SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Sealed: A Bug Bounty Where a Contract Runs the Exploit Instead of a Human Triager

0
·6 views

The author argues that bug bounty triage is increasingly strained by AI-written reports that can be convincing yet wrong. To test this, they built a 52-item corpus against five OpenZeppelin Ethernaut levels and had three LLMs act as triagers. Models were persuaded to pay out on fake exploits supported by written explanations, while also refusing some genuine breaks. The proposed remedy is Sealed, a NEAR contract that holds the bounty pool and runs submitted exploits in a TEE-based verifier, ignoring the hunter's explanation. Payouts go only to the first verified break per invariant, with bonds slashed for hunter-caused failures. The author stresses the study's limits, including one run per model and no code execution during triage.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Pillow and sharp handle Display P3 photos differently by default, shifting colors

Testing a Display P3 image through Pillow 11.3 and sharp 0.34.5 with default settings produced JPEGs that were wrong in opposite ways. Pillow's output looked washed out because it wrote the P3 values unchanged without a profile, which browsers read as sRGB. sharp converted to sRGB first, keeping everyday colors accurate but clipping the most saturated ones. Neither library is buggy; each simply defaults to a different target that pipelines inherit unless set deliberately. For images viewed in color-managed contexts, the author recommends keeping the P3 profile, which adds only about 554 bytes and stays close to the original colors.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Audit of 1,000+ JAMB and WAEC maths questions finds four topics dominate exams

ALOC Station analysed over 1,000 verified JAMB UTME mathematics questions from 2000 to 2024, plus a pilot sample from WAEC WASSCE, indexing each to curriculum topics and Bloom's taxonomy. The audit found that Geometry, Algebra, Statistics and Number Theory together make up more than 65% of JAMB maths questions. Topics such as Matrices, Modular Arithmetic and Logarithmic Variations account for under 4.5% of tested items despite taking up substantial classroom time. The authors argue that candidates often fail not from lack of study but from misallocating their revision effort. The findings are presented as a case for data-driven exam preparation over teacher lore and tutorial booklets.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI system reports proof of 2008 Aaronson-Ambainis quantum computing conjecture, verified in Lean

Physical Superintelligence announced on November 6, 2026 that its internal research system, running a non-public Anthropic model, produced a proof of the Aaronson-Ambainis conjecture, which has been open since 2008. The Lean proof assistant accepted the argument, including a final version refined twice by the system, and the manuscript and formalization have been made public. The conjecture concerns whether quantum computers can be exponentially faster than classical ones on random inputs, lacking the structure that enables speedups like Shor's algorithm. The proof has not yet been peer reviewed, and experts still need to confirm that the formal statement checked in Lean matches the original conjecture.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Essay Warns AI Safety Failures May Stem From Misreading Reality, Not Malice

The author argues that the greatest risks from artificial intelligence may come from errors, misinterpretations, or unforeseen situations rather than a deliberately hostile machine. Drawing on The Matrix, they focus on the danger of AI producing a representation of reality so convincing it is hard to tell apart from the real thing. They also reference the film A House of Dynamite, which depicts leaders making high-stakes nuclear decisions under time pressure with incomplete information. A thought experiment follows: an AI that follows every safety rule could still help cause the disaster it was meant to prevent, if its analysis prompts actions that alter the behavior of people involved.

0 comments Read more at DEV Community