https://xcancel.com/v12sec/status/2061401842324820205
Thorchain has pulled a Microsoft.
Security researcher V12 has posted a tweet, with receipts, showing that they were stiffed out of a vulnerability payment after disclosing. The text of the tweet reads:
We reported a critical loss of funds bug to
@Thorchain
(32M TVL, 150M FDV)They silently patched it and told us their bug bounty program is permanently retired.
We have more Thorchain chain halt DoS vulns. We intend to release them (open disclosure) in the coming few days
Humoroursly, in a followup tweet, V12 writes "the code quality is honestly not great (in our opinion) so we wouldn't be surprised for there to be more crits lurking still". What an absolute disaster. And what's worse is they apparently aren't even paying out to security researchers anymore. How anyone can take this project seriously is a wonder.
