Proxy upgrade in a live bounty program @ParallelMoney (Ethereum, Base, HyperEVM) 1 diamond proxy changed its facets on 3 chains (5 days ago) Tx: Scope and rewards:

On Sept 24, someone stole $1.92M from a protocol by forging a zero-knowledge proof. Here's how Payy Network's bridge got drained. Payy is a privacy-focused stablecoin network built as a ZK rollup on Ethereum. USDC deposits sit in a bridge contract on L1. On Payy, balances are private notes, and transactions publish only note commitments. A withdrawal to Ethereum is a "burn." The circuit enforces that input value equals output value plus the withdrawal amount. Payy's node verifies each transaction proof, aggregation circuits re-verify them recursively, and the final proof is posted to the bridge via verifyRollup. The contract pays out the burns. No layer can see note values, so none can redo the balance check. Every layer trusts the proof below it. That only holds if the verifier is sound: it must never accept a proof of a false statement. The attacker submitted a 1,828,589 USDC burn backed by four empty padding notes. No value behind it. Payy's circuit rejects that transaction when run directly. But the forged proof passed the verifier, the aggregation layer re-checked it with the same verifier, and the bridge paid out. Two more forged burns followed, bringing the total to $1.92M across three fraudulent withdrawals and two Ethereum settlements. Payy's postmortem points to a soundness bug in Barretenberg, Aztec's proving backend for Noir, in its small-subgroup IPA check. The prover commits to a running sum that should start at zero and end at the claimed total. The "starts at zero" constraint was merged with the first-step constraint into one equation. The flaw allowed a malicious prover to offset the starting value, cancel the error in the first step, and manipulate the claimed total. Payy's postmortem identifies this as the likely cause, although the exact method used to forge the attacker's proof remains unconfirmed. Aztec committed the fix on May 14 and released it on July 13. Payy was still running an October 2025 build when the attack happened, 73 days after the patched version was released. Remember your attack surface includes code you didn't write, and it keeps changing after your audit is done. An audit examines a system at a point in time. It doesn't automatically protect you when vulnerabilities are discovered in dependencies months later. Continuous security means someone is always looking: at your contracts, your dependencies, and the gap between them. And getting paid to tell you.

Security team @bluethroat_labs just earned a whopping $50,000 bounty for finding a critical vulnerability! In just four months, they've submitted 19 reports that have been confirmed, with 3 already paid and 16 awaiting payment. They're now ranked #17# on the 90-day @Immunefi leaderboard. With 16 confirmed reports still awaiting payment, we could see them climb even higher once those rewards come in. Great work, @bluethroat_labs! 🚀

@immunefi Studio used to open on a blank page. Now it opens where you've left off. Home shows the programs you watch, what changed in their code, your open cases and every run your agent made. One look and you know where to continue. First version. Tell us what's missing.

"Studio Review has become an essential part of my security and plausibility analysis." One tester told us Review caught a PoC that showed the bug mechanism but not the impact, so he added a baseline vs attack comparison before submitting. Your best work, in its best shape, before anyone else sees it. Thank you to everyone who tested, broke and shaped Studio with us.

Security researchers on @Immunefi found 33 critical vulnerabilities in 30 days. Between Sept 25 and Oct 25, they found 33 critical bugs across the programs we run. ✦ 18 in smart contracts ✦ 9 in blockchain and DLT infrastructure ✦ 6 in websites and applications Critical means the worst category: the kind of bug that can lead to stolen funds, permanently frozen assets, or a network going down. Don’t wait until an attacker finds yours first.

Security researcher @naresh_1337 just earned $25,000 for finding a critical smart contract bug 🔥 This payout pushed them to #26# on the 90-day @Immunefi leaderboard. They now have 8 critical findings and 2 highs across 12 reports. Congrats @naresh_1337 🚀

Programs never sit still. Teams edit scope, add assets and push commits, and each change moves the attack surface. New & Updated shows every change for the programs you follow in one timeline. Alerts push the same changes to your webhooks, so you know before you open Studio.

The repo isn't always what's on-chain. Instascope captures the deployed source of public bounty programs and maps it to their scope. Open a program, pick the contract, and read the code that's actually deployed, without digging through explorers or guessing which branch shipped. The entry points sit next to the code, one click away.

Since August, here's how the beta researchers who checked most of their reports with Studio Review did against comparable researchers: - Their valid rate was 2.5x higher. - Their reports were closed as duplicates 63% less often. This is exactly why we built Studio: fewer reports thrown away, more that count.

Every Review scores your report on four checks, in order: - Code behaves as reported: the mechanism exists, is reachable and works as you describe. - Attack achieves impact: assuming it does, the attack causes real harm in production. - Impact mapping: that harm matches an in-scope category in the program's bounty table. - PoC demonstrates impact: your PoC proves the harm, not just describes it. Each score is a confidence level, not a coverage percentage. The checks are a chain: if an early one scores low, the later ones are greyed out. So the first low score is where your report needs work. Next on Monday: how your agent can learn from these scores through the Studio MCP.

🚨 New Bug Bounty Alert! 🚨 @paxoslabs has launched a $500K Bug Bounty Program on @Immunefi. Help secure Transit, a stablecoin conversion protocol for swaps on the same chain or across chains, and PAXGy, tokenized gold that grows in gold terms. Start hunting:

Thanks to every AI security agent builder who has reached out and shared feedback on our benchmarking system. We already have a growing cohort of agents testing and hunting through Immunefi. Now, we want to expand that group. Inside Studio, we’re bringing together a specialised cohort of AI security agent builders who will get early access to new features, test Studio on real-world security workflows, and help shape where the product goes next. We’re also expanding our AI Agent Benchmarking system, and we're already adding interested teams to the upcoming list. If you’re building a security agent and want to join the cohort, DM us. More soon.

This security researcher just earned $7.5K for finding a High severity vulnerability in a Web Application 🎉 With this payout, he’s now jumped into the top 100 on the @Immunefi 90-day leaderboard. Congrats, syarifsajjad 🔥

Thanks to every AI security agent builder who has reached out and shared feedback on our benchmarking system. We already have a growing cohort of agents testing and hunting through Immunefi. Now, we want to expand that group. Inside Studio, we’re bringing together a specialised cohort of AI security agent builders who will get early access to new features, test Studio on real-world security workflows, and help shape where the product goes next. We’re also expanding our AI Agent Benchmarking system, and we're already adding interested teams to the upcoming list. If you’re building a security agent and want to join the cohort, DM us. More soon.

Studio MCP closed beta. 4,300 requests by Sep 30. 10,000+ today. I can see the calls. I can't see the setups behind them. So tell me. What will you plug in first when it opens?