TiraiFrontier retweeted
tbh trying to filter through 2,857 @colosseum Frontier Hackathon submissions is driving me insane. everything is super early stage, mostly just raw prototypes and devnet demos.
but while everyone else is hyping up the usual consumer apps, i’ve been quietly obsessing over the k. if we want real adoption and autonomous AI agents to live on Solana, on-chain privacy isn't just a gimmick, it's a literal necessity.
here are 4 low-key gems on my radar that are building early but hitting hard 👇 #ColosseumReview Race
but while everyone else is hyping up the usual consumer apps, i’ve been quietly obsessing over the k. if we want real adoption and autonomous AI agents to live on Solana, on-chain privacy isn't just a gimmick, it's a literal necessity.
here are 4 low-key gems on my radar that are building early but hitting hard 👇 #ColosseumReview Race
Solana @colosseum Frontier Hackathon product directory is live and Solana CTs are prepping their reviews.
Don't just write for free - Review & Earn by joining SagaPad’s #ColosseumReview Race to win $1,000 USDC! You're also helping Colosseum projects you like get discovered on X and ote tweet this announcement with your review, hashtag #ColosseumReview, tag project handles, & drop the links in SagaPad community to claim applause.
We’re turning Colosseum project reviewing into a competitive sport:
🏆 $1,000 USDC prize pool
🏆 5 review tracks
🏆 For projects: Exclusive SagaPad builder perks for the top-reviewed and most-hyped
Let’s dive in 🧵
6
3
28
2,098
TiraiFrontier retweeted
4/ finally, keep an eye on @tiraifrontier. whitehat hackers keep our protocols safe, but the current bug bounty payout system is painfully slow, full of trust issues, and leaks sensitive identities. tirai is building an on-chain bug bounty platform on Solana to make payouts fast, private, and secure for security researchers.
they are using Cloak’s privacy protocol to shield the whitehats while leveraging Solana’s speed for instant payouts. it's a very specific security niche that usually gets ignored in flashier hackathons, so seeing a dedicated team tackle this is refreshing. they still need to prove they can get major protocols to adopt their flow, but fixing the ethical hacker UX is exactly how we harden the ecosystem long-term.
they are using Cloak’s privacy protocol to shield the whitehats while leveraging Solana’s speed for instant payouts. it's a very specific security niche that usually gets ignored in flashier hackathons, so seeing a dedicated team tackle this is refreshing. they still need to prove they can get major protocols to adopt their flow, but fixing the ethical hacker UX is exactly how we harden the ecosystem long-term.
2
1
7
343
Tirai win the @colosseum frontiers side track on @cloak_ag 🔥🔥🔥
The winners of the Cloak Track are here.
95 submissions. Builders from everywhere exploring what happens when privacy stops being a feature and becomes infrastructure.
The hardest part wasn’t finding good projects. It was choosing between them.
When there was a tie, we e winner per use case, to show how broad private payments can actually become.
🏆 1st: TENDR (@tendrdotbid )
Private RFP procurement where bids stay sealed until close, eliminating information leakage and preventing either side from cheating.
🥈 2nd: BIDO (@usebido )
Ad monetization for AI agents, where intent is privately detected and matched before the final purchase decision.
🥉 3rd: AEGIS (@aegis_ledger )
A privacy execution layer on top of Squads v4, routing multisig approvals through Cloak’s ZK infrastructure.
4th: TUMAR
A non-custodial family investment vault for the Kazakh diaspora, combining private payments with real-world asset exposure.
5th: TIRAI (@tiraiFrontier )
Private bounty payouts for security researchers, breaking the onchain link between deposits and withdrawals.
Honorable mentions: NORI, @DefundsFinance , @agio_network , @buildcoldstar , @usekixa , and GRAYBOX.
Massive respect to every team that shipped.
And to everyone who didn’t win this time: keep building. Cloak will continue supporting teams pushing privacy forward.
This is what the future of private payments looks like when builders take the problem seriously.
1
1
6
277
thank u so much @cloak_ag for proving that privacy and bug bounties matter on @solana @solana_devs
Tirai is just the beginning.
tirai-frontier.vercel.app
Tirai is just the beginning.
tirai-frontier.vercel.app
The winners of the Cloak Track are here.
95 submissions. Builders from everywhere exploring what happens when privacy stops being a feature and becomes infrastructure.
The hardest part wasn’t finding good projects. It was choosing between them.
When there was a tie, we e winner per use case, to show how broad private payments can actually become.
🏆 1st: TENDR (@tendrdotbid )
Private RFP procurement where bids stay sealed until close, eliminating information leakage and preventing either side from cheating.
🥈 2nd: BIDO (@usebido )
Ad monetization for AI agents, where intent is privately detected and matched before the final purchase decision.
🥉 3rd: AEGIS (@aegis_ledger )
A privacy execution layer on top of Squads v4, routing multisig approvals through Cloak’s ZK infrastructure.
4th: TUMAR
A non-custodial family investment vault for the Kazakh diaspora, combining private payments with real-world asset exposure.
5th: TIRAI (@tiraiFrontier )
Private bounty payouts for security researchers, breaking the onchain link between deposits and withdrawals.
Honorable mentions: NORI, @DefundsFinance , @agio_network , @buildcoldstar , @usekixa , and GRAYBOX.
Massive respect to every team that shipped.
And to everyone who didn’t win this time: keep building. Cloak will continue supporting teams pushing privacy forward.
This is what the future of private payments looks like when builders take the problem seriously.
0
1
5
173
al_f4lc0n found a $500M Critical in @injective. The fix shipped next day. The reward? 3 months of silence → 10% of promised payout.
Bug bounty payouts are slow and risky for whitehats. We built Tirai on @solana powered by @cloak_ag to fix it.
App: tirai-frontier.vercel.app
Bug bounty payouts are slow and risky for whitehats. We built Tirai on @solana powered by @cloak_ag to fix it.
App: tirai-frontier.vercel.app
@al_f4lc0n found a $500M Critical in @injective. The fix shipped next day. The reward? 3 months of silence → 10% of promised payout.
Bug bounty payouts are slow and risky for whitehats. We built Tirai on @solana powered by @cloak_today to fix it.
App: tirai-frontier.vercel.app
0
0
4
237
More on Tirai 👇
🎬 Demo: youtu.be/VN-GBcPeGVc
📊 Full pitch deck (video): youtu.be/CFLosti1l7Y
📚 Documentation: moai-3.gitbook.io/tirai-frontier
🎨 Slide deck: canva.link/hudgb0grbtveywj
Built for @cloak_today Hackathon 2026 · Frontier Track.
🎬 Demo: youtu.be/VN-GBcPeGVc
📊 Full pitch deck (video): youtu.be/CFLosti1l7Y
📚 Documentation: moai-3.gitbook.io/tirai-frontier
🎨 Slide deck: canva.link/hudgb0grbtveywj
Built for @cloak_today Hackathon 2026 · Frontier Track.
@al_f4lc0n found a $500M Critical in @injective. The fix shipped next day. The reward? 3 months of silence → 10% of promised payout.
Bug bounty payouts are slow and risky for whitehats. We built Tirai on @solana powered by @cloak_today to fix it.
App: tirai-frontier.vercel.app
1
1
5
325
TiraiFrontier retweeted
I Saved Injective's $500M. They Pay Me $50K.
I like hunting bugs on @immunefi . I'm decent at it.
- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)
Life was good. Then I found a Critical vulnerability in @injective .
This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.
I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.
Then — silence. For 3 months. No follow up. No technical discussion. Nothing.
A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.
I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.
I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.
Full Technical Report: github.com/injective-wall…
I like hunting bugs on @immunefi . I'm decent at it.
- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)
Life was good. Then I found a Critical vulnerability in @injective .
This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.
I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.
Then — silence. For 3 months. No follow up. No technical discussion. Nothing.
A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.
I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.
I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.
Full Technical Report: github.com/injective-wall…
508
528
4,659
1,853,803