Results and lessons from ~1yr (2025) of full-time BB on @immunefi - 3 bugs marked as Crits and paid - 2 Crits confirmed but not paid for >5-6 months - spent ~3 months on this project - the project has been unresponsive for months now - just recently the BBP was

~ Bugs are everywhere. Zoom out! ~ > This is a very long post. The more software we develop, the more certain we are that it is infinitely easier to discover bugs than to write bug-free code. On top of that, private audits and contests are doomed to miss critical

Check out my @immunefi portfolio protection! #ImmunefiShieldMyBags

@agfviggiano Let me share what I know; Barracuda is Asymmetric Research, and they still do bug hunting. The second person’s known nick is satya0x, after getting $10m from the Wormhole uninitialized proxy bug, they basically disappeared. Pwning founded Offside Labs. Gegul is an LSR at

Developers trust intuition. Data says they shouldn’t. Bug rates rise when code is written by feel, and AI isn’t fixing it. Code looks cleaner, breaks deeper.

Immunefi Show Episode 2 is here. "What It Takes to Secure a Trillion Dollars on Ethereum." Featuring @zachobront and @ethzed with @MitchellAmador.

https://t.co/a1cyWETmhC

Fresh details on the @Balancer V2 exploit - like the attacker's binary search via reverts & decompiled math helper code. Deep dive into rounding biases & on-chain forensics ⬇️ https://t.co/Eai3qDbNbx

I think the top bug hunters should be rewarded by the bug bounty platforms with DATA. I want to know which projects are actually worth my time to audit, not waste hours on trial and error. Give us a transparent list of projects that actually care about security. It’d save a

Foundry has a new release candidate: v1.4.0-rc3! Highlights include: backtraces, configuration inheritance & multi-chain configuration, forge fmt powered by Solar🌞, enhanced coverage guided fuzzing, custom precompiles & many performance improvements! $ foundryup -i v1.4.0-rc3

https://t.co/W8Ih7CGiln

New post: @RelayProtocol’s contracts trusted Ed25519 verification without validating offsets, opening the door to forged allocator signatures and potential double-spends. @_fel1x details the bug, the risks it posed to cross-chain liquidity, and how the issue was addressed.

Expecting something coming.

https://t.co/GjuYfqHRp6

Threat Contained: marginfi Flash Loan Vulnerability by @_fel1x A new instruction broke the flash loan logic, creating a way to borrow without repaying and putting $160M at risk. We explain the vulnerability, potential impact, and how it was fixed. Full post below ↓

Very solid codebase, congrats to everyone!🫡

lol🤣

don't let this be you anon

NEW: What looks like a normal Solidity compilation ends in a crash. In our latest post, we trace the issue to a 12-year-old G++ bug and explain exactly how this can happen. Full breakdown + recommended fixes 👇 https://t.co/8XIC7uNnT0

I've been in crypto for over 10 years and I’ve Never been hacked. Perfect OpSec record. Yesterday, my wallet was drained by a malicious @cursor_ai extension for the first time. If it can happen to me, it can happen to you. Here’s a full breakdown. 🧵👇