Lucas Ma

@MaLucasBC

troubled-pound-1ed.notion.site/PengXiang-Ma-1…

Joined October 2022

354 Following

116 Followers

Replies Reposts Media

Pinned
Lucas Ma
@MaLucasBC
Sep 4, 2025
Due to the 3 vulnerabilities of source code verification service, successfully entered Etherscan's Hall of Fame and bounty. Thanks Etherscan. At present, we have discovered 9 source code verification-related vulnerabilities in Etherscan, Blockscout, and Sourcify.
2
Lucas Ma
@MaLucasBC
Jul 24
A mentor of mine built SafeClaw — a handy way to safely give agents GitHub API keys or account access. Worth checking out: safeclaw.pro
Xiaohang Yu
@xhyumiracle
Jul 18
After 3 month, safeclaw.pro is reborn to online 🎉 if you ever paste any api keys / tokens (e.g. github, gmail etc) to your agent, you should have a try. The first 100 Founding Members: free for life. (already 5/100) Share your comments below! No matter love or hate
Lucas Ma
@MaLucasBC
Mar 18
Unlike hackenproof, immunefi only focuses on marketing and making fake stars. At least in hackenproof, you can see that they say white hats are important, and you can see the newcomer help mechanism.
sashko🇺🇦
@d0rsky
Mar 18
Paid submissions? Let’s talk We need to be honest about what’s happening to bug bounty right now We live in AI era, where submission volume is growing fast, but signal is not A lot of reports getting lost, delayed, or stuck in review loops And this hurts everyone - especially
Lucas Ma
@MaLucasBC
Mar 18
I'm collecting more such cases. Please contact me if anyone is unfair treatment in immunefi. We form a victims' alliance, keep the evidence and release them.
SlowBearDigger
@SlowBearDigger
Mar 17
I also created a ISSUE on github describing this github.com/HathorNetwork/… So this just keeps being public and people know... To all the whitehat fellows, don't waste time on platforms like @immunefi because they don't care about you, and don't even think about sending reports
Lucas Ma
@MaLucasBC
Mar 18
By the way, I want to find someone who wants to finish this thing together. But this is not profitable, which means we won't get any benefits. We can't be trapped by an opaque rogue platform.
Lucas Ma
@MaLucasBC
Mar 18
hackmd.io/zRB6--LrReKiOc… We need a decentralized bug bounty platform and clearly disclose every bug report afterwards! No need for a classifier. If vulnerability need to be handled as soon as possible, just pay a fee or calculate pow. The project party can use this fee to hire.
1