William Bowling @[email protected] @wcbowling

Security Engineer at @zellic_io, a.k.a vakzz when doing bug bounties and CTFs with @pb_ctf - https://t.co/9bjECLAwXg wbowling.info Tasmania, Australia Joined July 2013

Tweets

214
Followers

6K
Following

413
Likes

338

Zellic @zellic_io

2 weeks ago

You’re probably using WebViews wrong. There are a million ways to use a WebView wrong. Properly securing a WebView is hard. In this thread, we’ll cover common vulnerabilities in wallet WebView implementations and the ways to properly secure WebViews.

1 39 225 20K 196

Download Image

Zellic @zellic_io

5 months ago

How to spot misleading audit competition metrics Competitions are crowdsourced audits, where auditors compete to find bugs in a set timeframe. Last year, we acquired @code4rena which does these. We've also seen tons of misleading sales pitches. Here's what to watch out for: 🧵

13 57 286 112K 95

Download Image

Zellic @zellic_io

6 months ago

With the rise of AI agents, we expect new bugs, but we’ve instead found old bugs in disguise. Let’s look at two old-school bugs we found while looking at elizaOS: • An SSRF allowing internal services to be accessed • An LFI allowing host files to be read Let’s dive in 🧵

1 12 71 17K 39

Download Image

kamensec @kamensec

8 months ago

Just completed my 10th audit as a contractor @zellic_io and these are my top favourite things about this place: 1. They have a diverse and deep talent pool. World top Web security, Cosmos, Rust, Golang, MOVE. They have experts in every direction I want to move into (pun…

4 8 80 7K 14

Zellic @zellic_io

9 months ago

What happens when Random() isn’t random? Here’s how popular projects, including Proton Wallet and the Dart SDK were all affected by the same underlying weakness we uncovered in the Dart/Flutter ecosystem. All issues found were responsibly disclosed with the vendors. Let’s go…

4 30 153 19K 67

Download Gif

Solidity @solidity_lang

11 months ago

✨ Our judges also decided to give a special mention to @wcbowling for his submission in which the bug allows a `multisig` storage variable to be overwritten, allowing the `emergencyWithdraw` function to be called by an attacker. Read @PatrickAlphaC’s thoughts on this…

2 6 18 11K 5

Zellic @zellic_io

a year ago

Version 0.11.0 of gnark was just released, which fixes two vulnerabilities in the Groth16 backend reported by Zellic (CVE-2024-45039, CVE-2024-45040). These affect the soundness and ZK property of generated proofs. Read on for more details and how to check if you're vulnerable.

2 22 132 33K 52

Download Image

Zellic @zellic_io

a year ago

Zellic has moved forward to the final voting phase for @arbitrum's Security Council! We ask delegates to vote for Zellic as the Security Council furthers our mission to maximize TVL and extends our commitment to Arbitrum and its ecosystem. Vote here: tally.xyz/gov/arbitrum/c…

0 7 26 7K 2

perfect blue @pb_ctf

2 years ago

2023 was another great year for the team! 🎉 Blue Water, a collab between perfect blue and @Water_Paddler, placed 1st in CTFtime globally!🏆 🥇1st place in 6 CTFs 💻Hosted a successful pbctf 2023 In the past, we also placed first in 2020 and 2021.✌ Looking forward to 2024!🎆

1 15 103 28K 1

Download Image

Zellic @zellic_io

2 years ago

The dangers of integer truncation: How the Zellic team found a critical vulnerability in the @AstarNetwork. This bug allowed an attacker to drain certain LP contracts on the Astar-EVM, with no bugs required in the contracts. Read more: 🧵👇

3 44 224 72K 116

Download Image

Zellic @zellic_io

2 years ago

Meet Cairo, the native language of Starknet. In this thread we'll: ✅ Introduce Cairo & Starknet ✅ Explore the security features of Cairo ✅ Examine potential pitfalls when writing contracts in Cairo ✅ Give you things to consider when writing secure code Let's dig in👇🧵:

5 11 33 11K 23

Download Image

Zellic @zellic_io

2 years ago

Earlier this morning, @safemoon's Liquidity Pool was compromised and USD 8.9M worth of tokens were withdrawn. After looking at the transaction trace and the recent contract changes, we can tell you what happened:

2 6 44 13K 5

numbers @numbersdoespwn

3 years ago

Writeup for #PBCTF2023 git-ls-api pwnfirstsear.ch/2023/02/22/pbc…

1 6 20 4K 3

perfect blue @pb_ctf

3 years ago

It's finally happening! pbctf 2023 is here 🗓️ Feb 18th, 14:00 UTC to Feb 20th 02:00 UTC (36 hours) 🎁 A $10,000 prize pool Proudly sponsored by @zellic_io ctftime.org/event/1763

0 10 78 27K 4

Download Image

RBTree @RBTree_

3 years ago

3 2 78 8K 0

Download Image

Zellic @zellic_io

3 years ago

This weekend, we played 0xmonaco @matchbox_dao, a web3 gaming competition. We developed a highly profitable racing strategy by leveraging clever math and bugs. We got DQ-ed😅 In this thread, we'll break down: 🎯 our car's unique strategy 🎯 the vulnerabilities our car exploited

4 14 79 32K 23

Download Image

William Bowling @[email protected] @wcbowling

3 years ago

CTF + Bug Bounty + GitLab? How could I refuse such a challenge 😀

Johan Carlsson @joaxcar

3 years ago

CTF + Bug Bounty + GitLab? How could I refuse such a challenge 😀

0 6 47 0 15

1 0 39 0 5

yvvdwf @yvvdwf

3 years ago

My pleasure to share the details of my first #RCE: gitlab.com/gitlab-org/git…

5 128 555 0 89

s1r1us @S1r1u5_

3 years ago

Here are the Slides for "Electrovolt" published at @nullcon, @BlackHatEvents, and @defcon speakerdeck.com/s1r1us/electro…

0 64 230 0 51

‌Renwa @RenwaX23

3 years ago

Asana Electron desktop app open redirect to local file read Did you knew local files in Electron have file:// origin not null, with another Mac trick we load our malicious file and steal any file on the pc bugcrowd.com/disclosures/f7…