Hacking, AppSec, and Bug Bounty newsletter

2018-02-23 | Buggy smart contracts, Akamai’s state of the internet, and Snapchat’s $25K bounty

UPDATED to include twitter thread from @dguido providing context on the "Finding The Greedy, Prodigal, and Suicidal Contracts at Scale" paper and we also added a mention of Shopify's 2017 Bug bounty results. 

Friday, February 23


  • Smart contracts—stateful executable objects hosted on blockchains like Ethereum—carry billions of dollars worth of coins and cannot be updated once deployed. New paper by UK and Singapore based researchers presents a systematic characterization of a class of trace vulnerabilities, including 34,200 buggy smart contracts on Ethereum but Dan Guido has serious questions on the evaluation of their results - see his tweet thread and read Motherboard's writeup.


Toyota, Adobe, U.S. Department of Defense, Yahoo!, Uber, WordPress and more all resolved reports in the past 24-hours and Google Play awarded a $5,000 bonus.

You can see all the latest and greatest disclosures and bounties on  


  • well, the dev who created this just made my day - @_ayoubfathi_



Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.

Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?

Have a news tip / story to highlight? We’d love to hear about it. Email:

Get this email forwarded to you? Click here to subscribe to the Zero Daily

After analyzing nearly one million smart contracts, the researchers found 34,200 that were critically vulnerable... On a subset of roughly 3,000 contracts, the team was able to verify and reproduce the flagged vulnerabilities with an 89 percent success rate.



HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty program solutions encompass vulnerability assessment, crowdsourced testing and responsible disclosure management. Discover more about our security testing solutions or Contact Us today.