Plair
48 posts
Just woke up after an urgent surgery… pray for me fam.
English
Now that we have run through both cycles, which do you think was more fun. be honest
English
If you want to more learn about:
- Building
- Auditing
- using AI Agents for audits
- Launching your own Project with the eMBA course.
Check this out:
academy.zealynx.io
@TheBlockChainer
Bloqarl | Zealynx@TheBlockChainer
After 6 weeks with 44 early builders, Zealynx Academy is public today 🥳🥳🥳🥳🥳🥳 A platform to help Web3 founders build secure protocols and grow them into real businesses. Four things inside: - Guides to fork DeFi protocols with awareness - Security training to build safer Smart Contracts - MBA-level knowledge to grow your protocol into a business - Interactive guides to build your own AI Agents to help you grow your company academy.zealynx.io
English
Resources used:
updraft.cyfrin.io/courses/full-s…
Tornado cash rebuilt in a foundry repo: github.com/nkrishang/torn…
Understanding TC in detail rareskills.io/post/how-does-…
How to generate/create your ZKP: youtube.com/watch?v=3Gd3E9… youtube.com/watch?v=ZuwUFN…
YouTube
YouTube
English
devfolio.co/projects/edenp…
This was not possible with the public education & information shared from @PatrickAlphaC @CyfrinUpdraft @luishsoares @RareSkills_io
Free & Accessible education material really pushes this space forward.
English
Hot take: stop relying so much on Claude and start using your DAMN BRAINS more
I will not elaborate, but the QUALITY is going down A LOT. It's not sensitive, it's a BIG change. Instead of hunting for vulnerabilities and exploits, it feels like I'm doing QA ...
Some don't even know what their code does and have NO CLUE how to fix it. I should start adding myself as a co-author for some of these, ngl
English
Over the weekend I’ve had two friends reach out contemplating suicide after getting liquidated and I found out my brother lost what he had left in crypto on Polymarket 15 minute up/down markets
Wake TF up
Trading wasn’t enough -> we invented 100x perps and built binary up/down markets
4% increasingly risk-free yield for anyone in the world wasn’t enough -> we push out further on the risk curve and ask DeFi protocols to actually be custodial to cover it up
While certainly manageable by experts, for 99% of people this never ends well
Cryptopunk, DeFipunk, our best bet of realizing this vision is that AI has better decision making and management skills than we do, and uses this tech for enabling the financial revolution we so wanted
Alexander Leishman 🇺🇸@Leishman
English
I Saved Injective's $500M. They Pay Me $50K.
I like hunting bugs on @immunefi . I'm decent at it.
- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)
Life was good. Then I found a Critical vulnerability in @injective .
This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.
I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.
Then — silence. For 3 months. No follow up. No technical discussion. Nothing.
A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.
I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.
I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.
Full Technical Report: github.com/injective-wall…
English
Happy belated Christmas!
Sorry for the missed messages, I was not well.
What happened:
- Got tonsil infection start of the month
- Kept working with fever while taking pain meds & antibiotics like candy.
- Friday night I wake up and I can't breathe.
- Can't open my mouth, can't talk. Breathing through the nose works but laborious.
- I try and figure out what on earth is happening. After a few minutes I notice nose breathing is taking more and more effort, I need to get to a hospital fast.
- Can't talk so calling ambulance is not an option. Writing it out for my wife so she can call might work but that takes time. Do I have the time? I don't know.
- Get in the car and drive to the nearest ER.
- Arrive at hospital, nurse sees me and presses a button. 2 policemen come out and help me in a bed (no idea why policemen).
- Get rolled to different rooms, machines, tests, bright lights, masks, darkness (things are a bit fuzzy).
- Wake up in a bed. Throat hurts but I can breathe. Cool!
- Doc comes by and explains a massive abscess had developed in my tonsil and spread the infection to the throat, blocking airflow. They cut it open and drained it. Minor procedure in essence but quite urgent.
- Spend a week hooked on an IV antibiotics drip.
- Exit conversation with doc. I ask her if I can start working next week. She gives me a death ray eye glare and a 20m speech on how I might as well reserve an ICU bed for the month if I'm going to be this stupid.
- Rest of the month I'm just sleeping and trying to relax
So yeah, small infections can become somewhat problematic it seems.
I'll be back on regular updates & respond to messages from January onward.
English
@dani3l526 @hrkrshnn Who delayed the payout i wonder.. as on other platforms there were no such delay with OP payouts.
English
@hrkrshnn please fix cantina
TrustSec@TrustSecAudits
Decided to give Cantina a try last October, 8 months later results are finally out... Tens of solo findings in 1st Java audit and outperforming top Cantina leaderboard bros by 3-7x feels pretty good, not gonna lie. It's a shame the post-audit experience was so terrible I vowed never to return to that platform. *justified rant warning* - 8 months resolution time, as of writing - bounty still not sent. - Tens of hours spent escalating and defending submissions from wrong verdicts. - Counted ~ 104 judging mistakes (wrong dupes, clear invalids, wrong severity) that have been corrected. More that haven't. - Value loss of ~$110,000 due to resolution taking 7 months longer than it should and OP token tanking its way down to ~50 cents. Sure, when competing in non-USD contest pots fluctuations are an accepted risk. But 8 months of judges being incompetent and not being able to wrap up a contest was not part of my threat model. During the C4 judging days I would fully process 1000 findings in under a week (solo), OP-Java had 360 and multiple judges. It comes as no surprise that Cantina never announced on socials the results unlike 5 other contests that completed this week, certainly couldn't be the case that they wanted to avoid bad press or highlighting TrustSec dominance, right? It's a shame that we have to continue discussing bounty platform malpractices instead of critical bugs, but there is no other choice except keeping everyone accountable. A rant-free technical breakdown post for the solo finds will be coming shortly.
English
@0xnirlin @tapioca_dao seems to be:
hacked -> refactored the protocol -> dead silent on dc and twitter (only updates through chats),
thats it basically.
English
What happened to @tapioca_dao? last post was in December.
English
@GalloDaSballo Looks nice,
only thing i notice is the `Why Recon` section has too many squares,
maybe max 3-4?
English
There is a LamboWin contest going on at @code4rena right now. IMHO this is a great contest and protocol! Experienced auditors can make money and for beginners it will be super useful as you can learn how to:
- Track msg.sender between contracts
- Track token flow ETH/VETH/Lambo
English