Aave proposes increasing critical vulnerability bounties: V4 up to $2.5M from $500K, V3 up to $5M from $1M. Funds for V3 on Aptos to shift to DAO.
🚨 CoinGape Web3 Innovation Awards 2026 nominations have officially been extended by 48 hours. 🏆 More submissions continue pouring in 👥 Industry leaders joining the jury panel 🚀 Competition for this year’s awards keeps growing ⏰ New Deadline: 17 May, 18:29 UTC 👀 Submit your nominations now before the final window closes Nominate now in comments 👇
gm 𝕏 this line from @P2Pdotme transparency filing stood out to me: “No exploits or security incidents have affected protocol funds or tokenholders as of 2026-04-24.” ✦ 24 months live. ✦ real users. ✦ real money moving. ✦ not one exploit. in crypto, that’s rare. a lot of projects market security. very few can point to a public filing and verifiable track record. this is what real transparency should look like. @P2Pdotfound
Superform takes security very seriously! They already had at least 9 audits for the v2 contracts involving different security auditors and researchers. Now they are opening a Bug Bounty Program on @cantinasecurity with a maximum reward of 100,000 $USDC + $UP. It's always been their priority to proactively make sure the whole protocol is safe. Every user should have peace of mind knowing their assets are secure. And @superformxyz continues to double down on that as the ecosystem grows.
Zak Folkman, Co-Founder of WLFI, sat down with The Block to respond to Justin Sun’s allegations. Good to finally hear a direct response instead of recycled CT narratives. People should watch the interview before picking sides.
You Don’t Need Permission to Become a Smart Contract Security Researcher Just Start Breaking Things. There’s a lie a lot of people carry into Web3 from traditional tech That you need permission to start. ⇨ A certificate. ⇨ A job title. ⇨ A mentor telling you you’re “ready.” But if you’re trying to break into smart contract security, that mindset will keep you stuck longer than anything else. Because the truth is simpler and a bit uncomfortable You don’t become a smart contract security researcher by waiting. You become one by breaking things.
so superform just dropped a live bug bounty on cantina and it’s actually worth looking at critical bugs = up to 100,000 usdc & $up tokens high severity = up to 20,000 usdc & $up for context, superform is a non-custodial protocol that allows anyone to build and distribute onchain financial products. basically they let curators build yield vaults (supervaults) on top of multiple strategies. the security layer is wild tho, they use a validator-attested oracle + dual merkle hook validation to keep the price per share accounting clean. that’s a lot of moving parts which is prolly why they need researchers on it. been live since may 1, 2026 with 22 findings already submitted what counts as critical? things like “direct theft of principal from any supervault,” “unauthorized minting or inflation of supervault shares,” or bypassing the pps oracle’s signature validation. basically if you can drain funds or fake the accounting at scale, that’s the big bag tier. the high tier covers stuff like stealing unclaimed fees or freezing user funds for 48+ hours. medium is paid in $up only, which is lowkey a signal they don’t take those too seriously. a few catches tho: - kyc required before payout (yep, dox yourself first lol) - $20 deposit to join - no testing on mainnet, local forks only -you need a working poc (foundry or hardhat) or your submission gets binned safe to say this is built for proper security researchers, not casual hunters. the dual merkle + oracle setup is complex enough that finding a real critical prolly takes deep evm knowledge and time. @superformxyz's architecture is genuinely interesting, if you’re a smart contract dev or researcher, the risk-reward here is not bad at all. for the average degen, like myself this one’s not for us lol, but worth watching what comes out of it. just created a cantina account. not like i'm going bounty or anything. anyways, @cantinasecurity why don't y'all have a dark them layout👀
To ensure the safety of your in-game funds, our smart contracts are fully audited by @hackenclub. Your money is in safe hands 🔐 Please scroll to the end of this post to read the full audit report 👇
Before your protocol ships, run this check: ✅ vCISO with a live threat model ✅ Unit + invariant + fuzz testing ✅ Formal verification on critical paths ✅ AI audit pre and post remediation ✅ Manual review + 10-12 red-team researchers ✅ OPSEC audit on keys, infra, team hygiene ✅ Web2 + Web3 monitoring live on day 1 ✅ Incident response plan written and trained If any box is unchecked, you have a gap. Gaps are how $635M disappears in one month. Full breakdown of each layer 👇
