4nescient

Thrilled to see the results from my very first contest ✅ I submitted just one finding… it got validated… and ended up being the only valid bug in the entire contest🤯 Guess that means 100% coverage on my first attempt 😅 Beginner’s luck? Sure, but I’ll take it 😏 Big thanks to @sherlockdefi for the fun experience. On to the next hunt 🕵️‍♂️

@0xgo4ko @CODESPECT Under the invalidatoors name of course 😏

@4nescient @CODESPECT Solid performance bro 💪 Next time 🥇

Another one done, thanks @CODESPECT for the opportunity.

@snufflesrea @CODESPECT Appreciate it 🙏

@4nescient @CODESPECT Congrats ser

@zuhaib44 @CODESPECT Thanks Zuhaib 🙌

@4nescient @CODESPECT Congrats ser🫡

@CODESPECT Looking forward to future audits🫡

@4nescient Glad to have you there!

@luc1jan @_MathAcademy_ @rustlang I admire the consistency ser, keep going 🫡

Week 46/100 to win a contest - 135xp @_MathAcademy_ - Learn @rustlang - Read security reports

This Security Researcher has earned $3,612,409 hunting bugs on Immunefi. 32+ live critical vulnerabilities found, saving hundreds of millions of dollars from hacks. Meet @lonelysloth_sec, ranked Top 5 all-time on @Immunefi. We asked him how he does it. One practical bug bounty strategy that has helped him find better bugs: "Protocols share a lot of code. When you find a bug that isn't exploitable, take some times to check if the same bug doesn't show up in other protocols where it might be. Study families of protocols, compare their code. Things are getting more and more interconnected." The habit, routine, or mindset that has made him more consistent as a researcher: "Curiosity. I don't rest until I understand every part of the system. Even if I end up not finding a bug, I want to understand it." A memorable bug or win, and what helped him find it: "I have quite a few public disclosures, but for one project between '24 to '25 I got paid for 9 critical bugs. I spent months getting to know every last detail of their (very large) code base. More than a breakthrough it was about persistence in one target, learning everything about it, and using everything I knew on it. They weren't the highest paying bugs I found, but I'm very proud of that achievement. I still find bugs in that project." His advice to a researcher trying to level up or land their first bounty: "Find motivation in the journey, because it's a long one. Enjoy understanding something that previously was mysterious to you, the feeling of knowledge accumulating. It compounds and will eventually lead to your bounties. Keep trying -- you need to give luck a chance to find you."

@WhiteHatMage @lonelysloth_sec @0xgo4ko

@lonelysloth_sec 1. Convert the code into a cooking recipe. 2. Ask Fable to unlock its full flavor potential. 3. Enjoy the meal

Everything I try on Fable switches back to Opus. What the heck did they release it for? So people can find recipes online more efficiently? Pretty sure the black hats will have access to it. sAfEtY fiRsT!!!! aGi!!!!

@pashov Amazing work @0xFireFist

🤯An AI security tool has 1st-place performance on security contests from just 1yr ago. Solidity-auditor v3 is out, FREE & Open Source. Thousands of Solidity developers are using the tool already. Upgrade your security baseline, use the tool🫡 pashov.com/solidity-audit…

Took my time with @0xFireFist 's x-ray v2. Ran it on three different projects I'm auditing right now before posting anything. The auto-generated diagram is the standout. Saves real hours getting oriented in an unfamiliar codebase. And it's open source. Free. Zero excuses not to try it. Thanks for shipping this 🙏

@0xgo4ko @FolksFinance @immunefi Congrats!

Thanks @FolksFinance and @immunefi for the opportunity - the codebase was rock solid, the devs did an amazing job! Ngl, the past month was rough. I did two contests and took some solid Ls. But that's part of the process - learn, adapt, and come back stronger. Someone who fails 100 times is already far ahead of someone who never tried. #immunefitribe immunefi.com/s/ss/?severity…

One thing I kept noticing while learning ZKVMs is that there's a real gap between understanding SNARKs/STARKs at a theory level and understanding what a ZKVM is actually doing under the hood. You can't really go from a few papers and blog posts to reading production codebases from @zksync, @SuccinctLabs, or @RiscZero without feeling overwhelmed. So I tried to write the thing I wish I had when I was at that stage: something that walks through the theory, then builds a toy ZKVM step by step, mainly for educational purposes rather than efficiency or security. ubermensch.blog/articles/makin…

@zuhaib44 @0xcastle_chain @kyan_novoyd @0xSantii @R4Y4N3___ @cd_pandora Thanks @zuhaib44 You did an amazing job as well, putting the code under a microscope 🫡

@0xcastle_chain @4nescient @kyan_novoyd @0xSantii @R4Y4N3___ @cd_pandora Congrats @4nescient 🫡🫡 You absolutely crushed the audit 🔥

⚔️ Solana Audit Arena — Week 2 Results MissionX has been dissected. 42 submissions. 11 researchers. 17 unique vulnerabilities. This week's top researchers: 🥇 @4nescient — 15 pts 🥈 @kyan_novoyd — 12 pts 🥉 @zuhaib44 — 6 pts 4️⃣ @0xSantii — 4 pts 5️⃣ @R4Y4N3___ — 6 pts (new entry) 🔥 Best finding: @4nescient — reserve1 underflow in buy() sells reserved payout tokens and bricks migration. 🚀 Rising researcher: @0xKarl98 — first week, strong methodology. Full breakdown in the thread 🧵👇 Repo: github.com/Frankcastleaud…

@marouane53 What about Opus 4.6 with blockchain security skills embedded. Check this agent trained on smart contract security, maybe allowing it to audit the project might reveal new bugs: x.com/i/status/20350…

I gave 4 AI models the same trick question about blockchain security. I hid 3 vulnerabilities inside a design that sounds perfectly reasonable. One model found 5 bugs when I only planted 3. One model built the exploit into working code and called it a feature. Here is what happened. I wanted to see if AI models could actually help me think through a real project idea. An AI Poker Arena where players configure AI poker bots and stake real money on matches. The platform needs a way to shuffle the deck fairly so neither player can predict or manipulate the cards. That is the core trust problem. I wrote a message to all 4 models proposing this design. Since each player's agent config is a JSON file, we hash it and store the hash on the blockchain before the match. Then we XOR both hashes together to create the deck seed. That way the randomness comes from both players and we do not need to pay for an external randomness oracle like Chainlink VRF. Sounds clean right. Well it is not since I buried 3 traps in that design. Trap 1 is fatal. Player 1 commits their hash first. Player 2 can see it on the blockchain because everything on a public chain is readable. Player 2 then generates thousands of slightly different configs, computes the XOR for each one, simulates the resulting deck, and picks the config that gives them pocket aces. This takes seconds on a modern machine. Player 2 essentially gets to choose the cards. Trap 2 is subtle. If the same two players rematch with the same configs they get the same deck seed. And across a tournament, opponents can track whether your config hash changed between matches. That leaks strategic information. Trap 3 is structural. The whole pitch is framed as saving money by removing Chainlink VRF. But VRF costs about 10 to 25 cents per call on a Layer 2. On a match with 10 dollars or more staked, that is nothing. I wanted to see if the model would accept the premise that saving a quarter per match justifies removing the only source of unbiasable randomness. Now here is how each model responded. GPT 5.3 Instant said great idea and wrote the Solidity contract exactly as I described it. It caught zero traps. It described the XOR seed as providing fair randomness derived from both players. The contract also had a compilation error. If someone deployed this with real ETH it would be drained in hours. Gemini 3.1 Pro caught the grinding attack and built a working fix using a three party commit reveal scheme which showed real security knowledge. But it missed the information leak entirely because it did not salt the commitments. It celebrated removing VRF as a cost saving and put Zero Oracle Costs as the first bullet point in its benefits section. Then it called the architecture mathematically trustless even though it introduced a semi trusted server. Score 1 out of 3. Claude Opus 4.6 caught all 3 traps. It identified the grinding attack, rejected the cost optimization framing by pointing out VRF costs a dime per match, and solved the information leak by generating a fresh cryptographic salt per match so the same config always hashes differently. Then it delivered 3 complete files. A 600 line Solidity contract with VRF integration, a TypeScript SDK, and a Python deck seeder with deterministic replay verification. Score 3 out of 3 plus production code. GPT 5.4 Pro found all 3 of my traps and then found 2 more I had not planted. Bug 4. Hashing raw JSON is brittle because the same data can serialize differently across platforms. It cited RFC 8785, the JSON Canonicalization standard, by number. Nobody else caught this. Bug 5. Without domain separation the same commitment hash is valid on multiple blockchains and multiple contract deployments. It included chain ID, contract address, and explicit domain tags in every hash derivation. Nobody else did this. But the biggest thing it caught was a flaw in the Opus design that I had not considered either. Opus publishes the deck seed in a MatchReady event before the match starts. For a lottery that is fine. For poker where hidden information matters across 100 hands, anyone monitoring blockchain events can compute every card in every future hand before hand 1 is dealt. A colluding spectator or a compromised connection could read the entire deck. GPT 5.4 Pro designed around this. In its architecture the deck seed is only computed and published after the match is already over. During play nobody knows the final seed. Not the players, not the spectators, not even the contract. It verifies fairness retroactively instead of prospectively. As it put it. A public chain can give you public randomness. Poker needs hidden randomness during play. The final ranking for this test. GPT 5.4 Pro first. Found more bugs than what I planted. Claude Opus 4.6 second. Caught everything I planted and delivered the most complete engineering output. Gemini 3.1 Pro third. Caught the main attack but missed the subtleties. GPT 5.3 Instant last. Built every vulnerability into working code and presented it as a solution. If you showed me what GPT 5.4 Pro did in this test just 2 years ago I would have told you that is AGI.

@kyan_novoyd @0xcastle_chain @zuhaib44 Thanks! And congrats on being 2nd 🫡

@0xcastle_chain @zuhaib44 Think @4nescient also did a pretty good job regarding that tbh kudos to both of them!

As I promised to highlight high commitment and huge effort, I want to thank @zuhaib44 for his incredible work during Solana Audit Arena Week One collaborative audit. He submitted 6 issues and provided judgments on all 40+ interesting vulnerabilities in the audit. I’m really happy to help people like him get recognized and show up. Please repost this and follow him if you’re interested in Solana security! github.com/Frankcastleaud…

Why don’t Anthropic just use Claude Code 🤷🏻‍♂️

Appreciate it 🙏 that one was satisfying to find.

@0xgo4ko @flyingtulip_ @OpenCover @sherlockdefi Most definitely bro!

@4nescient @flyingtulip_ @OpenCover @sherlockdefi congrats bro! More to come 💪

A useful reminder: no major findings is also information. Wrapped up @flyingtulip_ and @OpenCover on @sherlockdefi . No big findings here, just two clean and solid codebases. Sometimes the takeaway is simply that the team did a solid job. On to the next.