Sabitlenmiş Tweet
🚨 SECURITY ALERT: A critical logic vulnerability persists in @RujiraNetwork Ghost Vaults despite their recent "patches".
The protocol remains insolvent and user funds are at high risk. 🧵👇
English
Mohamed Elsaed
215 posts
Mohamed Elsaed
@MElsaed14410
باحث في الأمن السيبراني | مهتم بأمن العقود الذكية (Smart Contracts) واكتشاف الثغرات البرمجية | مؤمن بأهمية الكشف المسؤول (Responsible Disclosure) لتعزيز الأمان
Katılım Nisan 2026
12 Takip Edilen8 Takipçiler
@xxxxataraxiaxxx @patriotsounds @fincontrarian @codehans1 @CBarraford @AaluxxMyth "@xxxatariax... I've sent the full report and the PoC to Hans as requested on June 18 and followed up on June 20. Still haven't heard anything back from him. I've done my part, just waiting for a response to make sure the users' assets are safe."
English
@MElsaed14410 @patriotsounds @fincontrarian @codehans1 @CBarraford @AaluxxMyth Can you disclouse? Be honest with hans, he has years doing the code, if is real just send the whole information!!
English
⚡️ Half of all THORChain node operators have already upgraded to v3.19.1.
The network is moving steadily toward restart, with security fixes deployed, vault protections strengthened, and the community focused on getting it right rather than rushing it.
After weeks of testing, patching, audits, and stress-testing, we’re getting closer to the moment every THORChad has been waiting for.
The rejuvenation of @THORChain is no longer a question of if — only when. 🛡️⚒️
Stronger security. Stronger infrastructure. Stronger community.
The Dex of DEXes is preparing for its next chapter. 🚀
#THORChain #RUNE #DeFi #THORChads 🫡🔥
English
@patriotsounds @xxxxataraxiaxxx @fincontrarian @codehans1 @CBarraford @AaluxxMyth "Code is neutral. It doesn't know you, it doesn't know me—it only knows if it's secure or exploitable."
English
@patriotsounds @xxxxataraxiaxxx @fincontrarian @codehans1 @CBarraford @AaluxxMyth "I reported a critical logic vulnerability in rujira-ghost-vault (asset inflation/drainage). After submitting a verified PoC, I was blocked rather than the issue being addressed. As a security researcher, my ethical duty is to warn users before potential exploitation."
English
@patriotsounds @xxxxataraxiaxxx @fincontrarian @codehans1 @CBarraford @AaluxxMyth "@patriotsounds I enjoy the sound of gunfire in the technical arena. The tracer round has been fired; final forensic PoC submitted to hans@rujira.network at 22:26 UTC. The exploit is documented, and the ball is in their court. No bluffing, no spam—just protocol security."
English
@Erudite3451 @RujiraNetwork "The PoC sent to your email hans@rujira.network is what matters, not old screenshots. The technical report and reproduction script are in your inbox. Waiting for your assessment of the vulnerability."
English
@MElsaed14410 @RujiraNetwork We have reviewed the PoC and it's an invalid finding, and user funds are not at risk
English
🚨 24h of silence from @RujiraNetwork on the critical logic vulnerability.
User funds are at high risk. Ignoring this increases the danger. The community deserves transparency.
🛑 إنذار أمني: الصمت تجاه هذه الثغرة يعرض أموال المستخدمين للخطر. نحتاج ردًا الآن.
Mohamed Elsaed@MElsaed14410
🚨 SECURITY ALERT: A critical logic vulnerability persists in @RujiraNetwork Ghost Vaults despite their recent "patches". The protocol remains insolvent and user funds are at high risk. 🧵👇
@fincontrarian @codehans1 @patriotsounds @xxxxataraxiaxxx @CBarraford @AaluxxMyth "Standard practice is ensuring the team is aware. I published the PoC for transparency and have sent all technical details to their official email as requested. Now, the priority is fixing the flaw, not debating protocols."
English
@codehans1 @MElsaed14410 @patriotsounds @xxxxataraxiaxxx @CBarraford @AaluxxMyth What is the common practice of checkin such "glitches" or "vulnerabilities" if they are even close to true?
English
@patriotsounds @xxxxataraxiaxxx @fincontrarian @CBarraford @AaluxxMyth "Thanks @codehans. I have sent the full technical audit report, including the reproducible test case (PoC) and methodology, to the email address provided. Looking forward to your technical review of the logic flaw."
English
@patriotsounds @xxxxataraxiaxxx @fincontrarian @CBarraford @AaluxxMyth "Security isn't about followers, it's about code. Logic flaw in distribute_interest misallocates fees to the pool, not the fee_address.
If I'm wrong, show a Tx log where fees reach the fee_address. Otherwise, the risk is real.
gist.github.com/me749397-coder…"
English
@patriotsounds @xxxxataraxiaxxx @fincontrarian @CBarraford @AaluxxMyth "Calling a PoC 'spam' to hide a critical flaw is dangerous. I shared the exploit details via Telegram. Ignore the proof, but the bug persists in production, risking user funds. I'm here for security, not bounties. Fix it or explain."
English
@fincontrarian "Everything is documented with timestamps and technical evidence. You can verify the full history of my reports to the team and their responses here: t.me/c/4458819593/2"
English
@fincontrarian "I reported a logic bug via Telegram (see screenshots). They patched the first issue, but a severe one in Ghost Vaults persists, putting funds at risk. Despite responsible disclosure, I’ve been met with silence. Transparency is a requirement."
English
@THORChain @xolosArmy @KentonC137 @patriotsounds "Critical security update for Rujira LPs. Proof of exploit attached below."
x.com/i/status/20664…
Mohamed Elsaed@MElsaed14410
"Visual Proof: My PoC (v1.0.3) successfully triggers the insolvency state. The core logic flaw remains fully exploitable in production. Liquidity providers, please check your exposure."
English
⚡This Saturday on the THORChain Podcast | Ecosystem Spotlight.
@xolosArmy joins @KentonC137 and @patriotsounds live at 10AM EDT / 2PM UTC.
xolosArmy empowers users with digital identity ownership, verifiable heritage, and participation in a decentralized, community-governed ecosystem.
Jump on stage and ask your questions live: riverside.com/studio/thorcha…
English
@30bgHitman @RujiraNetwork "I'm a researcher, not an attacker. My goal is to improve security, not exploit it. If they 'don't want to fix it,' that's their choice—but the community must know the risks. I act ethically, even if they don't."
English
@MElsaed14410 @RujiraNetwork Since they don’t want to fix it how about you exploit it
English
🚨 SECURITY ALERT: A critical logic vulnerability persists in @RujiraNetwork Ghost Vaults despite their recent "patches".
The protocol remains insolvent and user funds are at high risk. 🧵👇
English
Over a week since I reported a critical liquidity-draining flaw to @RujiraNetwork. No fix, no response—just silence & blocking.
If Ghost Vaults are 'secure', why ignore a verified vulnerability? Transparency builds #DeFi trust. 🛡️
#
English
Blocking researchers instead of fixing flaws is a massive red flag. 🚩
@CertiK @HackenClub @THORChain, take note.
If you have liquidity in @RujiraNetwork, pay attention. RT to protect the community. The truth must be seen. 🛡️
#DeFi #SecurityAlert #Rujira #BugBounty #Web3
English
The vulnerability lies in the interest distribution logic, making the contract insolvent. My PoC confirms that assets can be drained entirely.
Despite my private warnings on June 6th and subsequent updates, the team has failed to apply a proper fix. 2/3
English
🚨 Security Alert: @RujiraNetwork
I’ve identified a critical flaw in Ghost Vaults allowing liquidity drainage.
I reported it via their official Bug Bounty, but the team chose to ignore the risk and block me instead.
Community funds are at risk. Check the evidence below. 🧵 1/3
English
@Fakk2 @THORChain @vultisig "Critical security update for Rujira LPs. Proof of exploit attached below."
x.com/i/status/20664…
Mohamed Elsaed@MElsaed14410
"Visual Proof: My PoC (v1.0.3) successfully triggers the insolvency state. The core logic flaw remains fully exploitable in production. Liquidity providers, please check your exposure."
English
Forget #centralized #exchanges, prefer #decentralized #finance.
Use @THORChain; use @vultisig and other partners.
Forget the banking lobby, kick them all out, for a fairer world.
Don't repeat our mistakes, do better, and listen to your elders! =)
$RUNE $RUJI $VULT +++
asparagoid 🐂🀄️@asparagoid
If you could give a 2 hour talk to the world, as a last message before your death, what would it be? How would you distill the wisdom, understanding, realizations from your life, for others to benefit from? How much do we carry hidden that we have not found a way to give to all
English