Security Researcher, Advocate & DeFi Investigator Ex @immunefi
Death City
Joined July 2023
- Tweets2K
- Following1.3K
- Followers1.2K
- Likes4.7K
Pinned Tweet
After years of devoting my time to supporting ethical hackers...
I'm now on the journey to becoming one myself.
Hi. I'm known as PappaPug or Oddly in security circles.
You may have seen my profile in the past replying to support requests and hyping up whitehats...
It was my job for years to meet and speak with the best onchain hackers. Many friendships were nurtured during that time.
That path diverged since Dec 2025, and now I'm a free agent, getting back into web3 with two main goals:
1. To hunt, to seek, to provide services and feed my family with the skills and resources I have.
2. To question everything about how things work and understand what's under the carpet in the machinery of code and contracts, so that no one gets hoodwinked by fancy marketing.
Having been a marketer myself, I can smell it from miles away. I'm letting my intellectual curiosity and bubbly personality get carried away on this journey to becoming a world expert on smart contracts and decentralized finance.
See you at the finish line.
Love, PappaPug
Pappa Pug retweeted
Update: Immunefi upheld the duplicate closure.
Their own fix-bypass policy says a bug that wasn't effectively fixed should be reported.
That's exactly what I did. The PoC in my report still works after the attempted fix.
Yet their mediation response didn't even mention the fix-bypass policy.
So what's the point of having it?
Why would any whitehat spend time checking whether a fix actually works if the answer is still "duplicate, no reward"?
I thought Immunefi was supposed to keep this fair.
Instead, they're keeping their clients happy.
Projects trying to rug whitehats seem to be the norm lately.
I recently found a High severity bug. The project closed it as a duplicate of an earlier report. Which is technically true since both have the same root cause.
The funny part is they already tried to fix it.
And failed.
My PoC demonstrates that their fix can be bypassed and the bug is still exploitable.
@immunefi even has an explicit fix-bypass policy for cases like this:
immunefisupport.zendesk.com/…
But I guess it's easier to close the report than fix the bug and pay the whitehat.
Pappa Pug retweeted
Love this! If I had kids, I’d love to teach them this way.
I’ve been exploring learning through play too! A Claude skill for making hand-drawn, interactive everyday objects. Here’s my little washing machine :)
colorfigures.vercel.app
Follow up: what's some good groups to join for discussion of novel DeFi/web3 mechanisms and protocols?
Not trading/marketing/pump/hype groups.
Priority to technical or non technical discussions about blockchain applications.
Great one para to explain what bug bounties are:
To anyone who don’t much about hit bounty your basically a guy who searches through a programs or website codes for cracks that hackers can use or manipulate extremely tedious to do and sometimes long hours you can learn it and plenty of ways to get into it but the pay can be random due to how much the company will pay as well as how long it will take for companies to respond to your submission
Heck yeah.
This is Pele, my new rendering library for diagrams and charts, compatible with the latest Mermaid syntax.
- 100-500× faster than mermaid.js
- 6× smaller bundle
- No dependencies
- Easy to theme
- Responsive to device width
In pursuit of making Obsidian insanely fast and cohesively designed, I always found the Mermaid library to be too big, too slow, and too hard to theme. Pele will be the new renderer in the next version of Obsidian, but you can start using it now.
Pele [ˈpɛlɛ] is named after the goddess of volcanoes and fire. It's open source under the MIT license. Try the playground!
Looking for solo-dev projects that need a one week trial of growth + distribution.
Let me work my magic paws for a week! 🐾
If you like working with me, we can do a fixed monthly rate!
Dear whitehat frens..
I miss you guys! If you're free, do drop me a DM or a reply.
Thanks again for always being here for this pup.🐶
You are some of the kindest and most generous people on the planet. 🌍❤️
Well deserved!!
Career update folks.
I'm excited to announce I'm joining @HalbornSecurity as Director of Managed Solutions!
Halborn is heading into a new chapter and I can't wait to talk more about where this is going. I'll be leading managed service delivery and operations.
Thrilled to be part of what's next!
Pappa Pug retweeted
> El CEO de OpenAI admite que la IA no causará el apocalipsis de empleo que predijo
> Uber no encuentra un retorno que justifique sustituir humanos por IA
> Starbucks elimina la IA de su sistema por fallos constantes
> Microsoft retira Claude Code a sus ingenieros por no ver mejora en costes
NATURE IS HEALING
🤝 Paid partnership
Pappa Pug retweeted
really enjoyed collaborating with @AdamWhitcroft on this one!
Pappa Pug retweeted
The original MakerDAO code written in "daiwanese" is still one of the most underappreciated SE feasts in Web3. It's the opposite of current code slop with hundreds of unnecessary libraries and object hierarchies. Complicated code = more surface to exploit
Study daiwanese. Minimize your code. Learn FV. The future is opposite to current slop practices
SR Life Simulator is still in development... I just had to find a way to pay the bills in the meantime.
My dream of becoming an indie dev is still in progress, but at least I'll be able to take care of my family for now.
