Summary: On May 27th, whitehat pwning.eth submitted a missing call check critical vulnerability to the Moonbeam network via Immunefi, demonstrating the possibility of a direct theft of the native assets, such as Moonriver (MOVR) and Moonbeam (GLMR), which were deployed using pre-compiled contracts. …

On May 14th, ChainSecurity employee @k_besic reported a vulnerability classified as “Medium” in Balancer protocol. The vulnerability consisted of a potentially exploitable Denial of Service (DoS) scenario by emptying double entry-point ERC-20 tokens through Balancer’s flash loans. Balancer paid k_besic $50,000 USDC for his excellent find. While there were no…

At the ‘Off the Chain’ Web3 security conference in San Francisco in June, Unciphered–a cryptocurrency asset recovery company–unveiled three novel exploits impacting popular (and once-popular) crypto wallets Electrum Bitcoin Wallet, Trezor One, and Ethereumwallet.com. While the recovery of more than 1400 private keys from the long-defunct and non-custodial crypto wallet…

Summary On May 2, 2022, whitehat thunderdeep14 submitted a critical bug in Synthetix via Immunefi, which the Synthetix team then shortly patched. For his bug find, thunderdeep14 was paid $100,000, which is the max critical reward for Synthetix’s bug bounty program on Immunefi. Additionally, since Synthetix is eligible for matching payouts…

You’ve probably heard about all of the epic disclosures in the Web3 bug bounty space recently and decided that maybe it’s time to pave your way to the Immunefi Hall of Fame. …

In the wake of the intricate, multi-flashloan exploit that bankrupted DeFi investing platform Indexed Finance last year, the blockchain community is reckoning with the validity of the famous, yet poorly understood ethos that ‘code is law’. …

Summary Whitehat nojob reported a critical vulnerability in Port Finance via Immunefi on March 29. If a malicious attacker had exploited the vulnerability, they could have stolen $20–25 million. But because of nojob’s responsible disclosure, no user funds were lost. Port Finance promptly patched the bug and paid the whitehat $180,000…

By the time he was 8, t11s was playing Mozart’s Piano Sonata №1 in C major, K 279/189d (Munich, Autumn 1774). By the time he was 11, he mastered Klingon (eclectic interests, we’ll admit). And by the time he was 14, he sat down to read the Ethereum whitepaper and…

Summary On April 22, whitehat Violet Vienhage submitted a critical vulnerability in Sense Finance via Immunefi. Sense operates as decentralized, permissionless infrastructure, where teams can build and develop new yield primitives for DeFi, such as bond-like assets, yield tokens, and tranche-like instruments. Yield-stripping is the first application built on Sense, where…