ControlZ

Another milestone on our @immunefi journey! But I’m not settling — most whitehats at this level have already hit $1M. We still have work to do to earn this spot truly, and we will get there. Mark my words 🫡

@jvst_tammy Sure

@ControlZ_1337 this actually makes me want to ask you a couple of questions about how you think about auditing vs building trade-offs. cool if i dm?

Why did no one tell me building an open source project is this much work? With an internal tool, you know the users. It can be a little weird, opinionated, and full of shortcuts - as long as it works for you. With open source, you have to think about every edge case, every way someone might shoot themselves in the foot, every confusing UX decision, every missing feature, every undocumented assumption... and then realize someone will still use it in a way you never imagined.

In the competition? The workflows performed really well. If anything caused us to miss issues, it was me - not the workflows. There was a delay between a workflow finding a vulnerability and me actually reporting it on Immunefi. I intentionally didn't automate the reporting process because I wanted to manually verify every finding and make sure we only submitted high-quality reports. The downside was that it created a backlog of vulnerabilities waiting to be reviewed. By the time I got to some of them, they had already been patched - either because another researcher reported them first or because the project's team found and fixed them internally. So I ended up missing the reporting window on quite a few issues. If every finding had been reported the moment the workflow discovered it, I'm pretty confident we would have ended up with significantly more valid reports.

@_blockian @ControlZ_1337 @Kritt_AI What did the workflows miss, anything you expected them to catch?

Confession time: @ControlZ_1337 didn't manually review a single line of code in this competition. Everything was done through custom AI workflows that we built and orchestrated using our own platform: open·kritt. And as the name suggests, we're open sourcing it. @Kritt_AI We're planning to release it this week (hopefully), so if you don't want to miss it, go follow @Kritt_AI for updates. Our hope is that open·kritt helps more researchers build powerful AI-assisted security workflows and ultimately makes the Web3 ecosystem more secure :)

Great question! Regarding motivation: I'm aiming for more than just bug bounties in the long run. I don't plan on being a bounty hunter forever - I want to build products as well, and this is a great opportunity to gain experience while creating something useful. If, on top of that, it helps the community and makes the Web3 ecosystem safer, that's a win for everyone. As a user and member of the community myself, I benefit from a more secure ecosystem too. I can't personally defend every protocol at once, but hopefully this can help others do that. Regarding our edge: We have a long list of internal workflows that we use today. We won't be open sourcing all of them, because we do want to preserve some of our competitive advantage. That said, we're also not going to publish low-quality or only examples. The workflows we do release are ones that have already proven themselves - they've helped us land multiple five-figure bounties and even a six-figure bounty. Some of our more advanced workflows will remain private, but we think what's being released will still be genuinely valuable to the community. Hope this answers your question :)

@_blockian @ControlZ_1337 @Kritt_AI What's the motivation behind open sourcing it? It's your edge in such competitions.

@jvst_tammy This is what makes auditing fun and development hard if you ask me 🤣🤣

@ControlZ_1337 this is basically what makes auditing hard too. anticipating the user who will use it in a way you didn't design for

Small correction 😅 Looks like I wasn’t 100% clear. open·kritt isn’t available just yet! We’re putting the finishing touches on it and fixing the last few bugs before release. (Should be in a couple of days) In the meantime, you can join the waitlist by leaving your email and we’ll notify you as soon as it’s live.

@merbie40 @Kritt_AI @_blockian Will be available soon 😁

@Kritt_AI @_blockian @ControlZ_1337 Patiently waiting ... TIA ! 🙏🏻

Kritt is coming by @_blockian @ControlZ_1337

@jaczkal @_blockian @Kritt_AI Give it a few days

@_blockian @ControlZ_1337 @Kritt_AI I don't know man, I have still 404 on the repo

@TheTradMod @_blockian @Kritt_AI It is not public yet :) Will be in the coming days

@_blockian @ControlZ_1337 @Kritt_AI congrats, this is awesome! the gh not available ser @ControlZ_1337

@jaczkal @_blockian @Kritt_AI It is not public yet

Here it comes @Kritt_AI

@xKeywordx Damn 🤯 how the tables have turned

@ControlZ_1337 Sounds a lot like writing a protocol with open-source code and others breaking it :))

Remember these names. They were the pioneers, the alpha testers, the first ones. @_blockian @infosec_us_team @csanuragjain @behroznathwani @skshadan_ @0xiamkunal9 super grateful to be able to collaborate with you all again.

Today, we're excited to announce the launch of CertiK Hunt - our new invite-only platform connecting elite security researchers with trusted Web3 projects. CertiK Hunt brings together bug bounty programs, audit competitions, and AI security challenges in one place. 🧵👇

@savantchat Of course :)

@ControlZ_1337 Please tell me the false positive filtering is in there and not just the bug generation side

I think this finding is a good opportunity to announce something we’ve been working on. We’re currently cooking up an open-source project that’s essentially a public version of the internal system we use to leverage AI for vulnerability research and finding bugs (like this one). Stay tuned 🙂

@onebusinessclub Yeah it is a concern, I believe we will figure something out

@ControlZ_1337 Public version sounds dangerous, in the best way.

@csanuragjain @immunefi Your move :)

@ControlZ_1337 @immunefi 😭

We never doubted you for a second.