Pardon my crypto ignorance, but if someone took over the entire SEI platform, wouldn't the value of SEI coin drop to zero?
Sei pays out $2M bug bounty
91–100 of 133 posts
Re: Sei pays out $2M bug bounty
#92Earlier quoted context omitted.
Everything in Crypto (for both meanings of the word) has a built in bug bounty. It's just whether or not the companies want to take part in it.
You could say that about anything that is critical.
Try thinking through other comparisons to understand the difference: if I find a bug in the power grid, how do I cash out? There aren’t many buyers, it’s really hard to move a lot of cash without getting caught, and if I use any other electronic system I have to pay a ton of money to get help laundering it because the risks are so high. Criminal outfits in Asia play games trying to get gift cards or things like that but it’s hard to scale and a lot of their dupes here get caught.
Contrast that with cryptocurrency where a bunch of VC money pumped up a market for you to launder the proceeds and the protocols are intentionally designed not to have antifraud protections. Ransomware was possible a decade earlier but the profitability went up massively once it became easy to launder millions rather than hundreds of dollars.
Re: Sei pays out $2M bug bounty
#93Earlier quoted context omitted.
> And there just aren't enough security people yet that market forces have commoditized bounty finding. I have the opposite conclusion there, crypto organization sponsored bug bounties are far more accurately valued than Web 2.0’s arbitrary adversarial bug bounties, and have attracted tons of developer talent to crypto bug bounties and the crypto ecosystem as a whole
> and have attracted tons of developer talent to crypto And yet: "Both issues were caught after the code had been audited, merged, and slated for release" I wonder who did those audits?
The answer to this question is out there, but the reports are not published yet.
I caution readers to not make rash judgements on their skill like this though. These bugs are really hard to find, and it was a minor miracle that I noticed these ones at all. I actually had a whole list of critical bugs in this codebase ready to report before the V2 upgrade was merged to master (which would put it in scope for a bounty). However the auditors managed to find every single bug on my list. I only noticed the ones that eventually made it here later, by a stroke of luck, and after I had already spent a ton of time looking at this codebase without noticing them.
Re: Sei pays out $2M bug bounty
#94Earlier quoted context omitted.
Not true. My father (71) always was the same, anti-bitcoin etc. Until he needed to pay for online TV (do nt ask, but it was impossible to pay w card)
"Online TV" that requires payment in crypto, and doesn't take card... without more info, it's pretty safe to assume that service is not provided legally.
It may just be a matter of where they live. I got used to sending money in btc to my grandmother because the countries we live in currently happened to be at war with each other and bank transfers were not an option.
Re: Sei pays out $2M bug bounty
#95The bounties in crypto are so big because the math is so clear on the cost vs benefits of the bounties. Paying two million to avoid losing a billion is not a bad deal. And there just aren't enough security people yet that market forces have commoditized bounty finding. Good companies use bounties as yet another security layer - after doing everything else, add a bug bounty! Almost all crypto bug bounties run through…
Everything in Crypto (for both meanings of the word) has a built in bug bounty. It's just whether or not the companies want to take part in it.
Everything in finance... banks have the same bug bounty.
Re: Sei pays out $2M bug bounty
#96Earlier quoted context omitted.
> and have attracted tons of developer talent to crypto And yet: "Both issues were caught after the code had been audited, merged, and slated for release" I wonder who did those audits?
The answer to this question is out there, but the reports are not published yet. I caution readers to not make rash judgements on their skill like this though. These bugs are really hard to find, and it was a minor miracle that I noticed these ones at all. I actually had a whole list of critical bugs in this codebase ready to report before the V2 upgrade was merged to master (which would put it in scope for a bounty)…
congratulations ser
did you try other things like try to get employed by the team, or consider submitting an altruistic pull request? or was the bug bounty the adequate incentive from the getgo
Re: Sei pays out $2M bug bounty
#97 "
Cosmos uses go panics for error handling. Transaction runs
out of gas? panic. Try to spend more coins than you have?
panic. Invalid inputs? panic.
...
For safety, later on the panic was removed entirely.
"
Re: Sei pays out $2M bug bounty
#98Earlier quoted context omitted.
You could say that about anything that is critical.
Try thinking through other comparisons to understand the difference: if I find a bug in the power grid, how do I cash out? There aren’t many buyers, it’s really hard to move a lot of cash without getting caught, and if I use any other electronic system I have to pay a ton of money to get help laundering it because the risks are so high. Criminal outfits in Asia play games trying to get gift cards or things like that…
I have a general rule of exploit sales which nobody has shot me down on yet and I'm increasingly confident about: people are buying non-speculative outcomes. Every dorm room conversation about vulnerability valuation inevitably veers into speculation about what bank-shot outcomes a buyer might hope to achieve with a purchase. The reality is that unless the buyer is getting exactly an outcome they already planned (and, usually, have already repeatably achieved), they're not interested. Exploits have to slot into existing business processes.
This explains reliable, stealthy, zero-interaction full-chain iOS vulnerabilities, which fit into every intelligence, military, and law enforcement business process pin-compatibly. It explains browser vulnerabilities and ATO vectors.
And it also approximates the market for blockchain vulnerabilities: if the exploit is "literally transfer untraceable cash from victims to buyer", lots and lots of criminal organizations already have that business process; you probably simplify their existing repeatable process.
Blockchain vulnerabilities thus have a very credible market. As bonus: the work of discovering and POC'ing these vulnerabilities may be gnarly, but the engineering required to exploit them at scale probably isn't. It doesn't take months of R&D to make the exploit "reliable", it generates straight cash until it dies (and probably has a half-life measured in minutes), and so on.
Every lucrative class of vulnerability has some kind of story like this; they all fit into some existing, very clearly stated demand.
We get into trouble trying to generalize. All the markets are very specific; they're all sui generis. Most vulnerabilities are worth zero. There are mobile OS RCEs that are probably worth zero!
Re: Sei pays out $2M bug bounty
#99Honest question: Was the $2M figure advertised in advance? Where does one go about discovering bug bounties of this size? It seems like it might be worth the gamble of taking 3-6 months off work to discover a bug of that size.
Yes, that is actually worth it. This seems comparable to what a third party might pay. I have always wondered why the payouts are capped at the trillion dollar corps at such low figures. It appears like $75k max and MS and $100k max at Apple. Meanwhile shady 3rd party groups will pay you 10x that, won't they?
Apple outbids bottom- and mid-tier buyers, and top-tier buyers are extremely finicky about what they're buying: exploits, not vulnerabilities, for reliable bugs, with a variety of additional constraints. Apple and Google will buy exploits top-tier IC buyers won't, with less negotiation and less risk.
The major parties to this market are aware of each other and are calibrating against each other; Apple and Google aren't blowing this off. It's complicated and counterintuitive in a bunch of ways.
Re: Sei pays out $2M bug bounty
#100Earlier quoted context omitted.
Everything in Crypto (for both meanings of the word) has a built in bug bounty. It's just whether or not the companies want to take part in it.
Everything in finance... banks have the same bug bounty.
Not really. Bank transactions are reversible (especially when banks themselves are affected). And if you try to wire money to your account, you will be found trivially.