usmann
@usmannk
Followers
4K
Following
4K
Media
68
Statuses
1K
a bit confused | Head of Protocol Security @Plasma 🕊️
Joined November 2010
any devconnect attendees looking for a @DeFi_Wonderland ctf team? 🫡
Dear algorithm, Please show this post to every Security Researcher attending Devconnect. Join the Wonderland CTF: https://t.co/fzlphjiNjp Thank you.
1
0
12
New chains are launching as L1s while others are migrating to become Ethereum L2s. Join @bkiepuszewski, @usmannk, @zkLumi, @vladbochok1, and @jgorzny as they discuss the real security tradeoffs between building as an L1 or an L2, and what it means for DeFi protocols and users.
5
4
18
RIP kitkat. here he is investigating some paint
A cat known as the “mayor of 16th Street” was allegedly run over by a Waymo Monday night, sparking grief around the Mission Dolores bodega where he roamed. 📝: @allaboutgeorge
4
0
27
also someone in the brazilian government should probably check their Google org for compromise here?
0
0
2
Personal announcement: I’m joining @PlasmaFDN as Head of Protocol Security. Stablecoins are the future of money. Anyone with an internet connection can use them. If stablecoins are going to form the foundation of a thriving economy, we have a lot of work to do to make sure
133
39
525
Apple hates its (developer) customers so much. No good examples, no good docs. Every reference you need is buried inside a WWDC video from 5 years ago. Of course SDK source is unavailable.
1
0
7
wish someone would make a SWE AI for iOS apps specifically. writing software for apple devices is mindbogglingly difficult. it was literally easier to create Android apps in 2012 using Eclipse IDE than it is to make an iOS app in Swift (or its piece of shit cousin SwiftUI) today
4
0
10
to be clear i think they should notify their users, i wish they would, and i think they might even be legally required to lol. but what am i gonna do, sue them? i dont want to get in a fight with any well funded company
0
0
7
users have no clue how vulnerable many apps are. I once reported to a somewhat prominent dating app that every user's DMs were exposed along with their lat/long email phone # etc. Took them many months to fix. Once it's fixed it's not really worth it for they or me to publicize.
This is why you don't roll your own security, even for an MVP. Security researcher investigates app that only has magic sign-in, and immediately finds that instead of checking the OTP server-side, they send it as a response to the client request. Allows to take over ANY
1
0
18
Last week I reported a Critical bug to @Scroll_ZKP via @immunefi. Massive shoutout to the team for their exceptional commitment to security. The issue was mitigated within minutes after the report. Glad to contribute to Scroll and the Ethereum ecosystem 🧙‍♂️📜
3/ Issue 2: Bridge Message Spoofing A separate bug (reported by @WhiteHatMage via @immunefi) could have allowed attackers to mint ETH or ERC20 tokens on Scroll by spoofing messages across L1 and L2. This vulnerability came from a change introduced during the Euclid upgrade.
48
22
329
theres still 77M unlocked MELANIA tokens ($45M at market) that for some reason have not been claimed by team for weeks https://t.co/80LA5RCnXa
lock.jup.ag
Lock & distribute tokens over time with this open-sourced and audited program.
Nice $TRUMP unlock soon. Will short this to zero before the unlock. $409M unlock lol.
1
0
6
it does this by adding chatgpt to its LSApplicationQueriesSchemes and calling canOpenURL
0
0
2
related to this, you might not know that every time you open the @grok app it checks if you have @ChatGPTapp installed and sends that info back to its servers
Since the app exploiting it was leaked, I’m leaking the function they used. Don’t know if it’s exploitable on latest or not.
2
3
13
this was written for traders but it applies to SRs just as much
As a logical thinker, until you get data points on the board to plot out and see a trajectory for yourself, it’s hard not to have the imposter’s syndrome. Up until the point that you prove to yourself that you’re on the right track, you kinda have to be delusional by default.
0
2
25