Essential @only01Essential

Bug huntoor GoLang | Rust | Move | C++ | Solidity analyzer Joined December 2022

Tweets

1K
Followers

3K
Following

95
Likes

4K

Essential @only01Essential

20 hours ago

@0xWeb3boy @DeltaXV_ @alexfilippov314 Congratulations 👏👏

1 0 3 538 0

View Details

@NoahBiliamin @immunefi Reach out to immunefi support on zendesk or on discord and a team member will help you. And frankly speaking 9 days isn't a lot of time, depending on the severity of the bug, give the project more time, but alert immunefi

2 0 1 94 0

View Details

Essential @only01Essential

a week ago

@dvrvsimi @immunefi Congratulations 👏 👏

1 0 1 554 0

View Details

Essential @only01Essential

2 weeks ago

@v4rvl @immunefi Congratulations 👏👏

0 0 3 265 0

View Details

Essential @only01Essential

2 weeks ago

I see. So you don't believe there was any time wasted there. Let me rephrase it this way then. Assuming you are contracted for a private audit were you are paid per unique confirmed valid bug. At the same time the client pays for security audits in other firms(unbeknownst to you). By the time you finished with your review all your bug report gets marked as already known and you are pointed to a report for an audit that just concluded. I guess you'll say thank you to the team after spending two weeks auditing their code?

3 0 5 112 0

View Details

Essential @only01Essential

2 weeks ago

Given that you are on the other side of the fence it wouldn't make sense to you(or you'll just pretend it doesn't). Using your logic, as a project founder, I could start a conditional contest on sherlock then start another a week before the contest finalizes on cantina on the same commit. Then a week into the contest on cantina, mark all the findings from sherlock audit as out of scope. I guess this will make sense to you? Back then, maia dao, had a contest in sherlock and code4rena concurrently. This new rules are just here to frustrate security researchers, and you are here acting like it's a norm

1 0 4 108 0

View Details

Essential @only01Essential

2 weeks ago

@0xtruthlover @HackenProof Well done 👏

3 0 3 672 0

View Details

Essential @only01Essential

3 weeks ago

@dvrvsimi @0x15_eth @lonelysloth_sec When bug hunting, I will avoid any code that isn't live, since most projects value impact, if it isn't live yet, there's basically no impact

2 0 6 207 0

View Details

Essential @only01Essential

3 weeks ago

@dvrvsimi @0x15_eth @lonelysloth_sec If it's on bb platforms, you can report it the usual way, though you'll most likely not be rewarded/paid for the bug

1 0 13 747 0

View Details

Essential @only01Essential

3 weeks ago

@Qomolangma406 It seems you think it's all about the tool. I can list security researchers that have found a lot of live critical bugs with their own tools. The researcher mostly makes the model. A model could be garbage to one researcher and gold to another

1 0 5 302 0

View Details

Essential @only01Essential

3 weeks ago

I wonder why people are posting so much about Claude finding the critical ZCash bug as if it’s a big deal. HyperBridge got hacked, then launched a program on HackenProof and paid out about $120k within its first week or two for a ton of critical and high-severity bugs. My point is, I don’t believe the bug was hidden in plain sight; security researchers simply weren’t incentivized. Notice that the bug only came out after they ran a bug bounty program, attracted a lot of talent, and then closed the program. I would wager that the bug would have been found on the very first day on @HackenProof or @immunefi if they had launched a program, especially during this AI-assisted audit period we’re in. If an AI model found it, anyone with a subscription could have found it too. A formal bug bounty program really helps, I hope projects learn from this and launch a bbp on any of this big platforms. And note, for web3, launching on bugcrowd if it isn't just the web2 aspect you are as good as not having a program(talking from experience)

8 1 111 4K 13

View Details

Essential @only01Essential

3 weeks ago

@infsec_io @cantinasecurity Beast mode 💪 Your public earnings actually includes your bug bounty earnings as well

1 0 8 670 0

View Details

Essential @only01Essential

3 weeks ago

@0x15_eth So true, same reason I do just dlt audits too. It's impossible for teams to rigorously audit every aspects during their normal audit runs

2 0 18 616 1

View Details

Essential @only01Essential

3 weeks ago

@mamunwhh @cantinasecurity In my case they reached out via a comment in the submission to send them an address so they can process my reward. I think you should wait. Give them more days or properly reach out to cantina for help. X isn't the right medium for this

0 0 0 98 0

View Details

Essential @only01Essential

3 weeks ago

@theafro_dev Thanks man 🫡

0 0 1 210 0

View Details

Essential @only01Essential

3 weeks ago

$8,000 total payout for one chain halt and a high severity bug. $4,000 worth of native tokens for another chain halt bug in project 2.

26 9 238 12K 39

View Details

Essential @only01Essential

3 weeks ago

@immaterial_ink Thank you 🫡

0 0 1 102 0

View Details

Essential @only01Essential

3 weeks ago

@almond_env I think you should finish learning solidity first. I can help with the more difficult stuffs.

2 0 1 192 0

View Details

Essential @only01Essential

3 weeks ago

Congrats man, first of many 👏👏

demicannon001 @demicannon001

3 weeks ago

First bug bounty paid out. On to the next! 🏃🏿🏃🏿🏃🏿 Big thanks to @only01Essential for teaching, mentoring, and giving me tips on how to approach bug bounties.