theBugLifestyle

Commitment takes you there, consistency keeps you there! #thebuglifestyle #Web3

Running a bug bounty is so that you get more whitehats than black hats to look at your code regularly and submit issues that could be exploited. It’s not so you just gift random people money 😂 You can easily do a private audit/bug bounty for less than the 10% or 100% lost.

@LBacaj But then it leave some processes running on the back ground even though the output and task has gone way up

Something I appreciate about Open AI & their usage limits: they dont kill a running autonomous codex session mid way. Anthropic kills everything mid session. Even a running workflow w/ millions of fable tokens in progress gets burned, need to start it over later. It's terrible.

@0xcastle_chain Regular audit is the solution since the blackhat just needs one missed issue

Nobody inside the audit industry wants to say this, so I will: we are losing, and the data is not subtle. Three consecutive record years of theft is not bad luck. 2025 closed at $3.4B stolen. 2026 crossed $840M before June, with incident count up 70% year over year. Recovery rates collapsed from 21% to under 1% in twelve months. Whatever we're doing, the trend line has already graded it. And before anyone says "just get audited", Bunni was audited by Trail of Bits and Cyfrin. It died from a rounding error and shut down permanently. Balancer ran for years, heavily reviewed, and lost $128M to swap math. Cetus had multiple audits. $223M. None of these were exotic attacks. They were logic bugs, code doing exactly what it was written to do, where what it was written to do was wrong. The class of bug that pattern-matching scanners can't see and that a human with three weeks and a spec that exists only in the founder's head will statistically miss. After 100+ audits, here's the uncomfortable math of my own profession: a serious protocol ships changes continuously. An audit is a snapshot. The report expires the moment the next commit lands, and everyone in this industry knows it and prices it anyway. I'm not saying fire your auditors. I'm one. Manual review catches things nothing else can, and that stays true. I'm saying the model "two humans, a few weeks, a PDF, good luck" was built for 2024's codebases and 2024's attackers. Both have moved on. The data says the industry needs a layer that doesn't exist yet. I've spent the last months mapping exactly where that gap is, and testing what actually closes it. More on that soon.

Maybe we all should try NOT to use any sort of AI for a week and see if we still have any THINKING ABILITY left!

@M_Autos96 Welcome 💪

@botdidy You just gain a new follower will love to watch and learn from you for long

Commitment takes you there, consistency keeps you there! #thebuglifestyle #Web3

@CrucibleCrypto @dopplerprotocol Step1 don’t need anonymity. Nothing to hide lol. Seems like only step 2 is missing. Responsible disclosure

step 1: Make anonymous twitter Step 2: Collect the many other whitehat reports with a similar situation to maximize anonymity Step 3: Publish all vulnerabilities to inform users their money is not safe because a true white hats job is protecting the people who put their hard earned cash into this products Step 4: Watch how the space suddenly starts shifting because protocols can't hide anymore.

After 5months +, i got a reply under my tweet and now under the @dopplerprotocol report. TRIAGED->ACKNOWLEGED->REJECTED Like just forget bout it man… Also I wonder who budkayo is 😂. LESSON LEARNT! 😂 You shouldn’t have moved to another chain 😂

😂 bro is like…. “Nah im good. I don’t need to do regular audit. It’s only for big projects”

@0x158_ @dopplerprotocol 😂 😂 got me thinking Budkayo Saka

@botdidy @dopplerprotocol is budkayo another user on the platform? 😂

Well, well, well. We’ve seen what they do when they find you but Ever wondered how they find you - the protocol? There are many ways and different theories and one is to search X on “protocol” lol Are you safe?

The bugs exploited today are Bugs that couldnve been reported or have been reported or was not reported. You refuse to host a bounty, you refuse to pay bounty, yet you launch your program on a permissionless ecosystem. If this is isn’t suicide, I dunno what it is.

To the security researchers reading this: you deserve better than the spam queue. You know the cycle. You find a valid critical. The project disputes severity. The payout drags for months. Meanwhile open platforms bury real findings under thousands of junk submissions. That's the exact problem CertiK Hunt launched to kill. Invite-only, so signal beats volume. Programs and researchers both vetted. And the part that matters most: every program's scope and severity terms are defined up front — built on CertiK's industry-standard severity framework — so you know exactly how a finding gets classified before you commit a single hour. One week in: 300+ researcher applications, first program live, first reports already in triage. On July 15, the team behind Hunt presents at our Manhattan HQ — and takes questions face to face. So, researchers: what's the one policy that would make you commit your best hours to a platform? Drop it below. I'll put your answers in front of the team on the 15th — and tag you with what they say. Want to ask them yourself? RSVP: luma.com/n5zlmsjf

How?

@yassine3eth I replied ser. Waiting. Thanks

The DMs are pouring in 🙏 We're inviting in small batches for now, so it'll take a bit. But I'm getting back to everyone, don't worry.

I submitted a high severity vulnerability on @dopplerprotocol by Whetstone since February 2nd which was triaged by @cantinasecurity. Today is the 1st of July and I’ve not received a single response from the Team (Zero response). Guess what else?

The contract was smart, the dev wasn’t. I’ll explain. First you need to know that smart contracts can hold logic but EOA can’t because it has no code. So the dev is like okay, we’re not going to check if an account is an EOA using ‘account.code.length>0’ cause it’ll be weak.