Rocking at @immunefi | Never stop learning. Work with GitHub? Check https://teapaw.org/t.co/0bSp6fWyS3
Lisbon, Portugal
Joined April 2010
- Tweets2.1K
- Following1.8K
- Followers348
- Likes4.6K
Alex Parra retweeted
🚨 New Bug Bounty Alert! 🚨
@metricxyz has launched a new Bug Bounty Program on @immunefi, offering rewards of up to $500,000!
Help secure @metricxyz, a decentralized exchange featuring active liquidity pools with custom pricing that dynamically adapt to new market information.
Whitehats, start hunting!
immunefi.com/bug-bounty/metr…
Alex Parra retweeted
“We’re audited and we’ve been live for a while.”
We host the bug bounties of 25 lending protocols, including some of the most consequential in DeFi, like Aave, Sky, Spark and Compound.
1 in 3 critical bugs found on lending bug bounty programs on @immunefi came a year or more after the program went live. That’s code teams had already shipped, with deposits sitting in it for over a year, and a critical was still waiting there.
That’s the value of a bug bounty. It keeps independent researchers on the code that holds your deposits.
Read the full breakdown: immunefi.com/solutions/lendi…
Alex Parra retweeted
AI made it easier to submit reports. More reports meant more noise, which meant more restrictions: submission fees, rate limits, and accuracy penalties.
Immunefi Studio helps you avoid wasting time and money.
Signals helps you choose where to hunt. Review checks your report before you submit, so you can send stronger reports.
And the credits you earn from valid work can pay for your Reviews.
But don't take our word for it:
"my first 5-fig report ($50k) came from picking the program through /signals, the data showed exactly where to look/priority. and /reviews changed how I work entirely, went from submitting more submissions to stacking 3 criticals back to back because I started focusing on quality over quantity." - @Horvix_
Studio launches soon.
Alex Parra retweeted
Alchemix Finance offers self-repaying loans: you borrow against a deposit, and the yield on that deposit pays the loan back.
It launched V3 after 5 security reviews. In June, a researcher found a critical in one of V3’s vault strategies through Alchemix’s bug bounty on @immunefi, a bug that put user funds at risk of theft. The researcher was paid nearly $300,000.
We’re at Digital Asset Summit on Tuesday and Wednesday, and the Stable Summit on Friday. If you run a lending market or a CDP, come and find us.
Our team on the ground: @theBliz_ @0xAtomist @Cesare_Immunefi
immunefi.com/solutions/lendi…
Why doesn’t iOS delete update files after updating? Had over 25GB before updating and now barely have any space left. 🤬
1
71
Alex Parra retweeted
@plether_fi Audit Competition day 5 is on 🔥
9 Criticals. 9 Highs. 31 unique valid findings.
Top 5 so far:
1. Mclovin
2. @Omisanin0
3. Ailenia
4. @4nescient
5. thorthumbz00
More than a week still to go. Who takes the top spot? 👀
@immunefi
Alex Parra retweeted
At least 33 lending and CDP protocols were hacked in 2026, and 7 in 10 had been live over a year.
Bugs keep turning up in old code.
On Immunefi’s lending bug bounty programs, 1 in 3 of 149 critical bugs came a year or more after the program went live.
Alex Parra retweeted
Feedback like this came in from day 1.
It’s still coming in today. People got what we build and they still do, and that means a lot.
It’s how we built Studio: listen to what the community needs, then measure what we ship against real usage and candid feedback.
Excited for what’s next.
Credits are now live on Immunefi.
If your report is valid, duplicates a real bug, matches a private known issue, or wins mediation, you get your submission fee back as credits.
But credits only help after you submit.
They can't give you back the weekend you spent working on a bug someone else already found.
That's where Immunefi Studio comes in.
It helps you find where to hunt and check your report before you spend hours on it.
Don't just take our word for it. Hear from the researchers using Studio Review:
"Studio Review is genuinely most valuable to me for catching private duplicates, since that's the one thing I can't check on my own. I really want to say: you've built something great here. " -@coinsspor
“The review is awesome help us filtered tons of dup submissions.” - @JoohhnnnChase
Studio launches soon.
Alex Parra retweeted
Security doesn’t end when the audit does.
The code stays live. The money stays live. And so should the scrutiny.
If you’re building or running lending markets and heading to DAS or Breakpoint, come find us. We should talk 🫡
149 critical bugs found and confirmed on lending bug bounty programs on Immunefi.
1 in 3 came a year or more after the program went live.
Alchemix had five security reviews. Five. Its V3 went live in April.
Two months later, a researcher found a bug that could have let someone steal user funds.
The team heard about it within three hours. The researcher got paid almost $300,000.
The five security reviews didn't catch the bug but the bug bounty did.
25 lending programs run live on Immunefi, including Aave, Sky, Spark and Compound.
See how they stay secure:
immunefi.com/solutions/lendi…
Alex Parra retweeted
That’s how it should be! Still, navigating multiple PRs on GitHub browser tabs is clunky and limiting.
Mergiato aims to make that a lot smoother.
Get ready SRs!
The @plether_fi audit competition launches in less than 3 days.
💰 $80,000 reward pool
📅 Runs Nov 2 – Nov 15.
Open to all registered researchers who meet the eligibility rules.
Program details, and when it goes live: immunefi.com/audit-competiti…
3
157
Alex Parra retweeted
Today's Claude extension compromise is a good reminder to do this. If you're using VSCode @code, Cursor @cursor_ai, or any other IDE built on VSCode, I would immediately enable extensions.installCooldownHours.
I've set this setting to 72 (hours), which is a much safer delay to install new updates to extensions than the default setting of 0 (immediate updates).
This prevents extension updates from getting installed for 3 days, which would hopefully eliminate most of the risk from compromised updates. It's not foolproof, but it's better than no delay.
Heck, set it to something even higher to be safer, like 336 (2 weeks).
