Introduction & Sponsor Shout-Out
00:00:07
riptide
Life of the blockchain. Welcome back to Bounty Hunters. We are back for a new episode full of juicy bug-finding material with incredible guests.
00:00:18
riptide
But first, we got to give the good shout-out to our sponsor, Recon, getrecon.xyz forward slash Riptide. you can get some high quality solidity audits powered by invariant testing with these guys.
00:00:32
riptide
So having worked with leading projects such as Centrifuge, Liquitee and Badger, they also have a ton of useful resources for bounty hunters and protocol devs. Again, recon.xyz forward slash Riptide will give you five grand off first time customers for an invariant testing engagement.
00:00:49
riptide
So basically using fuzzing without all the pain that goes with it. Nice, gooey, easy to use with big critical bugs, hopefully as a result.
Meet Bytes032: From Audits to Zenit
00:01:01
riptide
All right. And our guest today is Mr. Bytes032. Welcome to the show, welcome to the show sir
00:01:10
bytes032
Thank you for having me. I appreciate you saying 032. The zero is like important.
00:01:16
riptide
It's very important. And may I ask, are you part of the Bulgarian mafia?
00:01:21
bytes032
Yes, I am. Like actually the 032 is so a lot of people are like, it's just the variable by street to, but actually 032 is like the zip code of my hometown.
00:01:33
riptide
I see. Interesting. 032.
00:01:38
riptide
See, I don't miss one detail. So give me any feedback here, but I want to say, Dobre doszlief, Choteau.
00:01:47
riptide
Is that very bad? ah Hopefully that was welcome to the show.
00:01:51
bytes032
Yeah, I mean, kind kind of. You've got it.
00:01:54
riptide
I tried, I tried, I tried.
00:01:54
bytes032
You've got it. Yeah.
00:01:56
riptide
Well, hey, thanks for coming on, man. And and I don't even know how to classify ah Mr. Bytes here because we were we kind of transitioned from doing bug hunters to doing some auditors to get their takes.
00:02:09
riptide
And i mean, I guess, i would you classify yourself as an auditor primarily?
00:02:16
bytes032
Yeah, I mean, I used to sell audits a lot of the time today. So I wouldn't say doing audits that much that I have been doing before.
00:02:27
bytes032
But yeah, I guess I'm kind of a mix is the best way to phrase actually.
00:02:35
riptide
Oh, good. Well, maybe give us give us a little background for some people that that have no idea who you are. And ill I'll just post a couple quick things here.
00:02:42
riptide
So I met Bytes, I don't even know, somewhere more on X. And I noticed were an incredibly ambitious guy.
Connecting Auditors and Developers
00:02:52
riptide
And you were talking about how it was hard to get for people to connect with auditors. And you created this Telegram channel and web page.
00:03:00
riptide
think it's got called Find Audit, where you could just connect people, like direct protocols to auditors and connect people with with jobs and and connect people with security researchers. and And I love seeing that kind of ambition.
00:03:14
riptide
so that was where I first saw you. But please you know give everyone of an intro, kind of how you got here.
00:03:19
bytes032
Uh, I've got here, late 2023, I think something like this. Um, I was a developer before that, started doing, um, sole audits primarily.
00:03:35
bytes032
Um, then I, uh, created a collective i like with uh with a few with a few friends auditors as well with it i think maybe 60 audits or 70 something like that um that was around the time when i also created find audit like the platform that you mentioned that is unfortunately dead right now but just took too much of my time and nowadays i'm uh i'm helping run zenit which is you know an audit firm
00:04:07
riptide
I saw that. And you have, looks like the top tier guys over there.
00:04:13
bytes032
Uh, yeah, I mean, we have plenty of good guys. I'm, I'm very hesitant to always say like top tier because that's subjective, but, uh, we have really good guys. Yeah.
00:04:25
riptide
Yeah, that's interesting. it is kind of subjective. But, you know, I think we can agree on guys that bring results and and guys that don't too.
Auditor Industry Insights
00:04:34
riptide
And guys that love doing audits and guys that, you know, just aren't cut out for it.
00:04:40
bytes032
me Yeah, just my my main concern when some some people ah perceive top guys is like based on on name brand and like ah I found that, you know, a little bit more little known guys have been delivering like insane results.
00:05:00
riptide
Yeah, it's not always the guys with the biggest profile. People think that, you know, guys big on the leaderboard or post a big bug like he's the best. Dude, no one's the best, man. I got to say there's guys that are good and there's guys that are bad sometimes. But then there's these other guys.
00:05:16
riptide
And I think these are the ones you're talking about, the guys that are just consistent and just do a really good job each time.
00:05:20
bytes032
Yeah. oh I've been humbled plenty of times. Like I can't even count the times that I've been humbled like brilliantly by guys like this.
00:05:32
bytes032
So I think it's fair to say like the consistent guys that do a good job through like, that you know,
00:05:44
bytes032
a big timeline, say a year or the time without, you know, downs, mostly, mostly ups. I would say they're like the top guys actually.
00:05:52
riptide
Yeah, and the guys that can balance it without burning out too is it's pretty impressive.
00:05:58
riptide
Like just watching some people arc up and then you don't really hear from them
Bulgarian Audit Firms & Twitter's Role
00:06:02
riptide
again. But I mean, if you've if you've got a significant payday, hey, I get it. But still some of the guys that just keep grinding, I just like, oh shout out to Dead Roses, right?
00:06:12
riptide
This guy just got another 100K critical, it looks like.
00:06:15
riptide
But this guy humbled me and in one of the competitions I did, Wildcat. And he just found all kinds of shit.
00:06:24
riptide
And I'm like, damn, man, this guy is just, he's just a go getter, man. Just very consistent, very good. So guys like that, if I ran an audit firm, those the dudes I'd want.
00:06:36
riptide
But I'm not in the Bulgarian audit firm business. What's going on over there?
00:06:42
riptide
How come everyone's launching an audit firm?
00:06:44
bytes032
i think I think it was a meta after after you know it after saw audits i think a lot of lot of people started like doing saw audits and then uh a few a few guys started you know teaming up and that's when like a lot of the bulgarians actually started launching firms that was actually a pattern that was visible through throughout the whole space i think but just like uh
00:07:16
bytes032
A lot of the Bulgarian guys are very, are like vocal on Twitter. So like crypto Twitter gets it like it's mostly Bulgarians. But like, yeah, i think everybody that but has started early has been doing like quite quite well.
00:07:32
bytes032
um ah The people that have been consistent with business as well. So nothing surprising, I would say.
Public Personas & Financial Motivation
00:07:41
bytes032
um I don't know how much context you have as well.
00:07:43
bytes032
So I'm trying to be, you know, to start from the back pretty much.
00:07:48
riptide
ah No, I mean, the context I have is crypto Twitter context where, you know, Pashov, I've saw him grow from, you know, just a guy starting out reply guy to now he's he's got his own firm looks like he's doing really well.
00:08:02
riptide
I see you I see. um Oh, I think there was another another Bulgarian name, but I think you guys are more more active on Twitter than, say, other other groups.
00:08:14
bytes032
Actually, i'm I'm not sure even if I'm even active anymore. I don't even post that much. I found myself you know just struggle because i can't be shitposting when you know I represent a brand, a company, and people working with me.
00:08:37
bytes032
And i'm I have plenty of spicy takes so uh like let's not just not not pause that much
00:08:45
riptide
Yeah. yeah you You have to adjust, I guess, a bit when you have some.
00:08:48
bytes032
yeah what about you man i mean you you you start how i know you and like where i come you where i know you from it's like uh i've sold it out arbitrum bug bounty right up and i was like yay this guy like kind of killed it and then i was like they
00:08:49
riptide
Yeah, that's true.
00:09:10
bytes032
Such a shame that they didn't pay the full bounty. And then, you know, that's,
00:09:13
riptide
That's what everyone says. I know, but it's all good. It's all good. I'll tell you why. And here's a lesson.
00:09:19
bytes032
I saw the airdrop.
00:09:21
riptide
That was a fake airdrop. You remember that shit?
00:09:24
bytes032
Yeah, yeah, yeah, yeah, yeah.
00:09:25
riptide
Yeah, it's factile of it.
00:09:27
riptide
No, let me tell you why it was actually good. Because I met a guy, i met the coon, right? The guy who got two mil from Polygon for finding that ah great bug. Actually, it was the bug that Surtick found, I think, as well. And and this guy found that He got two mil, went and retired on a beach.
00:09:45
riptide
And I talked with him in person. we were chatting and he said the same thing. I was ashamed getting paid out. And I was like, yeah, fuck. But you know, once, like once you've been in crypto a long time, you, you have ups and downs, you know, you, you leverage up, maybe you'll lose some money, this and that your numbers go up, numbers go down. and what I realized is when you hit a certain number, whatever that is for you, where life is,
00:10:10
riptide
is very comfortable and things seem free, you kind of lose that drive. At least I did. like You lose that motivation to kind of continue pushing forward. And so if I would have gotten paid out all the way on Arbitrum, which was a couple of million, maybe the same thing would happen to me. you know Maybe...
00:10:28
riptide
I don't look at it as a negative. I look at it as like, well, hey, that's cool. This just pushes me to to continue to grind and and kind of stay in the space, do what I
Optimism & Gratitude in Crypto
00:10:37
riptide
like to. And it's interesting for me. you know, I don't take it as a negative.
00:10:43
bytes032
I like, I appreciate it. You like people being optimistic. I just, you know, maybe my, my, my worst post was about that being positive, being optimistic about it, not trying to, you know, delve in the negative.
00:10:57
bytes032
oh I put like, I, I like to see be be that way. And I think that's the right way to go about it. You can either go
00:11:07
riptide
who's Who hangs out with a pessimist all the time?
00:11:14
bytes032
That's point number one. And like, I think there's two pieces. Nobody hangs out with them, but like that there's, there's like that circle jerk social media thing that is mostly about pessimists.
00:11:28
bytes032
And like, I don't want to say haters because that's not exactly it, but people that just like cheer on seeing other people kind of down. Right. For example, the guys that were that say that saw you didn't get paid, and they're like, oh, that he deserves that.
00:11:44
riptide
Yeah. Yeah. Or it's guys that they get into a group, they start shorting, shorting assets, dude, I'll never short. That's a pessimistic view. I just, I just can't do it.
00:11:54
riptide
I just can't, man. I'm an eternal optimist.
00:11:57
riptide
I think every day you wake up is choose your own adventure and you can make it whatever you want to do. And you you had this great quote, man. I looked on your Twitter feed and you had this fantastic quote and you said, do what everyone does, get what everyone gets.
00:12:14
riptide
What a fucking line.
00:12:15
riptide
Cause that is so true in so many ways in investing, especially in education. Yes. Work. Yes. Everything I could think of. If you want to follow the same trodden path, you know what you're going to get and it's not going to be that spectacular.
00:12:31
bytes032
Absolutely. um And how I, you know, it's, it's funny because you mentioned that roses and that quote is actually something that I read something among the wines from him I think I recall so just giving you giving you the the war right where it's coming from but it's absolutely true and just to get through
00:12:55
riptide
I like that, man.
00:12:58
riptide
And this is the space for that, too. Everyone can do whatever they want................
00:13:03
bytes032
yeah yeah just circle back to what what you said like Every day is a blessing and like if you just focus on stuff that's not
00:13:16
bytes032
like this mostly bad. I like to say, um let me just speak the right words to translate and but from Bulgarian. some people Some people don't even get that, right?
00:13:29
bytes032
Some people won't won't even get to find a book in Arbitrum. Some people ah won't get to you know work what we're doing. some people you know, it won't even leave any of that. So I think we're doing quite well.
00:13:45
riptide
I have no complaints. I'm happy to be here every day. I'm happy to to have a podcast where I talk to other dudes with my same interests about our yeah our shared interests in and just be free to do it. And we could podcast this out here and people could listen. And some people sponsor me. Some people will hate it.
00:14:06
riptide
i don't care. I'm putting it out here and you know it is what it is, but you know this is what it is and it's it's cool.
00:14:14
bytes032
Yeah, I have a question for you, if you don't mind.
Travel, Productivity, and Bug Hunting
00:14:18
bytes032
um That is actually even about book bounty or like book finding. I recall you were traveling a lot. how how How did that impact you, like your your focus,
00:14:32
riptide
So ah it was crazy.
00:14:35
riptide
It was crazy. I traveled. So people don't know. i was I was living in Miami and we went through some some stuff, right? And i had to, so we're going to move. We're going to move to the country.
00:14:50
riptide
And so we go and buy this house and I get to the new house and we're about to move in and I'm towing all the stuff. And then the bank, yeah the day before I'm supposed to boom in says, hey, the loan's canceled.
00:15:03
riptide
And they rug me completely. And so I didn't have a backup plan. And so I just said, well, what are we gonna do? Like all of our stuff was in storage. And we just said, well, let's just go travel the world.
00:15:17
riptide
So I took my wife, two kids, and we just took off to to Turkey. And we started this round the world trip and I traveled basically Airbnbs, hotels with everyone for a year.
00:15:29
riptide
We'd stay a month in one place, month in the next place. And I just worked on my laptop the whole time, a little 13 inch Dell XPS. And I found more bugs traveling and doing that just going to coffee shops on planes than have, I think, you know, like the consistency was there and it was incredible consistency. It was two, three a month, decent bugs.
00:15:54
riptide
And I haven't had that consistency since. So I don't know why I was so locked in. Maybe because I didn't have like, I didn't have a house at that point. We were just in travel mode. Or maybe it was this small screen that made you focus or something else.
00:16:09
riptide
But it actually was a huge benefit rather than ah hindrance.
00:16:15
bytes032
Right. Uh, to tell you like where I, what, what I'm asking that a lot of people are like getting different recipes for focusing or like making it whatever.
00:16:28
bytes032
Um, and I recall, oh there was a post or something in Twitter or X. Um, and maybe, it would be maybe it was my my post, whatever. And, uh, it was something about focus, et cetera. And you were like, um, no, it's a skill issue.
00:16:48
bytes032
And that's where, and that's when I, you know, I just had the context, like you've been traveling and stuff like that. So, uh, you know, just wanted to the just wanted to wrap up that one, at least for me.
00:16:57
riptide
you quote You quote my shitposts.
00:17:02
riptide
ah Shit. i yeah I don't know. I think it's, you know, it's one, the incentive is there for money. That's great. But we both know you can't do it unless there's curiosity like you want to do it.
00:17:12
riptide
Or else if you don't have that drive, you go down the despair hole into into nothing and you'll just give up.
00:17:20
bytes032
Yeah. Do you feel like there are more people getting into the space than before? Like it's the same amount of people?
00:17:28
riptide
As far as bounty hunters, honestly, have no idea.
00:17:34
riptide
i don't I don't know what anyone's doing. I don't know if there's voices on Twitter that are new. I just don't pay attention to it. And there's so many contracts out there. um It seems like there's more audit firms coming up. Those are the only ones I notice. I'm sure there's solo auditors out there that they're growing in in numbers because anyone can pick it up after a while and be pretty good at it.
Audit Competition & Quality Scarcity
00:17:58
riptide
um I don't know. what do you think?
00:18:01
bytes032
Um, maybe because I was more, more vocal in, vocal in Twitter before, or like more active opening the app or the page itself.
00:18:12
bytes032
Uh, I noticed more people getting involved. Definitely feels like less people now, but it might be a thing like what I've just said. I don't know because i don't really, I'm not really liking noticing it at all.
00:18:30
riptide
Are you getting more competition from other audit firms or other solo auditors?
00:18:36
bytes032
I wouldn't say wouldn't say mean there is good there is good competition but I think the amount of auditors that can do a good job um
00:18:51
bytes032
is not necessarily going up so I think it's two as cars resource of people
00:18:58
bytes032
that you know are going to deliver?
00:19:01
riptide
Let me ask you this. What's the deal with, I've noticed the contests. Have you done any contests?
00:19:10
riptide
why do you Why do you think all these contests, like recently I looked at, I think it was the Daily Warden, and I think Sherlock, and was it Code Arena? They had nothing coming up. And these were packed for the past, i don't know, six months.
00:19:26
riptide
And now it seems like there's a drop-off. Are you seeing a drop-off in your audit business as well, or is this just something totally separate?
00:19:34
bytes032
Yeah, maybe maybe just to clarify here. I mean, I don't want to be doing shilling, but Zenit is actually related to CodeRena. It's just kind of incubated by a product in CodeRena.
00:19:48
bytes032
So I can also speak you know for CodeRena because I'm involved with CodeRena as well to some extent. like Not to some extent, but like, yeah, plenty.
00:20:00
bytes032
oh So like don't want to be doing any any shilling so that do want wanted to give the disclaimer uh anyway think
00:20:09
bytes032
two pieces um competitive audits were commoditized that's piece number one and because there there are there are many reasons like that like for that to happen that's point number one and point number two is um a lot of competitions for not so many contests, right?
00:20:36
bytes032
And there are a lot of things that are happening behind the scenes and I i don't want to call out anything or anybody, but it's a combination of actually these three, because I mentioned three things.
00:20:52
riptide
Mm-hmm. So you don't think the demand, apart from that, you don't think the demand for security reviews and audits is is trending down at all.
00:21:05
bytes032
I think it might be.
00:21:05
riptide
Just maybe maybe there's some specific situations with contests, but as far as your business and other firms, business is still booming?
00:21:16
bytes032
Yeah, I think so.
Crypto Growth & Security Demand
00:21:20
riptide
So no shortage of capital coming in or projects coming in without funding, ah because I don't think that's true. I think people are, know, projects are still flush with cash.
00:21:30
riptide
They're willing to pay for audits.
00:21:33
bytes032
I think there are like two two pieces, ah like how many leads there are coming and like that kind of, let me actually go two steps back.
00:21:45
bytes032
I think there are plenty of new projects. I was in Dubai, I met a lot of lot of people. Actually, if you open DeFi Wama, ah you're gonna see that for March.
00:21:57
bytes032
ah For example, what was it? I think it was 3.5 billion. uh compare that to you know i don't know uh december or october if you go at the chart i'm gonna send you the link in telegram you're gonna see there's plenty of funding actually yeah
00:22:18
riptide
I didn't even realize they had the metric on there. Okay, cool. No, that's good, man. There's good demand. That's what I expect. I think this space is, you know, no matter the sentiment, I still think the space is growing, growing, growing.
00:22:32
riptide
And I mean, that's that's my investment thesis. And and that's why I'm invested in industry. I posted this morning about just, it hit me when I was looking at, um,
00:22:43
riptide
So I've been um been sucked away for like three days for no reason, looking at Layer Zero and Stargate. And I was reading through Stargate's contracts and their docs, and I was looking at the volume they've done, and I'm just thinking, this is so fucking cool that we can do this. Like from where we were, i remember, ah you know, we were food farming back at DeFi summer to where we're at now.
00:23:09
riptide
And even to when yeah the first DRC-20 came out to where we are now, it's so cool. Everything's working. Like, you know, follow a trace on a huge um transaction and just look at all the pieces of Legos coming together and it works.
00:23:25
riptide
And sometimes you can't find any bugs in it. Like it works flawlessly. And this was built and it's happening now. And we're here living in it. And it's just going to get better and better. So the demand is just going to keep coming.
00:23:38
riptide
And I think security demand is going to increase. And I think you know bounty hunters always going to be needed as well. I think we're we very well positioned.
00:23:49
bytes032
Yeah, and especially with a... It's funny because the the space relies so much, you know, by a single country and so so much on a single country and a single government.
00:24:02
bytes032
But how ah we we have a pro-crypto government in the US, so I think it should be moving at least for the next few years.
00:24:10
riptide
Yeah, I hope so. I hope it decentralizes more as it grows, which I think it will.
00:24:16
bytes032
It will. It will. It's just going to take time.
00:24:19
riptide
Yeah. but So let me ask you this. So you obviously wanted to make a lot of money. So you didn't get into bounty hunting.
Auditing vs. Bounty Hunting
00:24:27
bytes032
Yeah, that's right.
00:24:29
riptide
I always tell people this, go audit if you want some consistent income. But if you want to do a Hail Mary or you know really you're good with really spiky income, then then go bounty hunt. Otherwise, don't bother.
00:24:43
bytes032
Um, I think it's a more of a mental thing, right? It is very draining and requires a different type of
00:24:55
bytes032
personality that is not me.
00:24:59
riptide
Agreed. And likewise, I can't do the audits for very long at all.
00:25:06
riptide
it's Yeah, you couldn't swap us. we We just wouldn't we wouldn't enjoy it
00:25:12
bytes032
Yeah, exactly. you You have to enjoy what you're doing. um Maybe sometimes I feel jack of all trades just because I ah try to entertain myself with different things, right?
00:25:26
bytes032
But then I always remind myself that if I don't do what I'm doing, I probably won't be doing anything just because I get fed up with that specific thing if it's only it.
00:25:40
riptide
Are you a high risk activity enjoyer?
00:25:44
bytes032
define high risk I've been trading a lot I've been trading probably more made most of the money in my life trading I've leveraged my entire network so if that's high risk I'm probably yeah yeah I did some really great trades last year mostly leveraged and mostly trying to co to catch like a fallen knife
00:25:58
riptide
that's That's pretty good. You go full stack.
00:26:14
bytes032
right the dip is just just going really bad and I'm I'm buying and selling just because obviously I don't wanna I don't wanna go like too bad but I say I've spent I think 80k on fees with one on one occasion just to you know
00:26:33
bytes032
and No, just because i buy and I'm like, okay, I'm going to wait for a little bit. It's probably going to go down or up. It goes down too much. i kind of close the trade just because it might go too bad.
00:26:47
bytes032
But in the end, um like when I'm like, OK, the bottom is here for for now, I just open the trade and let it be.
00:26:58
bytes032
And i for example, one of the trades I ah closed in around 25 days. So fees, as in trading fees, funding fees, but also money that I lost on the trade before I profited, right?
00:27:13
riptide
So you'll, you'll leverage your full stack. You, I noticed, I noticed you're a off-road vehicle enthusiast, which there's a danger element there.
00:27:25
riptide
Uh, you're also, I'm going say you're into fitness as well.
00:27:30
bytes032
i i am like the last years, the last year, not really, no excuses. I don't want to be a bitch, but i have been in my in my life. Yes, correct.
00:27:40
riptide
ah hu I'm looking for like some commonalities. How do you define an auditor or bug hunter? i don't I don't think like my mentality versus yours.
Hosts' Hobbies & Risk-Taking
00:27:50
riptide
There's probably some commonalities.
00:27:52
riptide
Like I ride motorcycles. I like that. i do I do some intense exercise, but nothing extremely risky. Maybe in the past, but I just enjoy bounty hunting a lot more than auditing.
00:28:08
bytes032
have you Have you done skydiving?
00:28:11
riptide
Oh yeah, I used to do that in the military.
00:28:14
bytes032
Yeah. I've done a few times as well. I've never roll a motorcycle just because I'm probably gonna end buying and probably gonna end dying at some point.
00:28:25
bytes032
So I've never drive.
00:28:25
riptide
You know those, never believe those statistics unless you suck at driving because they say all these motorcycle deaths, that's because a bunch of people shouldn't be riding motorcycles. I've been riding for 20 years, no crashes.
00:28:40
bytes032
That's right. I mean, it's about, the thing is that, I'm probably going to get lost at like the adrenaline rush. So it's not not only about me being a good driver or not, but also taking unnecessary risks, which also maybe translates to being a good driver. I don't know.
00:29:03
riptide
It's a calculated risk.
00:29:08
riptide
I want to, all right, we're getting back off topic here.
00:29:11
riptide
Let's, let's talk about some stuff. ah I want to ask you some things here. So
Learning New Coding Languages
00:29:17
riptide
ah went through your tweets and I'm actually curious from an audit point of view, because this applies to bug hunters as well.
00:29:23
riptide
Cause guys want to know what to start with and you know, which I take my time learnings at rust, Solidity Viper. And you had a tweet and you were like, Hey, go learn, move Solana, Cosmos and Cairo.
00:29:35
riptide
And then you're also talking about the ton blockchain and they have their own language on there. Do you, do you still stand by that? Are you seeing like a demand in certain areas? Like you just can't find auditors for some languages. Do you think that's, they're kind of underserved and maybe if bounty hunters targeted those languages, they could ah just maybe dominate that, that area.
00:29:58
bytes032
I'm not sure how they target Suwana just because they don't verify their contracts. that's that's That's the first thing. So what I'm going to say is mostly about audits.
00:30:10
bytes032
Like, you know, just a huge disclaimer. I think a lot of the move guys don't verify their contracts as well.
00:30:17
bytes032
Anyway, I think. To stand out if somebody is to make a career as an auditor doing audits, you know, again, highlighting that in in firms or independent research or whatever.
00:30:31
bytes032
There is a lot of value to be found in these ecosystems, you know, Suwana and anything move in particular. um There is not enough good people.
00:30:44
bytes032
And i think translating from solidity, for example, is extremely easy. If somebody is a good security researcher, um they should translate.
00:30:58
bytes032
like quite quite easily.
00:31:00
riptide
to move and and ah rust as well.
00:31:04
bytes032
Suwana. Yeah. Rust, move. I would probably rank it you know, Rust, Suwana, MOVE, like whatever, Sui, Aptos, and many others. MOVE has the thing that there are a lot of variances of MOVE.
00:31:24
bytes032
And then also, Cosmos SDK and GoWang, like Rust can also apply to Cosmos, which is like kind of smart contracts in Cosmos.
00:31:35
bytes032
So these ecosystems, like there's a huge amount of people that can do well,
Ton Blockchain & Telegram's Influence
00:31:44
bytes032
for sure. I can tell you by, you know, the amount of oh business we are doing.
00:31:51
riptide
What's what's the the hardest auditor to get for what language?
00:31:57
bytes032
um Probably right now it's ton, but there is not so much demand for a ton. oh
00:32:03
riptide
ah What's that like security wise?
00:32:05
riptide
I haven't looked a ton.
00:32:07
bytes032
well, there, I think, um
00:32:12
bytes032
It's interesting because fun C or funk, it's kind of lisp-ish, but I just released a new kind of language on top of it. it's It's weird. I think that's the best way to say It's weird, but I think Telegram, if they play their you know cards well they have a lot of a lot of users a huge user base so eventually telegram and their you know chain and platform and you know user base if monetized well they're gonna they're gonna kick ass
00:32:49
riptide
Yeah, they could be. I mean, you know, i use Telegram all the time, and I think the team behind it, Lean and Mean, they must have had their reasons for for going with their own kind of language I've never even seen before.
00:33:03
riptide
But I agree with you. This could be a really good area to spend some time in.
00:33:09
bytes032
Yeah, but there are not too many projects, I think, at least right now. They just released a new language called Tucked.
00:33:23
bytes032
Yeah, it's user-friendly TypeScript syntax.
00:33:29
riptide
Interesting. Everyone with these new languages. How much demand are you getting for Cairo?
00:33:36
bytes032
Kyra is doing well. I think StarokNet is doing good. It's like generally has good good future.
Focusing on Promising Crypto Projects
00:33:45
riptide
Well, why what's what's on Starknet? Name one project.
00:33:48
bytes032
Well, Kakarot, like it's a ZK AVM, for example.
00:33:55
riptide
Where can I see the stats on this?
00:33:55
bytes032
Anything different.
00:33:58
riptide
I've never even even heard of this thing. I just hear these things like I look at, I go on chainless sometimes, right? And I just see all the chains.
00:34:07
riptide
And apart from like pump and dumps, this and that, I'm like, who is using any of this? Like, is anyone using all these, like who the fuck, even Unichain, right? That came out, who's using this?
00:34:22
riptide
Who's using Core, Kronos, BitLayer, like what the fuck are these, man? Is it just I'm totally out of the loop and everyone's, you know, DeFi lending, they're doing all these things and all these chains and I just have no idea.
00:34:37
riptide
probably That's probably
00:34:40
riptide
That's probably it, man.
00:34:41
bytes032
you're you're you're touching an interesting point. um But what you know just to to circle back to what just mentioned about the price action, I think a lot of the price action is ah you know market makers doing
00:34:58
bytes032
chart painting. so I wouldn't rely on that as you know indicative of usage at all. Because as we all know,
00:35:07
riptide
Yeah, or or pinging the nonce contract, increment nonce. There's all your activity.
00:35:15
riptide
Yeah, this this is crazy, man. I mean, ah from from an audit perspective, I bet you see some interesting projects kind of before anyone else sees them on different chains and stuff like that where no one's even heard of these things.
00:35:30
riptide
What about, have you have you dealt with, I think it's called Rootstock, the Bitcoin one?
00:35:36
bytes032
oh no i don't think so we haven't
00:35:36
riptide
Have you done anything with them?
00:35:40
riptide
Yeah, another one. With a humble quarter billion TVL, you've never heard of them, just like all these other ones.
00:35:45
bytes032
yeah quarter billion let me see
00:35:48
riptide
I think this is the, dude, this is the state of of crypto and these blockchains is just, it's permissionless and you can launch your own roll up.
00:36:00
riptide
And this is so cool because it's, this is great. I mean, it's like the singularity of blockchains. It's just gonna keep expanding over and over and over outward and outward.
00:36:11
riptide
And we can't keep up. And we'll use AI, we use different tools to try
DeFi Bug Bounties & Opportunities
00:36:15
riptide
to keep up. But as a humble security researcher, I mean, ah the opportunities are endless. If you ever get bummed out and think there's no bugs out here, go to DeFi Lava, go to chains.
00:36:27
riptide
it Just look, there's like, okay, so hundreds of chains, and you could just pick something and go find a bug in it. How awesome is that?
00:36:37
bytes032
Absolutely. And I'm not sure if like DeFi Wama is like the right, like you you know better than me if the non-bug bounty projects are actually paying like DeFi Wama heuristic, I mean, but yeah, probably probably going Yeah, it's ah it's ah it's a mix because I've just seen somebody get paid a one million bounty from, you know, a project that doesn't have a lot of TVL.
00:37:11
bytes032
So like, yeah, I'm probably speaking.
00:37:17
riptide
Oh, you're, you're doxing the guy. I know who it is, but it's all good.
00:37:21
bytes032
i mean i mean, it's it's public knowledge.
00:37:24
bytes032
I think it's public knowledge.
00:37:26
bytes032
It's in Twitter.
00:37:29
riptide
No, that's all good. You know what DeFi Llama needs? I'm going reach out to Is if they could add like bounties and just have all the bounties here because they're so good with data. This would be really cool to have.
00:37:41
riptide
And even I wonder if they could add like payouts, all kinds of stats. That would be really cool. We will see.
00:37:48
bytes032
the thing with payout is like it's cute because now not everybody's like you know transparent about what they pay or whatnot to so I'm not sure
00:37:59
riptide
Yeah, the data is not perfect. What about what would you say? Like, do you think that each auditor has a specialty, like a special area like this guy? handle He's a math guy.
00:38:13
riptide
We put him on AMMs or something like that.
00:38:16
bytes032
oh man um okay i'm gonna answer like uh no features i think most good auditors are good in whatever you throw at them ah yes there are exceptions like mad guy uh infra guy whatever but what i'm saying is like uh the infra guy, if he's a great auditor, if you draw if you throw him you know in something else, he's gonna catch up on that like really quick.
00:38:57
bytes032
So I think two pieces here. um
00:39:02
bytes032
the I'm gonna be a specialist in XYZ is a marketing thing, so it can attract The right people, yes, they're specialists in some things that actually have this cues.
00:39:17
bytes032
But, you know, going back to point number one, there are guys that, you know, are a good at multiple things. So yes and no, I think is the right answer.
Networking & Establishing Expertise
00:39:30
riptide
I think it's really good, the marketing thing, actually, because I saw a guy talking about, he obviously dove deep into one of one of these protocols. i think it was, maybe it layer zero or, think it was layer zero. was some guy who's who's putting all his research out there. He's like, yo, I did all this.
00:39:46
riptide
Here's my write up. Hey, anyone integrating o OFTs or using layer zero, talk to me. I'm the man. And you're showing that you're the man.
00:39:56
riptide
and Like, all right, Bounty Hunters, like if you want to get some side gigs doing some audits or reviews, do that because you spend so much time looking at protocols that yeah could go nowhere.
00:40:08
riptide
But at the end of the day, like you spent a week on something like me with the Stargate Layer Zero thing. Hey, man, I know how the whole system works now. Well, I didn't find anything. Actually, I found mega criticals. just going to leave those for you guys. I don't want to claim them.
00:40:22
riptide
But all these things that are out there, like you've taken all that knowledge. So do something with it. Do a write-up and share it with people. And then boom, now you're the subject matter expert on whatever the fuck it was. But other people find value in that.
00:40:35
riptide
And then they'll reach out to you, especially if you have a low following on Twitter. Man, post that, tag me. I'll retweet you if you have a good write-up. Hey, we'll hopefully get you some some extra side cash so keep hunting.
00:40:48
bytes032
Yeah, um I think what you're touching right now is just different, you know, applies to different people, right? If somebody wants to get employed by a security company, ah like full-time, they should probably just do do something that is going to know, make them get hard, like many, many things.
00:41:12
bytes032
If they're, if they want to stay independent, want to become subject matter expert in something they should tweet about that. But, or, or like if they want to, you know, do book bodies, I think is is' a good thing to connect with other book body hunters. So it kind of gets, get at least a little bit of, um,
00:41:32
bytes032
lifting up when you are down because i think that's probably needed at least initially so you get some confidence and courage but think something on the on the on the second one like marketing uh is very important i believe when you market whatever to be able to um
00:41:55
bytes032
back it up with real knowledge because you have only one shot and the space is small so i've seen people that are marketing themselves or as like subject matter experts um i've i've tested them like different means but uh there's
00:42:21
bytes032
No, like in in audits and like even in security, you either find bugs or you do not.
Reputation & Work Referrals
00:42:28
bytes032
And once you get to work on something that becomes very evident. So if you if you can't find that much bugs, you just be a little bit more oh
00:42:40
bytes032
scarce, you know, marketing yourself until you can actually find bugs because people like on these projects, they, that you audited, they speak with each other. And like, yeah, just, I think worth mentioning.
00:42:55
riptide
Yeah, I agree. It isn't that big of a space when you think about the the backroom communications and your reputation, your brand. You could be anonymous and just have your name out there. But people talk.
00:43:09
riptide
I think if you're good, you'll get referred. If you want work, it'll come to you. i think the you know the ah selecting mechanism for a lot of companies, and I'm guessing here,
00:43:25
riptide
would have been because it's the most public is to look at the leaderboard for a contest. And if you see guys hitting top ranked over and over again, I would say, okay, they're going to choose those guys. Do you agree with that?
00:43:40
bytes032
Not necessari necessarily. Depends who is selling. think selling audits is very relationship based.
Audit Pricing Strategies
00:43:50
bytes032
What you are describing, adding is a very small subset of customers.
00:43:57
riptide
Do you have a you have like a ah minimum engagement size?
00:43:57
bytes032
Like very small.
00:44:03
riptide
Or say a a project is just wanting you know a simple contract reviewed, like nothing, 100 lines of code. Would you take that on or is there ah minimum that you're going to bother with?
00:44:17
bytes032
Yeah, I mean, we we're gonna we're goingnna take we're going to take that, but
00:44:25
bytes032
let me let me just try to pick the best words here. We're going to take that. We're going to try to help any customer. um The thing is whether our pricing is not a competitive with what they might get from you know independent researchers if they're not going through firm, right?
00:44:42
riptide
Yeah, and my comment on that is what I learned early in business is never say no to a job. Don't say no. You don't have the capacity.
00:44:53
riptide
Don't say no to it. Just price yourself out of it. So if you if you really don't want to do it, you have too much on your plate, just give them some higher quotes. out Well, you know, if they pay me 20 grand, I'll do it. If they say yes, well, then hell, then do it.
00:45:06
riptide
You know, you're there's always a price you're willing to do that. But I always say price yourself out of the job. Don't decline any.
00:45:13
bytes032
You are, I mean, I have an interesting story to share here. It's, I think, interesting. I think I've lied to you because that that actually means I got into the space around 2022, not 2023, 2022. just kind pollucinated over here
00:45:30
riptide
noted lying to me.
00:45:33
riptide
It's all recorded.
00:45:34
bytes032
so So December 2023, I'm going to, what was it? EF Defcon in Istanbul, right?
00:45:46
bytes032
I think it was there. Yeah, Istanbul 2023. So i have accommodation, everything. I'm going to meet with friends, et cetera. And i got ah I get an audit request.
00:45:58
bytes032
And there are guys, we need that ASAP. I'm so auditor at the time.
00:46:04
bytes032
And I'm like, um I don't want to really do that. And I'm like, I'm just going to do what I just mentioned. um i just try to price myself out. I'm like, okay, that's a two week engagement.
00:46:18
bytes032
I'm just going to quote him like 65 K.
00:46:22
bytes032
And you know, two two days after that, the guys are like, okay, you have another choice. We're going to do it that. I'm like, fuck my life. I mean, that's, you know, insane.
00:46:34
bytes032
Absolutely insane. So I didn't go to Istanbul. I took it. I was like, okay, I'm going to stay for that amount of money. Yeah.
00:46:43
riptide
but it's such a good strategy when it works because you can't lose either way.
00:46:46
bytes032
Yeah, yeah, yeah.
Common Solidity Bug: ABI Encoding
00:46:50
riptide
Yeah. I love hearing that.
00:46:54
riptide
Oh, I, I, so I didn't prepare you. Sorry, but I've been to the last two episodes. I totally forgot the alpha drop because I was dealing with auditors. So I thought in my head, it was like, they don't have any alpha. Everyone's got some good alpha. So I'm bringing it back. All right.
00:47:10
riptide
And I didn't give you any heads ups. You better have some alpha ready. So we're doing the alpha drop.
00:47:15
riptide
Well, let me do mine and then you can scramble because I give no one a heads up on this show.
00:47:22
riptide
ah I'll drop some alpha here.
00:47:24
riptide
So This is a good one. So this is, it's such a simple thing. Like if you were studying solidity bugs, you would, you already know about it, but maybe you forget about it because there's so many bugs solidity.
00:47:37
riptide
ah But I see it, you know, as simple bugs, I see this stuff. Still to this day, I just found another bug last week and i'm negotiating now with the project on a payout.
00:47:49
riptide
But it was this beauty right here. When you use ABI in code pact, you get a collision, a packed encoding collision.
00:48:00
riptide
So yeah, if you know if if you don't know how it works, look it up, but I swear to you, this still exists in contracts that are being deployed, old contracts, it is still out there where you can have the same hash, but with different inputs.
00:48:16
riptide
So that is my alpha drop. Bytes 032, what do got? but you got
00:48:22
bytes032
necessarily has to be a about bounty hunting, let just get just give me a second.
00:48:28
bytes032
Just give me a second to um Maybe maybe you know something that might be more relevant to you know what I'm doing today.
00:48:28
riptide
could be It could be a life alpha, if you like.
00:48:41
riptide
If you think it will benefit the listeners, then by all means, go ahead and share it.
Exploring New Technologies
00:48:46
bytes032
Yeah, just just give me a second. Apologies for holding up for so long.
00:48:51
bytes032
Maybe the best alpha that I can give is
00:48:57
bytes032
study whatever is coming next, be it hyperliquid, be it whatever there else is. There are a lot of new things coming and if you stay on top of them and you make it like in just one, for example, even like Suwana, Hyperliquid, whatever it is, position yourself as an expert in one of these new things that are actually going to stay, maybe
00:49:30
bytes032
you're going to make you're going to make a lot of money and you're going to get a lot of work. I think a lot of people are not doing that and they are pretty much doing what they have been doing the past two years.
00:49:46
bytes032
And the competition on these new things is low. So position yourself as a good auditor in these.
00:49:54
riptide
Very good tip. Get yourself out of your comfort zone. That's me included. I should go start looking into move or rust or something. I admit I'm in my comfort zone sticking with solidity for so long.
00:50:08
riptide
And I should definitely do that. I'm i'm going to take it to heart. That was a great, a great alpha drop.
00:50:18
bytes032
I think I've asked you before, but you're coming from a dev background with PHP, right? So how do you translate into Solidity? It might be something.
00:50:26
riptide
Well, also did a lot of JavaScript, which is such an easy carryover to Solidity.
00:50:33
bytes032
Oh, I see. Yeah, absolutely.
00:50:37
riptide
You know what it is, man? You know this because you're just you have the same kind of mindset. But I think, and tell me if it's not true, I think you can learn anything you want if you have the aptitude for it.
00:50:50
riptide
you yeah If you have a reasonable intellect, you just put your mind to it and you just stare at it honestly and just just keep rehearsing things. And then magically,
00:51:02
riptide
It'll just start making sense. And I read this paper on like how that works in your brain with these, you have these myelin sheaths and they get thicker and thicker each time you do some repetitive learning and eventually that connection becomes stronger and stronger and you're able to connect the dots faster and things make sense.
Perseverance in Skill Development
00:51:27
riptide
But initially, It's like you go run a marathon and the first mile you want to quit. Same thing with looking at a new language. Everything's brand new and you just want to throw up your hands. Oh, I'll go back to what I know.
00:51:39
riptide
This is too complex. ah But I think you stick it out and things pay off and you'll eventually get it. And then if you keep at it, you'll become a pro at it.
00:51:51
bytes032
Yeah, maybe the only thing that I'm going to add is keep sticking at it regardless of like it's good or bad currently.
00:52:02
bytes032
Because when you start something, it's going to always be fun, always going to be you know very in enjoyable.
00:52:08
bytes032
But then when the down comes and you like the the ups and downs, I mean, that's what I mean by down. um You're probably going to struggle little bit, but if you go through that, the reward is right there. At least that's how I feel or how I felt about it and how it happened with me so far.
00:52:29
riptide
And ah you brought up hyperliquid. what's what' So I'm doing something on hyperliquid right now. What's your thoughts on like Barochain, hyperliquid, these kind of alts?
New Blockchain Architecture Speculation
00:52:40
riptide
Do you call them alt L1s? Would you agree with that?
00:52:44
bytes032
Yeah, I think that's a good way to phrase them.
00:52:46
riptide
What do you think about this with... um Yeah, honestly, I haven't looked at like the economic security behind it. I don't know. i haven't even looked in depth. Do you know what the security model is? Is this because why are putting people putting so much money over there?
00:53:03
riptide
Do they not care about ah the decentralization of Ethereum? um Like what's what think is the driving force other than greed?
00:53:14
bytes032
Man, I have so many things to say here that I shouldn't be saying in public. So I'm gonna start with that. But Hyperliquid is like pretty cool. um Like assets can be sent between HyperCore and HyperEVM.
00:53:29
bytes032
um It's a very, I think, refreshing thing to see. They have really interesting precompose. At least I'm personally, as a DJ that also trades, I'm excited about Hyperliquid just because, you know, it involves a lot of people, obviously bad people as well, you know, just to trade and do whatever, you know, just just trade without KYC whatsoever.
00:54:01
bytes032
I hope like hyperliquid goes so mainstream that kind of even replaces some of the centralized exchanges. But it's really cool.
00:54:11
riptide
But I mean, well, so, all right, well, I guess I do know something about their security model.
00:54:11
bytes032
You should check it out.
00:54:15
riptide
I found, cause I report a bug to them in their deposit contract back in the day. So they have the validator set, but is that it? Just the validators that they run?
00:54:28
riptide
And they have, what's, what's their TVL? Any idea? It's probably pretty big, like a bill.
00:54:32
bytes032
ah Oh, it's a, it's a, it's a, I'm not sure if the TVO here is like the meaningful metric, like exactly because there's a lot of trading going on there.
00:54:46
bytes032
um So it's also the revenue they're making. Right. But yeah, I think, I think that they're cooking. They should be cooking long term and the community is like very, very, very likable.
00:55:01
riptide
Yeah, like, because this was, this started, if I can remember with DYDX, where you'd be able to, to kind of use this, don't know what you called it, but you would just sign once.
00:55:14
riptide
And then, I don't know how it worked, honestly, outside the contracts, but it was very fast, you know, it and it was, it was a, it was a similar to sex-like experience when you trade.
00:55:28
bytes032
Oh, you got me chuckling over here.
00:55:35
riptide
But I mean, that, that was, that's what kicked it off.
00:55:37
riptide
I remember the DYDX airdrop. If you didn't get that, you're missing out, but, but, but, and they, I don't even know, is DYDX still around?
00:55:41
bytes032
That... I didn't. I didn't.
00:55:48
riptide
I mean, they Dolomite copied them and they're going strong on Baruchain and multiple chain, but then Hyperliquid comes out. And they say, we're an alt L1.
00:55:59
riptide
We're going to have some validators run this. Trust us. And they came out with this great kind of, ah I don't want to say egalitarian kind of airdrop with hype and everything. Everyone loved that. So it got them a lot of marketing.
00:56:12
riptide
But how's it different than, wonder if it's less secure than DYDX was. What do you think?
00:56:22
bytes032
I'm in first place, I don't know how secure was DYDX. So that's that's point number one.
00:56:29
riptide
I have no idea. Yeah.
00:56:30
bytes032
Yeah, so I can't objectively answer.
00:56:33
riptide
But usability, it seems like all the same features are there. Maybe they have some more stuff with hyper liquid.
00:56:37
bytes032
um No, no, no. Like you should just read more about the hyper core and hyper EVM split. So it's a what what they like to say, dual block architecture.
00:56:49
bytes032
um So there's like a separate mempool, et cetera. It's, I think, really cool thing to, at least at least refreshing for me to observe.
00:56:59
riptide
I'll have to dive in. Yeah. Like what you said, it's such, such great info, man, is just stay on top of this new stuff that's coming out that honestly it's had a lot of hype and a lot of press and CT, but the attention span is, is not existed. So people probably forget about it already.
00:57:16
riptide
Yeah. Lock onto these new projects.
Varied Learning Paths in Crypto
00:57:18
riptide
And especially if the guys are cracked and they're developing something big in the background, Hey, maybe this is a, maybe there's a lot to it.
00:57:27
riptide
Yeah. So definitely to check out.
00:57:29
bytes032
Maybe a huge disclaimer here that might work for me because that's how my brain works. I like to entertain myself like with new stuff. For other people, it's like stick to one thing and just get really good at it. So you're like the best in the world when it comes to that. So just wanted say there are like many ways to skin a cat.
00:57:49
bytes032
That might not necessarily not necessari necessarily be the right thing for somebody whose you know brain works differently. It's not a silver bullet.
00:57:56
riptide
True, true, to each their own. I agree.
00:58:00
riptide
Cool. Cool. Mr. Bites, you got anything else, man, or should we wrap it up? We're at an hour here.
00:58:07
bytes032
I think we can wrap it up unless unless there's, yeah, i think I think we've done a good conversation over here.
00:58:14
riptide
I agree, man. Well, cool. Well, let's, ah I want to plug some stuff. So if you want to talk to other bounty hunters, you're, you're feeling low. You haven't found shit. Come to the discord. ah You can go to link tree slash bounty hunters. Check the sub stack. I give you some low medium bugs for free. And I'm trying to get somebody else to get their eyes on them, to amplify those into something else. Maybe you can, maybe you can't.
00:58:38
riptide
And lastly, if you're a protocol that you want to put a bounty out there on Immunify, just mention my name, mention Riptide, and they'll kick back some funds to the show to help support the show.
00:58:50
riptide
So after that, thank you, Mr. Bytes32032. will see you the blockchain. we will see you ah the blockchain