12 ms·
Coinbase awarded a $500k bug bounty
- dankwizard 2y agowhat was it
- vdfs 2y agoMost likely a bug
- koolba 2y agoThere doesn’t appear to be any details on the site besides the recipient: certik Anybody familiar with that name is probably chuckling right now.
- mtmail 2y agoI'm not familiar. What am I missing?
- koolba 2y agoThey perform audits of crypto projects. The idea is that you’re certifying that the code is not going to immediately steal people’s money. Quite a few of their clients have gone on to do that with relatively simple vulnerabilities. To the point where “certik audit” is a meme about not providing any actual assurances (and thus implying they are incompetent). There also was the story a month or two ago where they actually took funds from a bug bounty target and eventually did give it back: https://blockworks.co/news/krakens-cso-confirms-certik-returned-funds-with-a-small-amount-lost-to-fees https://blockworks.co/news/krakens-cso-confirms-certik-retur...
- gnfargbl 2y agoThat's just the classic attack/defence asymmetry though, no? When playing defence you have to find every reachable vulnerability. When playing attack, you have to find one.
- londons_explore 2y agoIt highlights the fact that even experts can't find every bug in code, and therefore you probably shouldn't be using code as the only security for a monetary system.
- user90131313 2y agoThey are %100 corrupted people and stealers.That story a month ago is mind blowing. Black hat type
- oersted 2y agoI know this is rather obvious and has been repeated to death but: There's just absolutely no point to crypto if you end up having to trust institutions that are fundamentally less trustworthy than mainstream financial institutions and regulators, even if they have plenty of issues too.
- npoc 2y agoAbsolutely correct regarding cRypTo. But there's also bitcoin, which people wrongly group with it. They are two completely different things, once you dig a bit deeper. One is going to improve the world immeasurably - in fact one of mankind's most important (maybe greatest) inventions, and the other is a snake pit. If what I say sounds crazy, it won't after you've studied the topic for 5000 hours.
- netsharc 2y agoIt's so funny when crypto banks get robbed and they turn to the FBI to ask them to get the robbers...
- kybernetikos 2y agoI see no problem with this. Crime doesn't stop being crime just because its happening to virtual assets. Maybe some crypto folks want to disconnect from the rest of society, but I don't think that's very many of them.
- FireBeyond 2y agoMany folks said the Silk Road had made drug dealing "harmless". What they really meant was "harmless to me". Because it does nothing for anyone else in the chain to make it safer. There's also a non-zero sum of crypto proponents that think a large swathe of things that are illegal "IRL", should be non-criminal because ... "online".
- jenadine 2y agoThere are people who think some things that are illegal shouldn't be illegal. (Online or IRL doesn't matter)
- montenegrohugo 2y agoCertik has a terrible rep in the crypto ecosystem They're ostensibly an audit/security firm, but miss many vulns Most egregiously recently they tried to blackmail Kraken, a big exchange, for $2m
- frankjr 2y agoWell, "certik" does translate to "little devil"...
- user90131313 2y agooh so the founders already had the idea. so no surprise at all
- oersted 2y agoYes I believe the direct translation is simply "imp".
- qqqult 2y agoCrypto security audit company that used to be decent & somewhat respected then scaled out and hired many more security auditors with questionable skills and morals (such as exploiting bugs in projects they're paid to review & help). The running joke is that protocols with no security audits are safer than protocols with security audits done by CertiK.
- 1023bytes 2y agoConspiracy theory - they bought it from someone else for PR
- forty 2y agoWhat should we understand? It looks like the H1 account is the actual company, at least they link to their website. Is the company doing bug bounty? Or is this a creative way to pay for an audit?
- danielvf 2y agoFor those looking for context: https://news.ycombinator.com/item?id=41128441 https://news.ycombinator.com/item?id=41128441
- StrauXX 2y agoIs this the highest single bounty ever payed? The only other paymnts in this range I can think of are the yearly rewards by Google. But then again thats not really a bounty.
- BillFranklin 2y agoSomeone got a $10m bounty in another crypto platform Wormhole
- ackbar03 2y agoThat sounds more like a ..um.. ransom than bounty..
- yieldcrv 2y agoThe ransom would have been a few hundred million So, no. Crypto organizations float closer to the same market value of exploits that you see blackhat organizations like NSOGroup pay. Its just FAANGs that refuse to value them correctly and put up barriers of entry for pennies.
- SushiHippie 2y agoAt least on Hackerone this seems to be by far the highest Bounty https://hackerone.com/hacktivity/overview?queryString=disclosed%3Afalse&sortField=total_awarded_amount&sortDirection=DESC&pageIndex=0 https://hackerone.com/hacktivity/overview?queryString=disclo... The next highest bounty is $200k from Shopify and then again Coinbase with $115k
- KomoD 2y ago> At least on Hackerone this seems to be by far the highest Bounty You can't know that, not all bounty amounts are disclosed, and there's also private/confidential programs.
- tromp 2y agoA $250K bounty was paid for uncovering a bug in Grin: https://forum.grin.mw/t/ann-bug-bounty-awarded-to-david-burkett-grin/8672 https://forum.grin.mw/t/ann-bug-bounty-awarded-to-david-burk...
- tshanmu 2y agocertik appears to be a web3 smart contract audit company
- deleted 2y ago[deleted]
- Max-Ganz-II 2y agoI have to say, I did not have a positive first experience with H1. Probably mainly my misunderstanding, but H1 did not help in any way. I opened an account, filed a report - I can easily crash Amazon Redshift as an unprivileged user. Provided the DDL/SQL to do so - dead simple, two statements, issue them and boom. I received a reply, something like, "we have closed the report, if you can demonstrate a working issue we'll investigate further". I was confused, replied and asked for explanation. No reply. I tried going to their Support, 403 - doesn't work via Tor browser - no use for an anonymous report. And that seems to be it - end of road. I don't understand, no replies, no support, and I've disclosed valuable information and I have no idea what H1 have done or are doing with it (if it's been made public, for example). (I asked on HN for advice. One line of reply was that this is not an exploit, but a bug, which I can see. OTOH, when I filled in the severity rating form, there was nothing in that where I was evidently going against the grain of what was expected, so I'm not wholly sure. Any further advice in replies now gratefully received.)
- londons_explore 2y ago> crash [...] as an unprivileged user. DoS stuff typically wouldn't qualify for most bug bounties. Thats probably why you got ignored. Most services aren't awfully interested in fixing this sort of thing - they'll just wait for someone to try and DoS at scale, then have the oncall team put in some extra regex on the input which blocks that specific expensive/crashing query.
- piyush_soni 2y agoIn the Right panel on the page: $1,996,583 Total bounties paid I don't know if I should feel happy or concerned about the security policies of a company that has already given 2 million USD in bug bounties :).
- SheinhardtWigCo 2y agoYou should be far more concerned about the ones that have given $0.
- welder 2y agoI want to offer rewards (my site is on H1) but they require I sign up for a minimum $50k/yr subscription to enable that feature. I don't think that's a reason for concern, just means it's a smaller company.
- cyanydeez 2y agoIt means you can afford to be more secure. Poverty is just a basic gateway. I imagine hackers have to do some calculus on bigger vs little, since usually larger targets are more valuable, buy smaller are likely less secure.
- grumple 2y ago50k a year is insane. It's just a messaging platform. Advertise your own bug bounties and just have them email you, voila.
- a_dabbler 2y agoIf you get a lot of reports you'll probably be paying attention least one person 50k/yr to manage it
- deleted 2y ago[deleted]
- rvz 2y agoAgain, we have another 6-figure winner on finding a vulnerability in a crypto exchange and the payouts are way more than the average bug bounty these days (especially for critical bugs). For crypto skeptics and those who REALLY hate crypto, this is a great opportunity to turn your passion of hating all over it into a lucrative hunt for bugs like this one and to make a massive killing from the payouts. Just think about it.
- wasteduniverse 2y agoIf I hated crypto companies, why would I help find bugs for them?
- lifty 2y agoI think the OP was obvious. To make money.
- rty32 2y agoCost/benefit analysis? What is the chance I would someday get a $500k payout, starting from near zero experience today, with the help of a little bit of luck?
- saliagato 2y agoCan't comment on the cost (varies depending on who you are and what you do in your life) but the benefit is really high. source: I started from 0 and the very first bounty I submitted (related to CEX) was valued to $100k+
- Loughla 2y agoHow long did that take? How long was the 0 to reward process, and how much time did you spend?
- modernerd 2y agoCrypto skeptics probably don't trust crypto firms to pay the "rewards up to $15,000,000" bounties advertised at places like https://immunefi.com/ https://immunefi.com/. Immunefi has a similar payouts table to h1's at https://immunefi.com/bug-bounty/ https://immunefi.com/bug-bounty/ implying people are getting paid, but it could boost credibility by linking to write-ups and findings from researchers if any exist.
- deleted 2y ago[deleted]
- vishnugupta 2y agoLooked around and they seem to be a company rather than an individual? https://www.certik.com https://www.certik.com One of its co-founders is a Yale professor https://www.linkedin.com/in/zhong-shao-545b754/ https://www.linkedin.com/in/zhong-shao-545b754/ One is at Columbia University https://www.linkedin.com/in/guronghui/ https://www.linkedin.com/in/guronghui/ Interesting!
- deleted 2y ago[deleted]
- miohtama 2y agoCertiK is also notoriously bad reputation auditor company, having black hats on their payroll, and promoting scam projects.
- lagniappe 2y agoblack hats working for an auditing company is like being mad that your dentist cheated on his taxes. your teeth look great either way.
- RIMR 2y agoYou want former black-hats only, with a reputation of being a white-hat hacker in the present day. Handing tons of sensitive customer information to people actively engaged in black-hat hacking and scams is a terrible idea.
- anvil-on-my-toe 2y agoMore like having a drug dealer in your AA group.
- sophacles 2y agoMost AA groups have a few drug dealers.
- gkanai 2y agoCertik is widely used in the blockchain industry for smart contract audit/verification.
- deleted 2y ago[deleted]
- danielvf 2y agoHere's some context, and some fun drama. One month ago this same company found a bug with a 2 million dollar bug bounty. The bug would let them drain funds from a crypto exchange by sending funds to the exchange on the blockchain, but then after sending, reverting the part of the transaction that sent the funds, while keeping the overall transaction alive. The software at the exchange was fooled into counting the reverted transfer as actually happening. [0] So what do you do when you find an incredibly critical bug with 2 million dollar bug bounty? CertiK researchers choose to steal 3 million. Then when they stole it, they exchanged the bulk of the coins for other coins, and sent some of the funds to an OFAC sanctioned entity. CertiK did not report the massive bug that they were exploiting live, in the wild, in public view, for ten days. When they finally did report it for the 2 million dollar bug bounty, CertiK did not mention the 3 million dollars that they stole. When confronted about it, they referred all questions to the sales team, who made demands and refused to return the money. Two weeks of refusing to return the money pass by, and before the head of security at the exchange posts on Twitter the story [1], without naming the company. So what do you do now there's a now a story out there that some researchers stole 3 million and won't return it. CertiK chose to confirm everything on their official Twitter, loudly proclaim that the team that stole the money was them, and claim that the exchange was persecuting them by threatening legal action for the return of the stolen funds. CertiK founders also retweeted these tweets. After a firestorm of twitter drama, by the end of the day, CertiK promised to return the stolen funds. So CertiK is just some random team of anonymous people, right? Nope. CertiK is 2 billion market cap, company, headquartered in the US, just did 230 million dollars worth of fund raising. (CertiK does have a long reputation for working in ways that no one could conclusively prove if their actions were from evil or from incompetentance.) [0] https://x.com/danielvf/status/1803780167027871878 https://x.com/danielvf/status/1803780167027871878 [1] https://x.com/c7five/status/1803403565865771370 https://x.com/c7five/status/1803403565865771370 [2] https://x.com/CertiK/status/1803450205389402215 https://x.com/CertiK/status/1803450205389402215
- vishnugupta 2y agoThis should be the top comment on this thread!
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]