pks_ @pks_eth

Friday I said 10 retweets and I ship it by Monday, and you delivered. Duplicate detection is live in Studio. It checks the program's history for overlap before you submit. Retweeters get first access. Ping me.

Vid Repar @vidrepar

4 weeks ago

Should I add duplicate detection to Studio? It would catch dupes before you submit. No more burning a week on a report someone else filed first. 10 retweets and I ship it by Monday. Sorry for the bait, but I need the validation first.

3 9 19 4K 1

@vidrepar studio

@Mudit__Gupta @hexens Btw, we wrote a kick-ass article about the vulnerability. A very interesting read: hexens.io/research/aptos…

Tough day for many security researchers. It is worth remembering that a lot of teams are still hiring: - Senior Cyber Security Engineer at @aave (come work with me ;) ): aave.com/careers/senior… - Information Security Engineer, Product, at @AptosLabs: job-boards.greenhouse.io/aptoslabs/jobs… - Lead Security Engineer at @babylonlabs_io: babylonlabs.io/job-listings/l… - Blockchain Security Engineer, Smart Contract Auditing, at @binance: jobs.lever.co/binance/31a869… - Security Engineer, Product Security, at @chainlink: chainlinklabs.com/open-roles?ash… - Security Engineering Lead at @EspressoSys: jobs.lever.co/Espresso/135f4… - Senior Infrastructure Security Engineer at @the_matter_labs : jobs.ashbyhq.com/matter-labs/c1… - Senior Protocol Engineer (Verification) at @Morpho: morpho.org/jobs/ashby-sen… - Senior Security Engineer, Offensive, at @Offchain: jobs.lever.co/offchainlabs/5… - Senior Application Security Engineer at @0xPolygon: jobs.ashbyhq.com/polygon-labs/a… - Security Engineer at @tempo: jobs.ashbyhq.com/tempo-xyz/361e… - Onchain security engineer at @Wonderland : apply.wonderland.xyz/o/onchain-secu… And these audits firms are also hiring: - @asymmetric_re, Security Engineer: jobs.ashbyhq.com/asymmetric.re/… - @chain_security, Blockchain Security Engineer: chainsecurity.com/jobs/blockchai… - @guardianaudits, multiple roles: guardianaudits.com/careers/#open-… - @osec_io , Security researcher: osec.io/careers/securi… - @PashovAuditGrp, Security Researcher: pashov.com/jobs - @Nethermind, Smart Contract Auditor, jobs.ashbyhq.com/nethermind/bed… - @zellic_io, Security Researcher: zellic-inc.notion.site/Security-Resea…

Josselin Feist @Montyly

8 months ago

Most protocols spend a lot on audits and bug bounties but have zero internal security Launching whohassecurity.com to highlight the ones that do Having an internal security team should be in every protocol's New Year's resolutions for 2026

12 18 175 81K 47

@0xTimofey @immunefi @MitchellAmador Thanks for everything you did ser, best luck to your next chapter🫡

@Afriauditor @immunefi yup

I just found a bug and got paid on @immunefi #immunefitribe immunefi.com/s/ss/?severity…

Solarpunk is a movement that imagines a sustainable and optimistic future where humanity thrives in harmony with nature.

Today we're launching Crucible, a coverage-guided fuzzing framework for Solana programs. Built for Anchor, with v2 support from day one. Just one example of what Crucible can find: a years-old bug in Solana's stake program, surfaced in seconds ↓

We found a critical soundness bug in dusk-plonk that let a malicious prover forge proofs for arbitrary false statements. The result: an attacker could mint arbitrary amounts of DUSK out of thin air and bypass every check protecting Dusk's shielded transactions.

On Solana, events are often reconstructed from transaction traces, and failed transactions still emit data. @Dooflin5 details a bug in Across that could have allowed attackers to spoof deposit events and trick relayers into filling orders with no real deposit behind them.

During the last week I executed very long autonomous sessions of Claude Code Opus 4.6 and Codex GPT 5.4 (both at max thinking budget), in cloned directories (refreshed every time one was behind). I burned a lot of (flat rate, my OSS free account + my PRO account) of tokens...

Interesting parts of this research 🌕 the appendix of the paper 🌗 GitHub repo 🌑 the undisclosed quantum algorithm 🔗 quantumai.google/static/site-as…

keyboard_arrow_left Previous keyboard_arrow_right Next

Craig Gidney @CraigGidney

4 months ago

This is from a paper that should have appeared on arXiv today but due to technical issues will only be there tomorrow; for the moment it's at quantumai.google/static/site-as… See also this blog post on the idea: research.google/blog/safeguard…

2 15 81 19K 18

Cross-chain bridges remain critical infrastructure, proof verification is the core of their security model. New disclosure on our research page: a vulnerability in the Polygon Plasma bridge that allowed transaction proofs to be forged. At the time of discovery, $800M in POL was at risk, exploitable in a single transaction with no prerequisites. The research covers how the proof verification breaks, how the exploit was built, and what it means for bridge security. Full technical deep-dive: hexens.io/research/polyg…

If @ethereum continues with this nonsense of zkVM vibecoded we're gonna end with the L1 fully hacked. We all make mistakes and I'm sure we will get hacked too. The difference is that we try to avoid it. Some irresponsible people have been proposing to vibecode cryptography like it has no cost.

Andrej Karpathy @karpathy

4 months ago

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database

1K 5K 28K 66.6M 14K

This hacker is on a roll 6 hacks in 1 month 55 eth total earned

deebeez @deeberiroz

4 months ago

Some type of liquidation contract was just exploited. Held over ~$1m funds at some point, exploited for only $100k Happy for someone to investigate more etherscan.io/tx/0x73bd1384e…

3 3 71 56K 44

I Saved Injective's $500M. They Pay Me $50K. I like hunting bugs on @immunefi . I'm decent at it. - #1 — Attackathon | Stacks - #2 — Attackathon | Stacks II - #1 — Attackathon | XRPL Lending Protocol - 1 Critical and 1 High from bug bounties (not counting this one) Life was good. Then I found a Critical vulnerability in @injective . This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk. I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity. Then — silence. For 3 months. No follow up. No technical discussion. Nothing. A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either. I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten. I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve. Full Technical Report: github.com/injective-wall…

Let's give pi-coding-agent a heartbeat 🤖♥️ Add Memory + Messenger + Skill Discovery 🦞. Make it autonomous. #OpenClaw-level chaos included 🙂🔥 npmjs.com/package/pi-sch… #AI #DevTools #pi

Two protocols. One skipped command. The first confirmed live exploits of ZK cryptography weren't sophisticated, they were a setup ceremony nobody finished. It turns out default settings ship faster than trust. rekt.news/default-settin…

@brucexu_eth 除了权限和集成，跨文件综合推理还是比不上直接调用 codex cli。龙虾虽然有记忆管理，但稍微用久点还是会忘掉一些内容