Solax 🧢
396 posts

Solax 🧢
@solaxi_
Killing the hype, finding the truth 🕵️♂️




Gm. Building @H4cklabs_ltd & @morrisii_x everyday. H4cklabs is the company Cypher Wallet is the product MRSX is the protocol Morris is the agent



So last week @morrisii_x came across some security issues on @pumpdotfun. I have been monitoring for a week, creating a report on the issues, but since they ghost me just putting it here. So, yesterday I contacted pumpfun, had to send a message to their security account on telegram. Gave them small hint, and wanted to send them a full report, but no response so I didn't send the report yet. So, what is the problem? 1. I am able to fully use their @heliuslabs RPC nodes. 2. They exposed their API key which I have now. 3. They have not rate-limited their nodes (yesterday). 4. Their frontend exposes A LOT of data. 5. I can run inline malicious javascript. 6. They allow MANY sources. The list goes on. So @pumpdotfun, if you want a full report, you can dm me. So they closed the access from localhost:8080 now. But please check all the other ports since I still have access. The main issue: You made 500m, hire a security team... If someone has bad intentions... well we know how that ends. Request URL: pump-fe.helius-rpc.com/?api-key=****b…**** Request Method: POST --Llama


So last week @morrisii_x came across some security issues on @pumpdotfun. I have been monitoring for a week, creating a report on the issues, but since they ghost me just putting it here. So, yesterday I contacted pumpfun, had to send a message to their security account on telegram. Gave them small hint, and wanted to send them a full report, but no response so I didn't send the report yet. So, what is the problem? 1. I am able to fully use their @heliuslabs RPC nodes. 2. They exposed their API key which I have now. 3. They have not rate-limited their nodes (yesterday). 4. Their frontend exposes A LOT of data. 5. I can run inline malicious javascript. 6. They allow MANY sources. The list goes on. So @pumpdotfun, if you want a full report, you can dm me. So they closed the access from localhost:8080 now. But please check all the other ports since I still have access. The main issue: You made 500m, hire a security team... If someone has bad intentions... well we know how that ends. Request URL: pump-fe.helius-rpc.com/?api-key=****b…**** Request Method: POST --Llama

So last week @morrisii_x came across some security issues on @pumpdotfun. I have been monitoring for a week, creating a report on the issues, but since they ghost me just putting it here. So, yesterday I contacted pumpfun, had to send a message to their security account on telegram. Gave them small hint, and wanted to send them a full report, but no response so I didn't send the report yet. So, what is the problem? 1. I am able to fully use their @heliuslabs RPC nodes. 2. They exposed their API key which I have now. 3. They have not rate-limited their nodes (yesterday). 4. Their frontend exposes A LOT of data. 5. I can run inline malicious javascript. 6. They allow MANY sources. The list goes on. So @pumpdotfun, if you want a full report, you can dm me. So they closed the access from localhost:8080 now. But please check all the other ports since I still have access. The main issue: You made 500m, hire a security team... If someone has bad intentions... well we know how that ends. Request URL: pump-fe.helius-rpc.com/?api-key=****b…**** Request Method: POST --Llama

So last week @morrisii_x came across some security issues on @pumpdotfun. I have been monitoring for a week, creating a report on the issues, but since they ghost me just putting it here. So, yesterday I contacted pumpfun, had to send a message to their security account on telegram. Gave them small hint, and wanted to send them a full report, but no response so I didn't send the report yet. So, what is the problem? 1. I am able to fully use their @heliuslabs RPC nodes. 2. They exposed their API key which I have now. 3. They have not rate-limited their nodes (yesterday). 4. Their frontend exposes A LOT of data. 5. I can run inline malicious javascript. 6. They allow MANY sources. The list goes on. So @pumpdotfun, if you want a full report, you can dm me. So they closed the access from localhost:8080 now. But please check all the other ports since I still have access. The main issue: You made 500m, hire a security team... If someone has bad intentions... well we know how that ends. Request URL: pump-fe.helius-rpc.com/?api-key=****b…**** Request Method: POST --Llama

So last week @morrisii_x came across some security issues on @pumpdotfun. I have been monitoring for a week, creating a report on the issues, but since they ghost me just putting it here. So, yesterday I contacted pumpfun, had to send a message to their security account on telegram. Gave them small hint, and wanted to send them a full report, but no response so I didn't send the report yet. So, what is the problem? 1. I am able to fully use their @heliuslabs RPC nodes. 2. They exposed their API key which I have now. 3. They have not rate-limited their nodes (yesterday). 4. Their frontend exposes A LOT of data. 5. I can run inline malicious javascript. 6. They allow MANY sources. The list goes on. So @pumpdotfun, if you want a full report, you can dm me. So they closed the access from localhost:8080 now. But please check all the other ports since I still have access. The main issue: You made 500m, hire a security team... If someone has bad intentions... well we know how that ends. Request URL: pump-fe.helius-rpc.com/?api-key=****b…**** Request Method: POST --Llama

So last week @morrisii_x came across some security issues on @pumpdotfun. I have been monitoring for a week, creating a report on the issues, but since they ghost me just putting it here. So, yesterday I contacted pumpfun, had to send a message to their security account on telegram. Gave them small hint, and wanted to send them a full report, but no response so I didn't send the report yet. So, what is the problem? 1. I am able to fully use their @heliuslabs RPC nodes. 2. They exposed their API key which I have now. 3. They have not rate-limited their nodes (yesterday). 4. Their frontend exposes A LOT of data. 5. I can run inline malicious javascript. 6. They allow MANY sources. The list goes on. So @pumpdotfun, if you want a full report, you can dm me. So they closed the access from localhost:8080 now. But please check all the other ports since I still have access. The main issue: You made 500m, hire a security team... If someone has bad intentions... well we know how that ends. Request URL: pump-fe.helius-rpc.com/?api-key=****b…**** Request Method: POST --Llama






