Pinned Tweet
+$7.5k for a valid Medium bug from a self hosted program.
Lots of work going on underground.
More coming btw this was inspired by my guy @only01Essential 🫡
Lots of work going on underground.
More coming btw this was inspired by my guy @only01Essential 🫡
39
5
210
5,259
Been getting lots of duplicate lately, 2 Criticals, 2 High, 1 Medium.
One was a direct theft of 8 figures can't disclose idk why team hasn't fix it yet.
I hate dups asf. Nevertheless we keep pushing.
One was a direct theft of 8 figures can't disclose idk why team hasn't fix it yet.
I hate dups asf. Nevertheless we keep pushing.
4
0
26
894
All 3 issues has been verified and fixed by the team.
Pending $100k bounty if team keeps to their word.
Pending $100k bounty if team keeps to their word.
- Been going on zk protocols.
- Reported 2C on HackenProof. Both valid dups lol.
- now 4C on another protocol below, 1 left.
- @schaliasosvons great zk resources helped me.
Soundness and completeness issues are scard of me rn.
9
3
91
4,366
@alignedlayer @diego_aligned And for anyone wondering @alignedlayer is a ZK-focused project, so this one feels especially meaningful to me.
Been in the ZK trenches for a while. Today is just another milestone. 🫡
Been in the ZK trenches for a while. Today is just another milestone. 🫡
0
0
0
133
BoyD (rtrd/acc) retweeted
Critical vulnerability in the bip322 Rust crate: BIP-322 proofs for P2WPKH and
P2SH-P2WPKH addresses could be forged with any attacker key. Full
address-ownership bypass. Fixed in 0.0.11, affected versions yanked. If you
verify Bitcoin address ownership, please upgrade now.
P2SH-P2WPKH addresses could be forged with any attacker key. Full
address-ownership bypass. Fixed in 0.0.11, affected versions yanked. If you
verify Bitcoin address ownership, please upgrade now.
3
70
260
123,420
- Been going on zk protocols.
- Reported 2C on HackenProof. Both valid dups lol.
- now 4C on another protocol below, 1 left.
- @schaliasosvons great zk resources helped me.
Soundness and completeness issues are scard of me rn.
- Reported 2C on HackenProof. Both valid dups lol.
- now 4C on another protocol below, 1 left.
- @schaliasosvons great zk resources helped me.
Soundness and completeness issues are scard of me rn.
5
4
41
6,839
My report could've prevented this, but the team was careless and disrespectful to me when i reported it. I'm not sorry for them.
The exploited vulnerability was patched and borrowing is currently paused as a precaution. As of now a $570,000 deficit exists . Securing user funds is the number one priority. We are working on figuring out the next steps.
DefiTuna AMM remains unaffected.
3
0
34
2,441
BoyD (rtrd/acc) retweeted
@CertiKAlert @DeFiTuna LOL, similar to the Critical vulnerability i reported to the technical team 2months back, they cuss me and said it was garbage!
Proof: gist.github.com/destinyae/83e6…
x.com/i/status/20782…
Proof: gist.github.com/destinyae/83e6…
x.com/i/status/20782…
2
1
6
1,048
BoyD (rtrd/acc) retweeted
Been wanting this to exist for a while, so I built it.
ProofOfRep, a reputation board for bug bounty programs and contests.
Report your unfair or dishonest experiences, with proof, and I'll manually review everything.
Hope it helps SRs focus on projects that actually take security seriously.
Still early. Let me know if this sucks or if it's useful. All feedback welcome.
proofofrep.xyz
ProofOfRep, a reputation board for bug bounty programs and contests.
Report your unfair or dishonest experiences, with proof, and I'll manually review everything.
Hope it helps SRs focus on projects that actually take security seriously.
Still early. Let me know if this sucks or if it's useful. All feedback welcome.
proofofrep.xyz
15
31
171
15,135
BoyD (rtrd/acc) retweeted
Currently experimenting with a new type of web3 security contest. All web3 Projects will love this one.
Trying many things and failing a lot right now, but learning fast. The existing solutions lost their glory a while ago, but the talent is still there - seeing an opportunity🙏
Trying many things and failing a lot right now, but learning fast. The existing solutions lost their glory a while ago, but the talent is still there - seeing an opportunity🙏
25
21
196
8,004
Probably last time I'll personally disclose an issue to a protocol, of bounty platforms. Tomorrow you come online to claim you care about security. Bro did not even care to read the issue because it's not @_SEAL_Org.
So impatient and uninterested.
@aandooor @zygbaeth
So impatient and uninterested.
@aandooor @zygbaeth
15
3
32
4,957
@_SEAL_Org @aandooor @zygbaeth This is why i insist on talking to the technical team, coz these guys are a bunch of mods/admins that doesn't understand the value of securing people's money, they just stay on discord all day, sell a protocol they don't even understand, posing like they even care about the tek.
0
0
5
701
BoyD (rtrd/acc) retweeted
Many people have claimed that with AI-assisted bug finding, secure code (and hence trustless anything) will be impossible.
I have a much more optimistic take, and AI-assisted formal verification is a major part of the reason why:
vitalik.eth.limo/general/2026/0…
I have a much more optimistic take, and AI-assisted formal verification is a major part of the reason why:
vitalik.eth.limo/general/2026/0…
448
392
2,523
476,434
BoyD (rtrd/acc) retweeted
@storming0xhe technology to detect these kinds of exploits at scale with high confidence and low cost for years. No AI needed.
Just well-written static rules, not the generic ones that come with the tools.
The only problem is that good actors have no incentive to run such a service across all contracts, since the majority of those projects don’t offer any bounties.
On top of that, it’s usually difficult to contact the contract creators and establish proper communication channels.
Only blackhats are really incentivized to scan and monitor all codebases at scale.
Just well-written static rules, not the generic ones that come with the tools.
The only problem is that good actors have no incentive to run such a service across all contracts, since the majority of those projects don’t offer any bounties.
On top of that, it’s usually difficult to contact the contract creators and establish proper communication channels.
Only blackhats are really incentivized to scan and monitor all codebases at scale.
0
3
30
7,570
