How to steal $5M with a read-only bug

The bug produced a duplicate that could not be written to, so for two weeks it looked like a dead end. I checked tens of thousands of lines and found nothing. What broke it open is that everything downstream still trusted the copy, and once I understood that, the problem stopped being the VM and became a search for a protocol whose price maths I could reach.

There were about fifty candidates and no time to read them by hand, so I wrote a tool against decompiled bytecode to find them instead. Metastable went first, for $2M. Then I ran the same eight steps against Bucket Protocol and got $3M. Both were reported and fixed.

I will show the escalation as it happened, including the two weeks that went nowhere, because that is the part nobody presents. You will leave with a sharper severity instinct: VM-level invariant breaks do not stay contained, and the second exploit is always cheaper than the first.

Speakers: Bartosz Barwikowski

Track: Security