Open for SR roles.
A brief summary about me:
1. All-time Top 10 Immunefi whitehat
2. Found bugs enabling ~$51M / ~$1M withdrawals (Tokemak, Wormhole)
3. Recently: $1.2M impact via BugChainIndexer
4. More fund-extraction vulns (undisclosed)
Details: github.com/kismp123
gegul retweeted
Chinese LLMs can hack better than state-sponsored hackers with properly evolved harness -
Kimi K2.5 managed to find and exploit 6 vulnerabilities in browsers: a single page view or an extension install by victims equal full system hijack.
Check arxiv.org/abs/2604.20801
I just combined BugChainIndexer + BugChainAudit.
Now every contract can be instantly audited.
api.bugchain.xyz/audit
→ Run automated audit
→ Surface potential vulnerabilities
Still early, but this is how I’m building a fully automated audit.
gegul retweeted
Cross-chain bridges remain critical infrastructure, proof verification is the core of their security model.
New disclosure on our research page: a vulnerability in the Polygon Plasma bridge that allowed transaction proofs to be forged.
At the time of discovery, $800M in POL was at risk, exploitable in a single transaction with no prerequisites.
The research covers how the proof verification breaks, how the exploit was built, and what it means for bridge security.
Full technical deep-dive: hexens.io/research/polygon-b…
gegul retweeted
I Saved Injective's $500M. They Pay Me $50K.
I like hunting bugs on @immunefi . I'm decent at it.
- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)
Life was good. Then I found a Critical vulnerability in @injective .
This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.
I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.
Then — silence. For 3 months. No follow up. No technical discussion. Nothing.
A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.
I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.
I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.
Full Technical Report: github.com/injective-wall-of…
I believe smart contract exploits have trends.
They’re not random — they repeat.
Recently, two patterns show up again and again in real incidents:
• Exploits in closed-source (unpublished) smart contracts
• Rounding & precision errors
Closed-source contracts are often assumed to skip audits because audits cost money
(usually $50k–$100k).
But in a recent ~$26M exploit, the contract already held significant funds.
Paying for an audit was clearly possible.
gegul retweeted
In 2025, big names like Balancer & Yearn got hacked hundreds of millions stolen from users due to rounding issues.
To close the year, here's a quick article on how to think about rounding problems when auditing smart contracts.
Sharing 3 years of accumulated knowledge from top auditors and my own experience. Hope you like it!
gegul retweeted
Harvard just leaked their Senior Engineer roadmap for free.
Stop paying for $2,000 bootcamps. Prof. Vijay Janapa Reddi just put the entire ML Systems (CS249r) curriculum on GitHub.
If you master these 6 pillars, you're ahead of 99% of the field:
🏛️ Architecture
🚿 Data Pipelines
🚢 Production
🛠️ MLOps
🔋 Edge AI
🔒 Privacy
This is the "Black Box" of Big Tech infrastructure, open-sourced.
This is the "Black Box" of Big Tech infrastructure, open-sourced.
Read. Learn. Bookmark.
gegul retweeted
My article “Introduction to cybersecurity in digital assets and cryptocurrencies” is now published by Oxford University Press (Oxford Law Pro).
Web3 cybersec is fundamentally different from traditional IT security & that difference matters legally.
#Cybersecurity #CryptoLaw
🧵
gegul retweeted
yeth exploit post mortem
github.com/banteg/yeth-explo…
gegul retweeted
.@Balancer and several forked projects were attacked a few hours ago, resulting in losses exceeding $120M across multiple chains. This was a highly sophisticated exploit. Our initial analysis suggests the root cause was an invariant manipulation that distorted the BPT price calculation, allowing the attacker to profit from a specific stable pool through a single batch swap.
Take an attack TX on Arbitrum as an example, the batchSwap operation can be broken down into three phases:
1. The attacker swaps BPT for underlying assets to precisely adjust the balance of one token (cbETH) to the edge of a rounding boundary (amount = 9). This sets up the conditions for precision loss in the next step.
2. The attacker then swaps between another underlying (wstETH) and cbETH using a crafted amount (= 8). Due to rounding down when scaling token amounts, the computed Δx becomes slightly smaller (8.918 to 8), leading to an underestimated Δy and thus a smaller invariant (D from Curve’s StableSwap model). Since BPT price = D / totalSupply, the BPT price becomes artificially deflated.
3. The attacker reverse-swaps the underlying assets back into BPT, restoring balance while profiting from the deflated BPT price.
Attack TX on Arbitrum: app.blocksec.com/explorer/tx…
ALERT! @Balancer and several forked projects have been attacked. Any forked projects should stay alert and monitor closely!
The losses were as follows:
Eth: balancer, 70m
Base: balancer, 3.9m
Polygon: balancer, 117k
Sonic: beets, 3.4m
Arb: balancer, 5.9m
Op: beethoven, 283k
gegul retweeted
Dear Founders, CTOs, Managers, and Developers,
I want you to read the quoted tweet and genuinely imagine this happening to your own product, the one you’re building or have already built.
The truth is, the founders of Bunni probably never took security seriously. And just like them, many of you still don’t, because “security doesn’t make money,” right? “We’re a small business,” “hackers won’t bother with us,” “we’ll deal with it later.”
That mindset is exactly how companies end up in situations like this.
Every time I get the opportunity to speak with people in your position, I emphasize one thing: invest in security early. Hire at least one competent security engineer. Budget for external penetration testing, not for compliance, but to protect your brand, your customers, & your reputation.
Security might not directly generate revenue,
but it prevents you from losing everything you’ve built.
Yes, security is expensive.
Yes, security is a choice.
But the cost of a breach is a hundred times greater, and when that day comes, you’ll realize it’s no longer a choice, it’s a debt you’ll have no option but to pay.
Please, take this as a wake-up call.
Reflect, & start taking security seriously, before someone else forces you to.
Help tag any founder, engineering manager, or developer to read this.
Hello everyone, it is with saddened hearts that we announce the shutdown of Bunni.
The recent exploit has forced Bunni's growth to a halt, and in order to securely relaunch we'd need to pay 6-7 figures in audit & monitoring expenses alone – requiring capital that we simply don't have. It'd also take months of development & BD effort just to get Bunni back to where it was before the exploit, which we cannot afford. Thus, we have decided it's best to shut down Bunni.
Here's what will happen:
- Bunni users will still be able to withdraw assets via the Bunni website until further notice.
- We intend to distribute the remaining treasury assets to BUNNI, LIT, and veBUNNI holders based on a snapshot. However, the validation of the legal process is ongoing, and the exact details of the distribution will be shared at a later date once the legal process is finalized. Team members will be excluded from the snapshot.
- The Bunni v2 smart contracts have been relicensed from BUSL to MIT, enabling everyone to utilize our innovations such as LDFs, surge fees, and autonomous rebalancing. We have pushed the AMM space forward by a generation, and it would be a shame if our efforts went to waste.
- We will continue working with law enforcement to recover the stolen funds from the exploiter.
Thank you to everyone who has supported us throughout our journey to push DeFi forward.