About · Bug bounty program
My thinking is in scope.
I get paid to find where a protocol’s code stops matching what its team believes. Fair’s fair.
0xtruthlover
Bug bounty program · Live
- Max bounty
- A changed mind
- Ecosystem
- Reality
- Paid in
- Credit
- PoC required
- Yes
- KYC
- Not required
Impacts in scope
Ranked by how far each one would take me from reality.
Critical
Something I hold to be true is false.
Truth is the only asset in scope.
High
I mistook a part for the whole.
Systems fail where their parts interact. So do opinions.
Medium
I worked on something that wasn’t the constraint.
A system has one bottleneck that matters. Effort anywhere else is decoration.
Low
I was right for the wrong reason.
The answer holds this time. The reasoning won’t hold next time.
Invalid
Disagreement without a proof of concept.
A different perspective isn’t a bug on its own. Show me where reality agrees with you.
Overview
I’m a client too
Truth, for me, is reality itself. Everything else is a description of it: a whitepaper, a spec, an audit, a tweet and this page. A bug is the distance between the story and the execution.
In one bug I reported, a single signed Solana block could be dead to every Agave node and worth a vote to every Frankendancer node. Both clients would be certain. The network would split along the line between them.
I’m a client too. I run one view of reality, and I can fork from it like anyone. The motto on my home page says all others must verify their code. Turns out “all others” includes me. So this is the program: find where my view and reality disagree, and prove it.
Cost
The hard way
I learned the hard way that theft is a bad energy. It consumes your peace and your inner self, your truth. The bill just goes somewhere you aren’t metering.
Method
The system found it
All 60 of my paid findings are AI-assisted. Every one came through some iteration of a harness I built for AI agents. Who found it, me or the model? Wrong unit. The system found it. I built the system.
A model can be fluent and wrong in the same sentence. So can a whitepaper. I don’t take either one’s word for it. Code doesn’t care how anything sounds, and a proof of concept settles it. That’s why this program requires one.
Pattern
Unmetered isn’t free
Three of my write-ups are about broken meters. A Flow dry run that never charged for gas. A Stellar transaction that cost nothing to send and 40,400 signature checks to receive. Memory a gno.land contract used that the VM never counted. Each time, a node did the work and the meter missed it.
Scope
Out of scope
- How the harness works inside. Nice try.
- My psychedelic trips and spiritual awakenings. Some findings only reproduce locally. That’s the record, not a recommendation.
Credit
Hall of fame
These people found bugs in how I think before anyone else did. Send one of theirs and it closes as a duplicate.
Treating one perspective as reality
Reported by Eben Pagan
Also covers seeing systems whole. Still my highest-paying fix.
Testing every part and never the integration
Reported by Daniel Schmachtenberger
Gas-golfing a function nobody calls
Reported by Rich Schefren and Eliyahu Goldratt
Underrating truth, intelligence and awakening
Reported by Leo Gura
Root cause of the white hat.
Using LLMs as a black box
Reported by Andrej Karpathy
Underestimating how far LLMs can go
Reported by Anthropic’s blog (yes, really)
The report that got me into bug bounty.
Quoting the 80/20 rule without applying it
Reported by Richard Koch and Perry Marshall
Came with steps to reproduce.
Talking about agents instead of building them
Reported by Andrew Ng
Knowing the math without the intuition
Reported by 3Blue1Brown
Anything still broken is mine.
First disclosed on X, .
Submit
Submit a report
Found one? Send it on X with a proof of concept. If it holds, I’ll say so.
Reports in the other direction are welcome too. Open to security review work on blockchain protocols, smart contracts and web apps. Reach me on X.