Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Chaofan Shou Profile picture
Chaofan Shou
@shoucccc
phd student @ucberkeley working on security (#fuzzing #plse #llm) / intern @hackthedefi
Apr 14 • 9 tweets • 3 min read
Technical details on how we made $10k/hr by mining $ORE via @bloXrouteLabs @jito_sol and GPUs.

[1/8] 🧵Image @bloXrouteLabs @jito_sol [2/8] WTF is $ORE

ORE is a token on Solana with a mining program. One can claim ORE from the mining program by sending correct nonces (calculated by trying hashes) to it.

A mining tx looks like this: Image
Dec 13, 2023 • 7 tweets • 4 min read
😝 Here is the full disclosure of the Twitter XSS + CSRF vulnerability.

Clicking a crafted link or going to some crafted web pages would allow attackers to take over your account (posting, liking, updating your profile, deleting your account, etc.) On 12/11, @rabbit_2333 posted details about an XSS on the Twitter subdomain .

analytics.twitter.com
May 9, 2023 • 8 tweets • 2 min read
How to make $800k every day by rug pulling?

A tutorial 🧵[1/7] Image Create an ERC20 token, preferably with some funky names.

Some examples 👇

[2/7] Image
May 8, 2023 • 4 tweets • 2 min read
gg! Our fuzzer can solve all challenges automatically in <16hrs on single core with some fine tunings 🔥🔥

Will share the writeup

Try it out: github.com/fuzzland/ityfu… And kudos to @publicqi for solving even faster than the fuzzer and using less gas
Apr 20, 2023 • 8 tweets • 7 min read
🈹 Stop buying #pepedao / #pipipump / #bobcoin, owner can rug you.

Scammer deployed >67 malicious tokens. These contracts are obfuscated and designed to bypass @GoplusSecurity & @Token_Sniffer's rugpull analysis.

~$300k funds have already been rugged.

#ScamAlert #rugpull twitter.com/i/web/status/1… Image @GoplusSecurity @Token_Sniffer So, what's going on?

1. The attacker uses "oowner" to define the owner so that analysis considers the contract has no owner -- really benign in the eye of static analysis! twitter.com/i/web/status/1…