Hacks are the only thing that makes projects take security seriously. Keep lowballing and ignoring whitehats, and those bugs won't get reported. They'll get exploited.

i used to often think how if i was born a few years earlier, i would've caught so many *obvious* opportunities such as crypto pre-2017. i was even sometimes mad that such opportunities seemingly no longer exist. and every few months i just get humbled as i look back and realize i've missed even more *obvious* opportunities.

the concept of a duplicate critical must not exist in bug bounty, it's either a critical and it gets instantly fixed so new scope doesn't include that critical anymore, or it's just bullshit

One year in web3 security. The biggest lesson wasn’t technical. In a few weeks it will be a year since I left software engineering and became a web3 security researcher. Estimated earnings for that first year: around $200k. This past month I’ve been looking back at all of it: the findings, the misses, the dry spells, the discipline, and how I built my days so I could hunt hard and still live a healthy life. And honestly, the number isn’t the main thing I took away. The biggest lesson was about control. Most of the game is outside your hands In this space a lot gets decided after you hit submit. Someone finds the same bug and yours becomes a duplicate. The judge downgrades your severity. A project goes quiet and never pays. Someone on your timeline posts a five figure payout in the same week you found nothing. If your mood depends on those things, this job will eat you alive. I learned that the hard way. Epictetus put it simply. Some things are up to us and some are not. Our effort, our judgments and our actions are ours. Results, reputation and other people’s decisions are not. Most suffering comes from confusing the two. Your report is your arrow Think of an archer. He controls the preparation, the aim, the breath and the release. Once the arrow leaves the bow, it belongs to the wind. In bug hunting the arrow is the report. Everything before submit is yours: how deep you read the code, how many edge cases you test, how clear your PoC is. Everything after is not. So I changed how I define success. A good day is not a day with a finding. A good day is one where I did the work with full focus. If that’s the measure, you can’t fail. Aim high, then let go You have to aim at something, otherwise you don’t move anywhere. Aim with everything you have, but don’t tie your peace of mind to whether you hit. Stop comparing yourself to other hunters. Leaderboards and payout screenshots show someone else’s journey. The only fair comparison is you a year ago. When I look at that version of me, the gap is huge. That’s the real result. And before you complain about judging, ask yourself if your report was really as clear and complete as it could be. Usually there’s something you could have done better. Emotions are information, not orders The hardest part was emotional. Frustration when a valid finding gets rejected. Envy when others hit big. The rush when you think you’ve found a critical, then the crash when it turns out to be a known issue. Doubt in the middle of a long dry spell. Most of my worst days weren’t caused by what happened. They came from the stories I told myself about it: “I’m not good enough.” “I wasted a whole month.” You can’t choose the judging outcome. You can choose what you do the next morning. Self-control lives in the boring parts Discipline isn’t one heroic all-nighter. It’s the daily structure: fixed blocks of deep work, phone away going through past contest reports and what I missed sleep, training and real food good books time completely offline Your system decides your results more than your goals do. The hunter with the better system beats the hunter with the bigger dream. And health isn’t separate from the work. A tired brain misses bugs. Taking care of your body is part of the process. What I control: how much I work and study how precise and persistent I am how I react when things go wrong What I don’t control: whether someone finds the bug before me whether it gets paid what the final result will be One year in, I don’t feel calmer because the results got better. I feel calmer because I stopped asking the results to tell me who I am. Focus on the process. Let the rest go.

I just found a bug and got paid on @immunefi #immunefitribe immunefi.com/s/ss/?severity=…

Soon I'll hit 5 years in Web3 security. This is for everyone just starting out in the space: - people are making $100k+ from reporting a single bug. the opportunities are insane, but it's NOT easy money - become a nerd. literally. read code, break things, put in the hours - learn to negotiate. being great at finding bugs doesn't automatically mean you'll be great at getting paid - be disciplined. it takes years to become genuinely good at this - stay curious. never stop asking WHY and HOW things work - start by finding smaller bugs. learn to walk before chasing Criticals - be patient. skills, reputation and money don't come overnight - adapt fast. this industry looks nothing like it did 4 years ago - embrace new technologies, especially AI. learn to use them instead of dismissing them - surround yourself with smart, like-minded people. you'll learn things no course can teach you - stay up to date with exploits, research and everything happening in the space - learn to sell yourself. your skills mean less if nobody knows about them - build your personal brand. a good reputation opens doors you didn't even know existed - understand what creates REAL value - celebrate your wins, but don't get too comfortable. take a day off, then get back to work - respect other whitehats and builders. there's always something you can learn from them - help people without expecting anything in return. you'll be surprised where it leads - long-term relationships > short-term benefit - be careful what you click. even security researchers get hacked - never think you've learned enough. the moment you stop improving, you're falling behind - enjoy the process. this space is so crazy that it's almost impossible to get bored

Good reminder that bug bounties can completely change your life in a matter of months. One bug can pay more than a year’s salary, and one great year can change your financial future entirely. From homeless to $1.4M in 11 months. Few careers offer upside this fast.

Small @immunefi ask: When a report is closed as "Duplicate of invalid", show why the original was rejected as invalid. Right now we only see the original report, NOT the closure reason. It feels like basic courtesy when I paid 75 USDC to submit.

I just found a confirmed bug on @immunefi #immunefitribe immunefi.com/s/ss/?severity=…

.@DarioAmodei and @sama! it is high time you put some money into KYC, or whatever trust/verification system you want, and give legitimate security researchers access to your best models. 1. we’ve helped secure both of your companies multiple times against issues that could have had serious consequences. i wouldn’t be surprised if we can keep doing that, and i also wouldn’t assume every capable attacker is reporting what they find. 2. there is now a KVM escape that, if researchers hadn’t found it first, could have been exactly the kind of thing your models eventually find in another hugging face style incident. you know, the list will keep growing, this is not the end. it rationally makes sense to get as many trusted researchers and companies as possible red teaming your companies, your models, and the infrastructure they depend on.

This is how you ask for advice if you want to get a response

Bug bounty tip learned the hard way: when you submit report, save a wayback machine snapshot or similar public evidence to avoid unnecessary arguing. Protocol can ghost your report and add "out of scope" rules during that time and close your report, you need evidence to flip it

If you run a Web3 project, don’t fuck around with whitehats. Causing catastrophic damage is easier than you think. They’re choosing to report your bugs instead of exploiting them. Don’t mistake their ethics for your security.

Imagine coming from the medical field but having earned more than $1.7M in bug bounties on Immunefi alone. This week’s Security Voices features @__nnez , one of the top Web3 security researchers. Here are some of his key takeaways 👇

Hot take: Codex 20x feels like a 1-day sub. Claude 20x feels like a 3-day sub.

🚨 Web3 security researchers, STOP SCROLLING. This entire playlist is FREE. 8 deep dives into auditing, stateful fuzzing, formal verification, L2 + bridge security, ZK circuits and more. This is hours of serious security education. SAVE IT. piped.video/playlist?list=PL…

The basic architecture behind most AI audit agents is surprisingly simple. Decompose the audit into different perspectives, assign each one to a subagent, and give every subagent a set of heuristics for reviewing the code. You can see this pattern everywhere. From public audit skills to complex multi-agent systems. The quality of the result then depends mainly on two things: 1. How well you decompose the audit into useful perspectives. 2. How well you teach each agent to search from its assigned perspective. I experienced the difference directly while testing my own workflow. For the first version, I asked Codex to parse Solodit and turn what it found into a decomposed set of audit heuristics. I did zero manual validation. I only wanted to test the overall approach. That version produced around 40 leads on my test codebase. Then I rewrote every heuristic manually. I added examples from my own work and tried to make the agent investigate each category exactly as I would. On the same codebase, the new version produced around 120 leads. To be precise, these were not 120 valid vulnerabilities. They were potential weaknesses and suspicious code paths that could either develop into findings or be discarded after further investigation. The point is also not that more leads automatically mean a better audit. It is how much the agent’s behavior changed once generic instructions were replaced with an experienced researcher’s methodology. Someone unfamiliar with security research may know which vulnerability categories to check. But they are less likely to know which questions expose them, what context matters, and where an investigation should go next.

🚨TO ALL AUDITORS: Monad’s security team just open-sourced an agentic Solidity fuzzing system. Its default campaign uses 43 agentic nodes to map flows, threat-model, derive properties, hunt bugs, triage findings and produce a report. This looks awesome! github.com/monad-developers/…

I just found a bug and got paid on @immunefi #immunefitribe immunefi.com/s/ss/?severity=…

And here I am, having reported vulnerabilities throughout my career that could have resulted in a total of several billions (yes, with a B, > $2B) being *stolen*, while my total earnings are around $2M. So what's the lesson the industry is teaching researchers? That next time we should steal the funds first, then negotiate a "responsible disclosure," return 80–90%, and walk away with 10–20%? Obviously, no. But it's insane that the incentives can make that rhetorical question even possible. The bounty world is broken. Blackhats exploit a protocol and get treated like kings in negotiations. Meanwhile, whitehats disclose the exact same kind of vulnerability privately, prevent any damage from happening, and then spend months arguing with projects that try to downgrade the finding and pay the bare minimum. I'm fighting several cases like this right now. Millions of dollars protected, vulnerabilities responsibly disclosed, and yet projects still don't want to pay the amounts they themselves advertised. We should be making responsible disclosure the overwhelmingly obvious choice. Instead, the current state of Web3 is doing its absolute best to discourage whitehats while creating increasingly attractive incentives for blackhats and "grayhats". Those incentives are backwards, and eventually the ecosystem pays the price.