TiraiFrontier
8 posts
Tirai win the @colosseum frontiers side track on @cloak_ag 🔥🔥🔥
Cloak@cloak_ag
The winners of the Cloak Track are here. 95 submissions. Builders from everywhere exploring what happens when privacy stops being a feature and becomes infrastructure. The hardest part wasn’t finding good projects. It was choosing between them. When there was a tie, we optimized for range: one winner per use case, to show how broad private payments can actually become. 🏆 1st: TENDR (@tendrdotbid ) Private RFP procurement where bids stay sealed until close, eliminating information leakage and preventing either side from cheating. 🥈 2nd: BIDO (@usebido ) Ad monetization for AI agents, where intent is privately detected and matched before the final purchase decision. 🥉 3rd: AEGIS (@aegis_ledger ) A privacy execution layer on top of Squads v4, routing multisig approvals through Cloak’s ZK infrastructure. 4th: TUMAR A non-custodial family investment vault for the Kazakh diaspora, combining private payments with real-world asset exposure. 5th: TIRAI (@tiraiFrontier ) Private bounty payouts for security researchers, breaking the onchain link between deposits and withdrawals. Honorable mentions: NORI, @DefundsFinance , @agio_network , @buildcoldstar , @usekixa , and GRAYBOX. Massive respect to every team that shipped. And to everyone who didn’t win this time: keep building. Cloak will continue supporting teams pushing privacy forward. This is what the future of private payments looks like when builders take the problem seriously.
English
thank u so much @cloak_ag for proving that privacy and bug bounties matter on @solana @solana_devs
Tirai is just the beginning.
tirai-frontier.vercel.app
Cloak@cloak_ag
The winners of the Cloak Track are here. 95 submissions. Builders from everywhere exploring what happens when privacy stops being a feature and becomes infrastructure. The hardest part wasn’t finding good projects. It was choosing between them. When there was a tie, we optimized for range: one winner per use case, to show how broad private payments can actually become. 🏆 1st: TENDR (@tendrdotbid ) Private RFP procurement where bids stay sealed until close, eliminating information leakage and preventing either side from cheating. 🥈 2nd: BIDO (@usebido ) Ad monetization for AI agents, where intent is privately detected and matched before the final purchase decision. 🥉 3rd: AEGIS (@aegis_ledger ) A privacy execution layer on top of Squads v4, routing multisig approvals through Cloak’s ZK infrastructure. 4th: TUMAR A non-custodial family investment vault for the Kazakh diaspora, combining private payments with real-world asset exposure. 5th: TIRAI (@tiraiFrontier ) Private bounty payouts for security researchers, breaking the onchain link between deposits and withdrawals. Honorable mentions: NORI, @DefundsFinance , @agio_network , @buildcoldstar , @usekixa , and GRAYBOX. Massive respect to every team that shipped. And to everyone who didn’t win this time: keep building. Cloak will continue supporting teams pushing privacy forward. This is what the future of private payments looks like when builders take the problem seriously.
English
The winners of the Cloak Track are here.
95 submissions. Builders from everywhere exploring what happens when privacy stops being a feature and becomes infrastructure.
The hardest part wasn’t finding good projects. It was choosing between them.
When there was a tie, we optimized for range: one winner per use case, to show how broad private payments can actually become.
🏆 1st: TENDR (@tendrdotbid )
Private RFP procurement where bids stay sealed until close, eliminating information leakage and preventing either side from cheating.
🥈 2nd: BIDO (@usebido )
Ad monetization for AI agents, where intent is privately detected and matched before the final purchase decision.
🥉 3rd: AEGIS (@aegis_ledger )
A privacy execution layer on top of Squads v4, routing multisig approvals through Cloak’s ZK infrastructure.
4th: TUMAR
A non-custodial family investment vault for the Kazakh diaspora, combining private payments with real-world asset exposure.
5th: TIRAI (@tiraiFrontier )
Private bounty payouts for security researchers, breaking the onchain link between deposits and withdrawals.
Honorable mentions: NORI, @DefundsFinance , @agio_network , @buildcoldstar , @usekixa , and GRAYBOX.
Massive respect to every team that shipped.
And to everyone who didn’t win this time: keep building. Cloak will continue supporting teams pushing privacy forward.
This is what the future of private payments looks like when builders take the problem seriously.
English
al_f4lc0n found a $500M Critical in @injective. The fix shipped next day. The reward? 3 months of silence → 10% of promised payout.
Bug bounty payouts are slow and risky for whitehats. We built Tirai on @solana powered by @cloak_ag to fix it.
App: tirai-frontier.vercel.app
TiraiFrontier@tiraiFrontier
@al_f4lc0n found a $500M Critical in @injective. The fix shipped next day. The reward? 3 months of silence → 10% of promised payout. Bug bounty payouts are slow and risky for whitehats. We built Tirai on @solana powered by @cloak_today to fix it. App: tirai-frontier.vercel.app
English
More on Tirai 👇
🎬 Demo: youtu.be/VN-GBcPeGVc
📊 Full pitch deck (video): youtu.be/CFLosti1l7Y
📚 Documentation: moai-3.gitbook.io/tirai-frontier
🎨 Slide deck: canva.link/hudgb0grbtveywj
Built for @cloak_today Hackathon 2026 · Frontier Track.
YouTube
YouTube
TiraiFrontier@tiraiFrontier
@al_f4lc0n found a $500M Critical in @injective. The fix shipped next day. The reward? 3 months of silence → 10% of promised payout. Bug bounty payouts are slow and risky for whitehats. We built Tirai on @solana powered by @cloak_today to fix it. App: tirai-frontier.vercel.app
English
@al_f4lc0n found a $500M Critical in @injective. The fix shipped next day. The reward? 3 months of silence → 10% of promised payout.
Bug bounty payouts are slow and risky for whitehats. We built Tirai on @solana powered by @cloak_today to fix it.
App: tirai-frontier.vercel.app
English
TiraiFrontier retweetledi
I Saved Injective's $500M. They Pay Me $50K.
I like hunting bugs on @immunefi . I'm decent at it.
- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)
Life was good. Then I found a Critical vulnerability in @injective .
This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.
I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.
Then — silence. For 3 months. No follow up. No technical discussion. Nothing.
A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.
I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.
I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.
Full Technical Report: github.com/injective-wall…
English