Kais Tlili

438 posts

Kais Tlili banner
Kais Tlili

Kais Tlili

@ktl_____

Security Researcher @cantinaxyz | DMs open for memes only, for private audits go hire some professionals | https://t.co/7RWQeveIDm

Tunis Katılım Nisan 2016
2.6K Takip Edilen404 Takipçiler
Kais Tlili retweetledi
Dark Web Informer
Dark Web Informer@DarkWebInformer·
A gasoline powered laptop... 😂
Dark Web Informer tweet media
English
28
83
616
49K
Kais Tlili retweetledi
Tay 💖
Tay 💖@tayvano_·
@TheTakenUser questions to get everyone impacted to answer
Tay 💖 tweet media
English
1
10
84
17.6K
Tay 💖
Tay 💖@tayvano_·
@MikeSylphDapps @TheTakenUser Most telling is apparently this is all evm? LastPass was always all sorts of chains Also, earliest seen date was 2017-07-14 23:46:07 LastPass goes all the way back to 2011. Many genesis evm addresses. Mt gox users. XRP genesis folks. Etc.
Tay 💖 tweet media
English
2
1
5
759
Kais Tlili
Kais Tlili@ktl_____·
@d0rsky Very interesting that most slop AI is gone at 5$, have you tried setting a linear fee per claimed severity, eg: 5$ for medium, 10$ for high and 20$+ for crit?
English
1
0
8
531
sashko.eth🇺🇦
sashko.eth🇺🇦@d0rsky·
Its almost a month, from the moment we enabled fees to test and see how it works. Here are some insights we have so far We enabled submission fees across 11 bug bounty programs. $1 - no measurable impact. Same as free. Some programs actually got more reports. Researchers assume fewer people participate, so give more interest for program. $5 - ~80% drop in AI slop and low-quality submissions. The golden middle. High confidence in every submission. $10 - the max we'd recommend. Whitehats tell us anything above $10 hits a mental barrier and starts pushing away legit researchers. At $100, you're essentially restricting submissions to Critical-only. No one will risk $100 on a Medium finding, even a valid one. If the goal is to filter AI slop, $5 gets you 80% of the way there without losing real researchers. I don't know who recommended to place it for one big audit contest happening rn. All 11 companies are satisfied with the results. If you're still spending days sorting through AI-generated garbage reports - submission fees + our open-source MCP triage tools + skills is the combo that actually solves it. DM us to enable it for your program.
sashko.eth🇺🇦@d0rsky

Paid submissions? Let’s talk We need to be honest about what’s happening to bug bounty right now We live in AI era, where submission volume is growing fast, but signal is not A lot of reports getting lost, delayed, or stuck in review loops And this hurts everyone - especially professional whitehats with real findings Over the last months, we’ve been trying to fix this step by step Reputation points system was first you submit spam → you get penalty points → you lose ability to submit simple incentive on quality Then - MCP Which helps teams triage faster, identify duplicates, reduce review time. Many companies already using it. And now we are introducing a new option - submission fees. We’ve been hearing this request from many companies and honestly, it feels like a next logical step to make the game more fair for everyone. This is optional, not default, and not something every company will enable. Fees going to be small ($1-$5), so this is not about monetization too This is about adding a bit of friction, so people think twice before submitting something they are not confident in Because today, there is almost no downside to spam. With $20 subscription, any user can generate thousands of reports even without understanding of them. At the same time, we fully understand concerns, whitehats are our biggest asset and we still want new researchers to join the space, so we added: • free credits for new users (via coupons) • support for high-signal researchers Goal is very simple - improve signal without losing important reports I will keep you in a loop once any of HackenProof clients will enable it Lets fix bug bounty together

English
8
9
114
11.6K
Kais Tlili
Kais Tlili@ktl_____·
I was poc'ing a DOS attack and ended up DOSing myself, when I asked @claudeai what was happening he didn't miss the chance to shit on me. I love this thing.
Kais Tlili tweet media
English
0
0
2
233
Kais Tlili
Kais Tlili@ktl_____·
@GalloDaSballo The closest would be nvd.nist.gov or any cve database I guess, for disclosed bbp reports you can find some in hackerone's hacktivity feed
English
0
0
0
147
Alex the Entreprenerd
Alex the Entreprenerd@GalloDaSballo·
What’s the solodit for all bugs? (All types vs web3)
English
3
0
11
2.2K
Kais Tlili retweetledi
alix40
alix40@AliX__40·
The Death of the Audit Contest? A 2025 Retrospective I will always be thankful for audit contest companies. They pioneered the open-sourcing of Web3 security knowledge, allowing security researchers (SRs) like myself to improve at a fast and consistent pace. However, looking back from 2025, it is clear that the landscape has shifted dramatically. 2024: The Golden Era 2024 was undoubtedly the best year in the history of Web3 audit contests. The volume of opportunities was unprecedented; almost every month featured a million-dollar prize pool, often with a dozen other contests running in parallel. The hype was strong, and the space was filled with highly trained competitors. During this time, the number of submissions was manageable, and "report spam" was significantly lower than what we see today. However, 2024 was also the beginning of the end for the traditional contest model. The Profitability Problem In the early days (pioneered by Code4rena), audit contest platforms typically charged a 40% margin on the total audit pot. Despite these large margins, most companies were burning through VC cash and failing to turn a profit. They were in "growth mode," prioritizing market share over sustainability. As the model's initial success became visible, it inspired a wave of new competitors. These companies introduced new models or used existing relationships with protocols to sell audits. This fierce competition was a win for protocols—they received high-coverage, deep-vulnerability reports as SRs competed to break their code—but it forced contest platforms into a "race to the bottom" on pricing. The Shift in Incentives To lower costs for clients, platforms had two options: - Reduce the SR Prize Pool: This led to "conditional pots" and custom rules that favored the client (e.g., defining a "High" severity only if >50% of TVL could be stolen). - Reduce Platform Fees: Platform fees shrank to 10%–20%, which is too low to sustain long-term growth or quality operations. This created two major shifts: For Platforms: They pivoted to private audits, which require less effort to manage and offer healthier margins. For SRs: The most capable researchers with personal brands grew tired of "unlocked" pots—where they could work for a month and earn $0 because a specific threshold wasn't met. These top-tier researchers moved to private auditing as freelancers or by joining major firms. The State of the Market in 2025 Today, most platforms are growing their profits by running fewer public contests and focusing heavily on the private/team audit sector. It no longer makes sense for them to sell a contest when a private audit is more efficient and profitable. For SRs, the ecosystem feels broken. The top talent has moved to private work, while public contests are increasingly flooded with low-quality spam reports fueled by the 2024 hype and AI-generated submissions. The original incentive alignment between SRs, protocols, and platforms has fractured. The Path Forward I want the "Golden Era" of audit contests to reemerge. To do this, we must fix the incentives: Healthy Margins: Platforms need to make enough profit to prioritize contests again. SR-Friendly Terms: We must enforce terms that protect researchers' time and attract top talent back to the public arena. Value for Protocols: By attracting the best researchers, protocols will once again receive the substantial security value that only a competitive environment can provide. I have avoided naming specific companies because my goal isn't to create drama or attack anyone. These thoughts are based on my own analysis and data from friends in the industry. My only goal is to propose a way for our space to innovate and thrive once more.
English
8
13
138
12.3K
Kais Tlili retweetledi
Kais Tlili
Kais Tlili@ktl_____·
@WhiteHatMage Man LLM are getting too good and I'm getting too old 🤦‍♂️
English
0
0
2
468
playboi.eth
playboi.eth@adeolRxxxx·
@ktl_____ Hm, I would agree with you in terms of contests. But bbps? I may not agree.
English
1
0
2
564
Eye
Eye@eyeonchains·
The Bunni exploiter is the same person behind other 14 exploits, such as @Equilibriafi , @bsx_labs , @DFXFinance , and @CurveFinance , where in many cases after she attack, she drained the entire liquidity of various protocols, driving them to failure. This is a person who acts without scruples and without mercy, disregarding the fact that they are playing with the future of many people, including users' funds and those of the various teams. The explorer is a person who is very well connected in the crypto industry with connections to VCs and thinks she are untouchable thanks to her alibi. A first class cloutchase given her thousand online allias, your turn will come where you will pay everything back
Bunni@bunni_xyz

Hello everyone, it is with saddened hearts that we announce the shutdown of Bunni. The recent exploit has forced Bunni's growth to a halt, and in order to securely relaunch we'd need to pay 6-7 figures in audit & monitoring expenses alone – requiring capital that we simply don't have. It'd also take months of development & BD effort just to get Bunni back to where it was before the exploit, which we cannot afford. Thus, we have decided it's best to shut down Bunni. Here's what will happen: - Bunni users will still be able to withdraw assets via the Bunni website until further notice. - We intend to distribute the remaining treasury assets to BUNNI, LIT, and veBUNNI holders based on a snapshot. However, the validation of the legal process is ongoing, and the exact details of the distribution will be shared at a later date once the legal process is finalized. Team members will be excluded from the snapshot. - The Bunni v2 smart contracts have been relicensed from BUSL to MIT, enabling everyone to utilize our innovations such as LDFs, surge fees, and autonomous rebalancing. We have pushed the AMM space forward by a generation, and it would be a shame if our efforts went to waste. - We will continue working with law enforcement to recover the stolen funds from the exploiter. Thank you to everyone who has supported us throughout our journey to push DeFi forward.

English
31
14
206
54.2K
Kais Tlili
Kais Tlili@ktl_____·
@philbugcatcher Give a man a 0 day he will have access for one day, teach a man to phish and he will have access for life
English
0
0
1
172
phil
phil@philbugcatcher·
Extremely cringe to see security researchers fall for phishing scams
English
11
0
67
4.6K
Kais Tlili retweetledi
phil
phil@philbugcatcher·
If you trade on perps dexes, you are being scammed I was doing research about perps dexes and noticed the absurd fees charged from traders Tradfi futures offer essentially the same product at 94-99% less fees Don't believe me? Take a look at the numbers 🧵
English
5
1
44
4.3K
Kais Tlili retweetledi
Gwart
Gwart@GwartyGwart·
when some nerd says “ZK solves this” and you know it doesn’t but you also don’t know how ZK works
Gwart tweet media
English
130
94
2.1K
89K
Zero Cipher
Zero Cipher@zerocipher002·
Web3 security is brutally competitive. Doubt creeps in. The cheat code: your circle. Big Shoutout to my friend @ktl_____ for pushing me into BBPs. He is directly responsible for a huge part of my wins due to his motivation and guidance to me. Newcomers: pick optimistic, driven friends. Your environment sets your ceiling.
English
8
3
87
5.2K