about the fixed submission fees
what's unclear here is whether this is indeed a revenue stream for Immunefi or they're just using this to cover their triaging costs
both very valid (i'm in favor of submission fees), but if it's a big source of revenue, it creates a conflict of interest
it's IMPOSSIBLE to make everyone happy if you're running a large-scale operation (e.g. web3 security contest platform)
98% of Web3 companies may likely have one or two security incidents within the next year.
why?
simple … attackers are getting better, and so is AI.
98% is pretty speculative, but with the rate of incidents we have seen in the last quarters of the year … the possibilities are just insanely high.
which is why I think Web3 companies should do two things:
- take security 10x more seriously
- take not just “smart contract audits” seriously, but increased operational security
Here's what @PabloSabbatella of @opsek_io has to say about operational security: youtube.com/watch?v=ynCkkATE…
GiuseppeDeLaZara retweeted
Independent researchers bring a different perspective to protocol security, challenging assumptions, roles and system design from outside the team.
@lonelysloth_sec spent 157 days reviewing Centrifuge across V3.1, V3.2 and V3.3.
a lot of people reached out, but most don't have any real, raw, and interesting research pieces to show
i'm not a super talented writer myself but i can spot when someone else is
an example of good writing piece is e.g. some crazy personal experience coupled with professional aspiration that went viral
you can check one of my early tweets that got super viral: xitter.cf/windhustler/status/167…
there was already plenty of spam online before AI and it's only going to get worse. everyone's looking for raw, honest and interesting stories and crazy achievements. it's something AI can't duplicate.
I'm hiring an intern at @burraSec - paid role.
It's a research role with a lot of writing, close to copywriting. You'll write technical articles, interview bug hunters and top researchers, and break down bugs so anyone can follow them.
You'll work with some of the best researchers in the industry and learn how they think.
To apply, DM me on Telegram (t.me/windhustler):
1. Links to your best writeups, or any of your tweets that went viral.
2. Your availability and why you want this role.
love Mert's usual takes and humor, but for the love of God, why do X influencers have to have opinions on every single thing in the universe - almost always including stuff they don't know jack shit about
Bug bounty disclosures hurt a project's reputation, so many projects require reports to stay private and go to great lengths to obfuscate the fixes.
Anyone out there investigating this kind of stuff? Would make for killer investigative journalism!
I'm hiring an intern at @burraSec - paid role.
It's a research role with a lot of writing, close to copywriting. You'll write technical articles, interview bug hunters and top researchers, and break down bugs so anyone can follow them.
You'll work with some of the best researchers in the industry and learn how they think.
To apply, DM me on Telegram (t.me/windhustler):
1. Links to your best writeups, or any of your tweets that went viral.
2. Your availability and why you want this role.
seems like your influencer’s favorite privacy protocol was full of critical bugs
neverthless godlike work @gosasu1
researching his way to $1 million
I’ve been researching @Zcash security as part of our internal work at @osec_io.
Today, I’m happy to share that the total amount I’ll be receiving in bug bounties from @Zcash has finally been confirmed at $972K.
I’m really proud of what came out of this research. More importantly, I’m glad our work contributed to improving Zcash’s security and got more security researchers interested in Zcash. It’s especially great to see that many researchers are still looking into Zcash, finding and reporting bugs, and keeping an eye on its security.
Huge thanks to the teams across the Zcash ecosystem, including @Zcash, @zodl_co, @ZcashFoundation, @ValarGroup, @ShieldedLabs, @TachyonZcash, and @ZcashCommGrants, for taking security seriously and rewarding researchers, and to the entire Zcash community for all the support.
I’ll keep doing my best to find more bugs.
anyone working on the cutting-edge tech is in a serious bubble
i was talking with a dev friend the other day - he works on an enterprise product
he said AI helps him a bit, but not much
in his own words - "i can still write code with approximately the same speed as AI"
now he's not dumb or anything, but the processes most big orgs use are so slow and outdated that you don't have the need to write code at super-fast speed. You're just being bottlenecked by a hundred different things
this is who we're competing against
with AI you can generate ideas, build skills, write articles, and build products with unprecedented speed
yet if you look around, the output of most people is the same
leads to a very simple conclusion
the bottleneck was always:
- agency
- taste
- courage
- the ability to fight inaction and overthinking