Mx (beta)

I got a Bug Bounty 🎉 on @xyz_remedy hunt.r.xyz/confirmed-as-v…

@0x3b33 same old story, they probably refused to pay up

My guy hacked Cosmos and shared the bug on X

@adeolRxxxx You drive a Ferrari ?

I took my mom on a date today, she was so happy. I also got to relax after some heated private audits back to back. Motion can’t be stopped. Back to xrp.

@lonelysloth_sec @m4rio_eth true and scary

That's the whole point. Go "AI native". Be rug pulled by the duopoly (at best, if you can work with either). If the entire world changes processes to depend on them their valuation sky rockets. Doesn't matter what value is delivered. They can charge whatever they want. They basically own all businesses.

I was raising exactly this problem a few posts on my timeline, business start being super dependent on claude/OAI it’s not anymore your business.

I don't know what happened to @immunefi but they are partly responsible for the surge in hacks in 2026. People may want to submit a critical vulnerabilities and you are asking them to submit KYC information first ? to limit "spam". What happens if they don't want to ?

"Thank you for your time".

web3 security is the only place where protocols and companies act like they are doing people protecting the industry a favor. The beatings will continue until morale improves.

What incentives do web3 researchers have to submit vulnerabilities ? @immunefi :KYC, banning, deposit to submit, ghosting @code4rena : KYC, submission limit Protocols: fix and lowball Protocols need researchers, real money is at stake, this industry is a joke. DeFi will die

Protocols are now building with AI and barely understand their product.

*** Biggest Contest of all time *** $500,000,000 Conditional Pot : Unlock full payout by draining the entire protocol, it's current blockchain infrastructure and find the founders long lost nephew. Otherwise the pot is $6,300.

They're calling it the most conditional contest of all time, where the protocol basically gets a free audit. Are you guys not tired of these stupid games

If you're a security researcher or Solidity dev who: 1) has good product sense 2) enjoys talking to customers DM me Hiring for a few different roles that could be a good fit

the figures referenced in the post are entirely misleading. There was no impact realized from this issue. Zero user funds were affected and zero addresses were compromised. My response: Are you suggesting I should have actually exploited the bug and caused real damage before coming to talk to you? For the stated vulnerability to work in practice, it would require execution of several suspicious transactions that would have an extraordinarily limited impact. My response: You should know better than anyone that on a Cosmos-based chain, a single transaction can pack multiple messages. Just one transaction is more than enough to completely drain multiple whale accounts. Injective has dynamic rate limiting functionalities which are applied automatically based on our live monitoring systems. This functionality has been live on mainnet since last year and is publicly available in our code base. My response: First, this has nothing to do with the vulnerability itself. Rate limiting doesn't stop attackers from stealing funds. It only slows them down when they try to bridge those funds over to Ethereum. Second, when I submitted my report, the mainnet configuration for this feature was not set. In other words, this feature wasn't even turned on! In addition to all of the above, this report was reviewed against the clearly defined terms of our Immunefi program. Based on those terms, issues such as those raised in this report that DO NOT impact block production or consensus are categorized outside of the Blockchain/DLT tier and carry a maximum payout of $50,000. My response: First, Immunefi has always put the impact of direct fund theft at the very top of its priority list. This is a fact that everyone knows. Second, you changed your bug bounty page after I submitted my report. Here’s the snapshot from November 8, 2025: web.archive.org/web/2025110816… . And now, there’s an extra line added to your bug bounty page: “IMPORTANT: Within the Assets in Scope table, the injective-core folder is listed for both Blockchain/DLT and Web/App due to overlap between the two within the same folder. However, for a report to be categorized as Blockchain/DLT, the resulting impact has to be directly involved with the block production process or with consensus failures. All reports not dealing directly with either of these are to be categorized as Web/App.” I’d really like to know when this line was added. and do you really value chain consensus more than users' funds? We remain committed to fair, transparent, and consistent handling of all reports, and to maintaining the highest standards of security for the ecosystem. Injective has done so since its mainnet inception in 2021 and will continue to do so in perpetuity, always putting builders and security first. My response: You never even replied to my messages, and now you’re blaming me for not requesting mediation? I can post the original report if you agree. I left many messages, but you haven't replied to a single one. ---------- Finally: Stop making excuses from every angle and trying to use technical jargon to confuse people who aren't developers. That doesn’t work anymore these days. Anyone can just ask an AI to fact-check what both of us are saying. I have no ill intentions toward your project. All I'm asking is for you to be honest and handle this transparently.

2026 has been mostly white hats disclosing critical severity vulnerability for free.

The era of smart contract auditors is just beginning

Human knowledge is the most precious thing we have. From childhood savants discovering numerical manipulations to the theoretical chemist who died in penury and obscurity. Training AI to paraphrase and regurgitate this information then calling it intelligence, is a sin.

"Pattern matching" is absolutely new in web3 security right ? Because that is all AI is capable of at the moment

Audit Wizard and @ChaseTheLight99 have done this already a long time ago btw, these snake oil salesmen are going to run many protocols to the ground

so much deceit in LLM marketing, especially exaggerated as it is geared toward technical users that are lagging behind and very easy to impress

Nobody wants to tell the truth, but AI is terrible with reasoning.