0xDjango
@0xDjangoOnChain
Followers
2,666
Following
474
Media
46
Statuses
976
Building @FlexyBridge ⚔ #40 @immunefi 🛡️ judge @code4rena 🤙 the bear is sticky with honey
Joined February 2022
Don't wanna be here?
Send us removal request.
Explore trending content on Musk Viewer
Adalet
• 192561 Tweets
Linkin Park
• 188537 Tweets
Gazze
• 117684 Tweets
Engin Polat
• 113053 Tweets
ベイマックス
• 102148 Tweets
Chester
• 96814 Tweets
雇用統計
• 37124 Tweets
Game Day
• 36623 Tweets
大阪府警
• 35838 Tweets
NANON LETSGO NYFW
• 35768 Tweets
エイリアン
• 33655 Tweets
#サクサクヒムヒム
• 31946 Tweets
#ساعه_استجابه
• 30476 Tweets
金メダル
• 29204 Tweets
#浦島坂田船11周年
• 22857 Tweets
#DAY6_9th_Page
• 22276 Tweets
KIDNAP CHAPTER ONE
• 21550 Tweets
Franco Escamilla
• 20680 Tweets
HAPPY BIRTHDAY TANNIE
• 20408 Tweets
#데이식스_청춘의_9번째_페이지
• 13850 Tweets
おぱんちゅうさぎ
• 11552 Tweets
ロムルス
• 11407 Tweets
In November, I submitted a critical bug to Cronos (
@cronos_chain
) which they downplayed and have since been kicked off Immunefi. Here's some info about the bug and an example of how projects can simply not pay a fair amount.
Report:
tl;dr:
- It's a
45
70
384
I started hunting on
@Immunefi
about 1.5 years ago, devoting about 50% of my time. Here are my stats so far:
Paid:
- 4 Critical: $256k
- 3 High: $64k
- 5 Medium: $23.3k
- 3 Low: $4.2k
Duplicates:
- 5 Critical
- 3 High
- 3 Medium
29
23
366
I tested popular bridges to calculate their total cost and total bridging time. Here's what I found:
Parameters:
- I bridged ~$30 worth of ETH from Base to Optimism using each platform.
- I initiated the bridge transactions as quickly as possible to reduce variation in L1 fees.
20
72
166
Just stumbled upon an EOA that collects all of the funds accidently sent to Optimism Portal contracts (e.g. Base Portal). They've made roughly $50k in the last 6 months. I don't think it's illegal but I wouldn't feel comfortable skimming from people's mistakes.
8
9
134
BIG NEWS! After months of tireless work, we're finally ready to announce Gasbot's successor, Flexy ⚡
@flexybridge
What is Flexy? Flexy is a full-scale, cross-chain bridge offering the lowest bridge fees, fastest bridging time, and our signature gasless transactions!
Fewer
19
12
116
I was born to be an auditor. When I was 7, my parents brought me to a restaurant where they knew the owner. He brought us to a special table made of glass, and on the inside were thousands of individual dried paint drops. He told us that he paid over $500,000 for it and that no
5
1
111
2024, I'm committing full time to
@gasbot_xyz
. I think we have something truly game-changing for crypto users everywhere.
No more auditing, hunting, or judging for me for the foreseeable future. Buidling has been a wildly rewarding experience and I'm excited to stoke that fire
15
3
104
Just found ~$18,000 in a contract that can be skimmed. It’s pretty wild how much money is available for anyone to grab. Ethically questionable though
10
0
96
@cronos_chain
It's fitting that they were exploited last month, for the exact amount as the max bounty 😂
7
4
91
I submitted a critical theft of NFTs to a protocol a couple weeks ago. A user can steal an NFT that they had previously deposited that is later deposited by another user.
1) attacker deposits NFT into protocol
2) attacker approves himself as an operator
3) attacker withdraws and
13
4
83
I'm looking to hire a Web3 dev for building out a few pages and integration with a few contracts. Ideal candidate is well-versed in:
- NextJS
- WAGMI
- RainbowKit
- making stuff look goooooood
DM me with some example work if interested!
22
6
84
Extremely excited to announce that
@gasbot_xyz
has received financial support from the Meter blockchain (
@Meter_IO
) 🎉🎉
This support helps allow us to integrate Gasbot’s seamless cross-chain gas delivery service into the Meter chain. A big thanks to our new friends at Meter 🤝
10
11
80
When I started building
@gasbot_xyz
, I had a vision for cross-chain gas acquisition with 0 transactions from the user. No token approvals, everything off-chain using permit signatures. We achieved that pretty quickly and it's awesome! Everyone who uses Gasbot loves it, but it
3
10
75
Audit contests or bug bounties? I started with contests, then moved to bounties, then have done a little of both here and there.
Given the number of auditors competing in contests these days, I find bounties to be a better use of my time. Even though the number of bounty hunters
5
5
78
I'm beyond excited to share a project I've been working on,
@gasbot_xyz
!
It makes it a whole lot easier to get gas on various chains. If you have some stablecoin, just sign a permit message and we relay you gas on the same chain or another ⚡️
We're
4
9
77
2023 was a great year. Health issues plagued most of it, and forced me to completely change my lifestyle.
January 2023 I was the unhealthiest I’ve ever been. My body was full of toxins that had built up from poor eating habits and the use of topical steroids for an autoimmune
13
0
76
Disappointing. The crit I posted about a few days ago was for
@HookProtocol
. They closed the report without payment following mediation, and now they’re already off of immunefi. I don’t think they plan on fixing the NFT theft issue. Since no NFTs are currently at risk, this is
15
9
68
The Blast contest is the first “audit” I’ve done in a while. I’ve been so deep on the bug hunting side, I’ve forgotten the biggest difference between these two sub-professions.
Auditing a system that hasn’t been deployed yet opens up so much room for systemic issues, as opposed
3
2
68
Following my previous post, the Tectonic team reached out to initiate a conversation. They worked closely with me to discuss the reported vulnerability. As a result of our meetings, we have agreed to a bounty payout that is fair for all parties. I greatly appreciate the time and
In November, I submitted a critical bug to Cronos (
@cronos_chain
) which they downplayed and have since been kicked off Immunefi. Here's some info about the bug and an example of how projects can simply not pay a fair amount.
Report:
tl;dr:
- It's a
45
70
384
7
4
65
I just found a few thousand Polygon USDC on a random wallet I forgot about, probably from a Code4rena contest. No MATIC though. I got mentally ready to check my other wallets for MATIC and transfer and deal with that BS. Then I remembered I built
@gasbot_xyz
for this exact
5
4
63
When choosing a bug bounty target, quickly check the project on DefiLlama. It tells you:
- TVL trend (projects with declining TVL might have tighter budgets)
- Is it a fork? If so, of what?
- Which contracts hold the funds (i.e. vault)
- Past audits
- Github activity
1
6
64
GasbotV2 is live!! 🎉🎉🎉
With V2, Gasbot is the absolute easiest way to get gas on any supported chain.
- Gas for gas swaps (e.g. $MATIC for $BNB)
- Stablecoin to gas (e.g. Base $USDC for $AVAX)
☝Stablecoins with permit support require 0 user
11
10
63
Just told the mother of my daughter’s best friend that I get paid anonymously in crypto under the name of Django. It feels like telling a muggle about Hogwarts
5
0
61
Even if a blackhat steals millions and is never charged criminally, the bad karma will always be with them. They've sold their soul. This is the most overlooked factor in the whitehat/blackhat discussion.
9
1
62
GasbotV2's round of audits are complete. Here's the list of all security steps that were taken 👇
1) We received extensive help building out the
@gasbot_xyz
test suite, reaching 100% code coverage. We brought on
@testereum
and would highly recommend. Not only is the test suite
7
7
59
I've scraped together some funds and am excited to launch a $10,000 bounty for Gasbot on Immunefi in the near future!
Meanwhile, Cardano:
6
2
60
Throwback to June 2022 when I took an entire Code4rena contest pot with a single medium. I bet this would've received several dupes in today's contest environment. Times were different back then 😅
5
0
55
In another life, I used to make YouTube videos about data analytics. Crazy to think that people still watch to this day, even though I'm years deep into web3 sec 😅
7
0
56
I recommend that all my web3 sec homies get outside of the bubble and experience crypto like the rest of the world. Lend, stake, swap, claim an airdrop. It helps a lot tbh.
Then again, I just came across Gary Gensler Inu token and I think I'm done for the day.
11
1
52
PART 2: I tested popular bridges to calculate their total cost and total bridging time. Here's what I found:
Parameters:
- I bridged $100 worth of USDC from
@base
to
@Scroll_ZKP
using each platform.
- The final bridge fee was calculated as:
Total Fee = (Total USDC Sent - Total
3
5
52
Wow
@gasbot_xyz
has delivered more than $10,000 in gas! Feeling blessed to have hit this milestone so quickly. Truly wild to see how quickly it's grown in under 5 months. Thank you all for the support 🙏
1
0
48
Current Blast Bridge gas fee: $80.57... or you could use Gasbot for $0.96 🚀🤙
8
5
43
People seem to think a project should always have a 10% TVL bug bounty to match what a blackhat would take as a reward. This doesn’t make sense.
Projects pay bounties from their own funds, not TVL (user funds). Assuming a project has millions just sitting around to pay bug
4
8
44
Woke up today wanting to talk so I started a podcast. Talking all things Django, crypto, Gasbot, and anything else that crosses my mind.
1
1
41
Let's go!!! I'm excited to see Code4rena iterating on their model. C4 has done so much good for web3 sec over the past 3+ years. The team always delivers 🔥
1
1
35
Hear ye! Hear ye! Quick announcement for
@gasbot_xyz
📜
We're reducing the Gasbot fee to FREE from now until the end of ETHDenver (March 3rd). Test it out without any fees and see if you like it ⛽
1
6
38
Recently I sat down with
@windhustler
for a fireside chat about auditing, crypto, and life. Listen in for some alpha and get to know your fellow security comrade 🫡
0
2
39
Would anyone be interested in creating a POC for a bug I've already submitted to Immunefi? I've got too much on my plate atm. The work would be paid upon project confirmation.
If interested, hmu on Discord: 0xdjango
5
3
38
Random anecdotal bounty hunting advice:
- always hunt contracts with “helper” or “zap” in the name. These contracts are often written with a focus on convenience, not security.
4
1
38
I'm thrilled with all the positive feedback about
@gasbot_xyz
from the auditing community!
I built it specifically with security researchers in mind. Receiving $USDC to new wallets from contests and bug bounties, and getting gas to move the earnings took too many steps❤️
4
5
34
Let’s do a reverse “DM for audit”
GasbotV2 needs an audit first couple weeks of January. If you’re a skilled auditor and have availability around that time, please send me a DM on discord: 0xDjango
12
1
35
We've just released our gasless cross-chain bridge as an npm package. Blockchain projects can embed the bridge functionality directly in their dapp to help users get gas where they need it ⚡
0
3
31
Proud partner of Sonar and their mission to make DeFi easier to navigate!
Our mission to simplify DeFi is gaining traction with key partners joining our network. Lately, we've welcomed significant players in the crypto world including:
@ibcgroupio
,
@TintashApps
,
@GetOnramper
,
@lifiprotocol
,
@GoPlusSecurity
and more! Thrilled to have them onboard! 🚀
9
49
114
1
8
32
We’re hiring a DevOps Engineer for
@gasbot_xyz
. Please share if you know someone great!
Responsibilities:
- DevOps things
- Python scripting with web3 dot py
- Supporting backend API (Flask)
- System health monitoring
Hit me up on TG with your experience and desired pay:
3
6
33
Awesome seeing this
@gasbot_xyz
integration live on Unreal Destiny on the
@Meter_IO
blockchain! 🔥
Get your $MTR quick and easy through this dope Web3 game 🚀
Now the users can join to the game easy. Use the
@gasbot_xyz
#protocol
to jump into the Unreal destiny action
Send tokens from $ETH $MATIC $ARB $AVAX $BNB to the
@Meter_IO
network and start playing today in our open development
#beta
Now integrated in our
#DAPP
3
9
22
1
5
32
We did it fam!
@gasbot_xyz
has officially been integrated into Sonar Studio. This marks a big milestone for Gasbot and we appreciate the support from the great team at
@SonarPING_
♥
More to come very soon 👀
Gasbot's first dApp integration is live on Sonar Studio 🔥🔥
Sonar Studio (
@SonarPING_
) is an all-in-one interface to discover, track, analyze, and trade on multiple chains. Now offering seamless gas acquisition via
@gasbot_xyz
⚡
3
11
47
4
4
31
I haven’t seen any projects getting Certik audits in a long time. Nice 😎
5
0
31
Currently judging a C4 contest. A lot of reports are ChatGPT, obviously. But my favorite includes what seems like a back-and-forth dialogue:
3
0
31
I’ve been addicted to caffeine since college and felt like I couldn’t start my day without it. Coffee in the morning and coffee in the afternoon. Felt like I wasn’t present unless I was caffeinated.
I always wanted to quit coffee but relapsed whenever the headaches or grogginess
5
1
28
Alright, the repo was sent to the AI auditors and their reports have been submitted. Take a look at the reports and decide for yourself whose is better 👇
Contract: (single contract, 265 LOC):
Reports:
- Nirlin's "human" report:
Update 2:
The contracts and related bug reports have been forwarded to
@0xDjangoOnChain
. He will serve as the intermediary, facilitating the exchange of audit reports according to set rules.
1
0
10
7
4
25
Wow, thanks to EIP-4844, the total bridge cost for is now only $0.50. LFG!!! I did this test one day too early lol
I tested popular bridges to calculate their total cost and total bridging time. Here's what I found:
Parameters:
- I bridged ~$30 worth of ETH from Base to Optimism using each platform.
- I initiated the bridge transactions as quickly as possible to reduce variation in L1 fees.
20
72
166
1
0
25
@v0000000000l
@immunefi
1) I would POC everything, even if not required. My first 10+ submissions were invalid trash.
2) I would learn more before hunting. I was looking for bugs with little understanding of Solidity or EVM lol
2
0
25
It took me over 4 hours to find a way to get native $KAVA on
@KAVA_CHAIN
. All bridges failed and CEXes don't withdraw to that chain.
We just added support for Kava on
@gasbot_xyz
so this will take a maximum of 30 seconds from now on 🫡
0
4
24
Any projects hmu if you want us to support your token in
@flexybridge
. The Flexy widget lets users acquire your token in an ultra-streamlined flow directly from your own dApp 🔥
2
3
24
Who are some awesome smaller scale, first-check VCs?
Asking for a Flexy
3
1
24
It’s pretty dishonest when protocols fork a project, seemingly change little to nothing, and change the “author” comment to their own name. Looking at you
@Unlockd_Finance
6
0
19
LFG 🚀
⚡
@Meter_IO
has seamlessly integrated with
@Gasbot_xyz
.
⛽ Users can now refuel their $MTR utilizing any ERC20 tokens, with the added benefit of completely gas-free transactions.
🔽 VISIT
17
31
92
3
2
22
I didn’t deserve this, but you gotta take all the freebies you can in life 🙏
🥇IllIllI just made $7,920.02‼️
Congrats to:
🥈
@0xDjangoOnChain
- $1,626.00
🥉T1MOH - $542.93
and everyone in the
@BuildOnBeam
audit.
IllIllI made $4,000.00 fixed pay + $3,920.02 from the contest pot!
$15,000.00 rewards ➡️ $4.5M+ paid out in rewards.
2
0
14
1
0
21
Scaffold-ETH 2 is such a cheat code. We built the
@gasbot_xyz
frontend in a fraction of the time it would have taken from scratch.
A big thanks to you
@port_dev
,
@cryptomastery_
, and the rest of the team 👏
Scaffold-ETH 2 just hit 1k ⭐ on GitHub!
🏗️ Scaffold-ETH 2 An open-source, up-to-date toolkit for building decentralized applications (dApps) on the Ethereum blockchain.
With Scaffold-ETH 2 you can,
-> use wagmi + viem + custom hooks built on wagmi to interact with the
17
28
134
2
0
21
I had the pleasure of running into
@marqymarq10
at ETHDenver. It was pretty crazy to encounter another bug bounty hunter in the wild! Turns out he's created some pretty dope CTFs that actually feel like real-world vulns. Check them out here:
1
3
21
From the legend himself 🙏
Just used
@flexybridge
for the first time.
It works as advertised.
Wow.
That was *super* convenient.
3
1
22
0
0
21
Wait, am I to understand that LGTM doesn't mean "Let's go to the moon!"...?
I always admired merge comments for being so bullish.
4
0
20
Biggest change from GasbotV1 to GasbotV2:
Removed all instances of if...revert() and replaced with OG require(). Feels right 👌
3
0
20
Finally finished dev and testing on GasbotV2! 🎉
I recorded a contract walkthrough for auditors. Check it out if you're interested in learning the internals of how Gasbot works!
2
1
20
Bug bounty programs have two options on how to pay out to whitehats, via
A) stablecoin/ETH/BTC
B) with the project’s own token
If a project pays in stables, they’re paying out of their own pocket. If they pay with their token, they’re splitting the cost with the token holders.
1
0
20
What’s your user name based on?
I started web3 bounty hunting and I thought of Django Unchained, so Django On-Chain was perfect.
What’s your user name based on?
When the compiler converts code that operates on one number per instruction, into code that operates on multiple numbers per instruction… the code is vectorized.
7
2
92
3
1
19
This was a big upgrade in terms of functionality. I'm happy we were able to ship it ahead of schedule!
🚨 GASBOT UPGRADE! 🚨
@gasbot_xyz
now supports regular tokens, not only stablecoins and gas. Got some $OP or $ARB? Use them on Gasbot to get cross-chain or same-chain gas. Fully gasless, zero user transactions, lowest fees in the game, fast AF ⚡
4
110
33
0
1
19
90% or more of crypto projects have wildly fake follower counts. What are we doing? 🤥
Organic actions will bring organic users.
3
1
19
Pro tip for Web3 bounty hunters: If a project says the submission is out of scope but they'd like to give you $XXX for your hard work, it's likely valid and in scope.
1
1
17
Happy to announce another
@gasbot_xyz
integration 🔥🚀 You can now get $FTM or other gas tokens directly from
@fMoneyMarkets
, a leading lending protocol on the OG Fantom chain 👻
0
1
18
1
1
18
100%. Also look for where certain function calls are “mocked”. I.e. simply minting tokens in place of actual swaps, etc.
One of the easiest ways to find bugs in an audit is to look where the test coverage is lacking ❌
And this is the best way to have a clear vision of what the tests are covering or not:
1. Download Coverage Gutters:
2. Cmd+Shift+P -> Open Settings (UI)
23
88
408
1
0
17
Few people know that you can integrate
@gasbot_xyz
natively into any dApp. Any projects looking to add this functionality to your dApp (it’s free), shoot me a DM
Running out of gas at the worst moment? ⛽️ Don't let opportunity slip away! Refuel at
#SonarGasStation
and stay prepared whenever, wherever! 🔥
#DeFiMadeEasy
#crypto
7
24
72
0
3
16
As of just now,
@gasbot_xyz
is live on ETH mainnet. This was the last step of phase 1 to enable cross-chain gasless relays. I'm super excited for what we've built so far and I hope it helps you crypto chads out there!
4
0
17
This is what
@flexybridge
is all about. Thanks for the words ser ♥
Holy shit I just saved over 60$ making a small cross chain swap using
@flexybridge
- instead of
@MetaMask
portfolio.
Also that new UI where you select which tokens on which chain instead of a dropdown is very smooth and kinda sexy
Great work formergasbot OG's
excited to integrate
25
1
6
1
1
17
It shouldn’t come as a surprise that AI can’t provide a passable audit. The claims from Bunzz were crazy. Grifting at its finest
🚨🚨 Breakdown of AI vs. Human Audit Competition Just Dropped.
Details included:
1. What led to it?
2. Codebase that was audited.
3. Final reports.
4. What's next?
Thanks to
@0xDjangoOnChain
for his time in managing everything.
14
12
72
2
3
15
Excited to expand
@gasbot_xyz
to the Mode Network, a new L2 using the OP stack. We have some big partnerships lined up that I'm thrilled to announce soon!
Gasbot now supports the BOOMING Mode chain! (
@modenetwork
) Just launched this month, Mode TVL is exploding.
Need gas on Mode, we got you fam.
0
0
7
0
0
16
@sockdrawermoney
@code4rena
Dude I’ve never known a more dedicated team than the C4 crew. They (and you) are quite amazing ❤️
0
0
16
I haven’t seen a legit pomodoro post in months, but at least 10+ daily of pomodoro satire. Is that where we’re at?
7
0
16
We need more memes in the bug hunting community. Good work sir 🫡
1
2
16
@gakonst
Anecdotal, but as a security researcher, I’ve reported vulnerabilities saving over $100mil in total. Foundry has saved me multiple weeks worth of time crafting POCs for submissions over the past 2 years.
0
1
16
Just submitted a temporary frozen funds bug. Can't wait for the downgrade to "Griefing"
2
0
15
That feeling after you submit a bug and hours feel crazy long while you wait for confirmation!
Fast-forward 19 days and the project has only acknowledged receipt… 😂
4
0
15
I built a quick and ugly dashboard showing some of
@gasbot_xyz
KPIs. Check it out if you're into that kind of thing or want to track Gasbot's progress 🤙
0
3
14
A great way to increase crypto adoption would be to make a blockchain-optional game. No one wants to HAVE TO set up a wallet and write down a long af phrase just to play a game.
But what if the game functions perfectly without a wallet connection (like every non-blockchain game)
9
0
14
What’s the reason why crypto projects direct you from the main site to a sub domain (project.xxz -> app.project.xxz)?
Is it for legal reasons or different tech stack on the sub domain?
11
0
14