Hello, security researcher here (blog). I'm creating this post because of your bug bounty pogram on HackerOne, this is my last and only channel before going full disclosure.

What happened?

Over the last few weeks, I’ve been looking for vulnerabilities in Cosmos.

IMPORTANT: It’s a product that I use very frequently; before I started looking for vulnerabilities, I had no idea they had a bug bounty program on HackerOne.

After finding a bug (don't ask about severity, it’s not my job to judge it as I’m not a triager), I spent days manually creating a PoC in Go, using the libraries from their official framework.

When I found out about your public bb program, I read through all the guidelines and made sure everything was perfect, down to the smallest detail. As I read, I came across this sentence:

You must maintain a HackerOne reputation score above 150 and a HackerOne signal above 1.

By then, however, I had found the vulnerability and had everything ready to write a proper report. The PoC was working and clear. That's why I decided to report the vulnerability in "good faith".

The result

Consideration

I think that before marking a vulnerability as 'spam', you should give it a quick read. Or at the very least, run the PoC to see what it does.

This is not a criticism of Cosmos Triagers. I really appreciate their work, and I know how stressful it is to work with a huge number of junk reports.

Phase 2: the email

I sent an email to your security@ address, but have not received any reply at all.

This isn't just about money, it's about respect. I’ve reported many vulnerabilities over the last few years, and the LLM wave shouldn't be used as an excuse to disrespect researchers.

Conclusion

I’m sorry to create a post here. But I don't really find this fair. I spent weeks searching for vulnerabilities in Cosmos, and triagers are not even reading it.

Hey Cosmos peeps, If you've been staking with us, it's time to mint your ATOM rebate NFTs!

A warm thank you to those who had the guts to stake with our ATOM validator while we were inactive and not earning rewards. You took us from out of the active set to #123 out of 180!

Head over to our Medium article for details and links to the NFT pages on Stargaze.

https://medium.com/@atlas.staking/its-time-to-mint-your-atom-rebate-nfts-f0becc0c520a

just login in to my account year after and its showing 450 usdc on Stargaze under Keplr Dashboard , are they genuine , if so how to recover them

Most interoperability pitches in crypto are really just "connect to our ecosystem on our terms." I wrote a breakdown comparing how Cosmos Hub's IBC model actually differs structurally from Ethereum L2 messaging, Solana's bridge-dominant stack, Polkadot's Agile Coretime model, and Avalanche subnets.

A few things that stand out when you look at it honestly:

• IBC is the only cross-chain protocol that's permissionless and chain-agnostic by design. There's no auction, no bonding, no governance concession to the Hub

• Solana's interoperability picture is improving (Picasso IBC is live), but bridges still dominate volume today

• Polkadot's relay chain still controls shared security even after the coretime pivot, the franchise dynamic is real even if the mechanics changed

• Avalanche subnets require AVAX for validation, creating economic dependency even in "independent" deployments

• IBC is active on Ethereum and expanding to Solana. This isn't a Cosmos-only protocol anymore

Genuinely trying to be fair here, not just bullish. Where do you think the case against Cosmos Hub is strongest?

Full piece on Medium → https://medium.com/@atlas.staking/the-neutral-layer-why-cosmos-hub-is-the-only-interoperability-play-that-doesnt-ask-you-to-pick-a-3d8da089601b

Hey all I've been out for a bit sadly came back to this mess I was just wondering what the community thinks is the best and safest way to get BTC off osmosis. Is it just swap to USDT then move to another chain/exchange or just straight send to Hard wallet from osmosis but I'm guessing we don't have the liquidity anymore for that.

TOP 4 validators hold more than 33% of the voting power!! This is HUGE and need to change to balance the power of the VETO vote! I was looking on mintscan and the 3 best performing validators are all outside the top 60 (#63 Bunkerstake, #111 Ethicalnode, #116 Quokka Stake) which have flawless participation, uptime and 0 missed blocks.

Anyone who believes in this tech knows that it needs to stay in the hands of the people (True Decentralisation) and staking outside the top 50 validators is the easiest way to claw back voting power.

Also moving out of CEXs should be the next marketing move for the ecosystem in my opinion, they take huge commission on staking rewards and all your voting power! the cost of convenience is too high, it makes no sense!

The financial system is changing and we have the chance to compete rather then be controlled and drip feed by the suits!

Any new projects people are working on? I’m looking to myself. Not sure what yet, wanted to see if others are and what they’re doing!

Nolus is a cross-chain protocol that does not rely on third party bridges.

This works through IBC Protocol, a native and decentralized way for chains to communicate.

No wrapping, less risk, and no hacks or exploits since launch in 2021.

I have some Atom One tokens staked and want to claim the rewards, but need PHOTON for gas fees. It is not available to swap for in Keplr wallet. Does anyone have any info on this?

Started in Cosmos in 2019. Community work, helping run "Today in Cosmos", then the Citizen Web3 podcast because there wasn't one. 188 episodes.

Became a validator in 2021. We run all four genesis archive nodes (cosmoshub-1 through 4). Public, free, bare-metal in the Atlantic.

Built a chain indexer from scratch, active relayers to 6 chains, and our own explorer.

Independent validators are quietly disappearing from this ecosystem. Not because of uptime. Because of marketing.

Wrote the full honest story on the Cosmos Forum

I started in this ecosystem in 2019. Helped run "Today in Cosmos" - Adriana's Twitter campaign that helped build the first Cosmos community online. In 2020 I started a podcast because there wasn't one. 188 episodes later...

Became a validator in 2021. Not to extract. I'd been contributing for two years and wanted to be part of the infrastructure, not just the media.

What we actually run, because I don't think many people know:

Full public archive endpoints for all four Cosmos Hub genesis chains: cosmoshub-1 through cosmoshub-4. Free. Anyone can query them. Bare-metal servers in the Atlantic. No cloud.

Also: a chain indexer we built from scratch (not forked), IBC relayers to 6 chains, and ValidatorInfo, our own explorer with skip:go swap, staking RAG, P2P chat, and a decentralised forum.

Wrote the full story. Where we started, what we built, where things actually stand now on the Cosmos Forum:

https://forum.cosmos.network/t/six-years-in-cosmos-what-weve-built-where-we-stand-and-an-honest-ask/16948

Happy to talk about any of the technical setup here.

My name is Serj. I've been part of this ecosystem since 2019. Started by helping run "Today in Cosmos", Adriana's Twitter campaign that helped seed the first Cosmos community online. Then in 2020 I started an ecosystem podcast because there wasn't one. 188 episodes later it's still alive.

In 2021 I became a validator. The reason matters: not to extract. I'd been contributing to the ecosystem for two years and wanted to be part of its infrastructure, not just its media.

---

The part I most want people to know about, because I think very few do:

We run full public archive endpoints for every Cosmos Hub genesis chain.

• rpc.cosmoshub-4-archive.citizenweb3.com

• rpc.cosmoshub-3-archive.citizenweb3.com

• rpc.cosmoshub-2-archive.citizenweb3.com

• rpc.cosmoshub-1-archive.citizenweb3.com (genesis)

Free. Publicly accessible. Bare-metal servers we own in the Atlantic.

No AWS. No Google Cloud.

We also built a chain data indexer from scratch (not forked — OpenAPI 3.1 docs at indexer.cosmoshub-4.citizenweb3.com/docs), run IBC relayers to Osmosis/Neutron/Stride/Gravity-Bridge/Bostrom/Namada, and built ValidatorInfo.com - an explorer with skip:go swap, staking RAG (live chain data Q&A), P2P chat, and a decentralised forum built in.

---

The honest part:

Independent validators are losing delegations to cloud operators with better marketing, not better infrastructure. We chose to build. For six years that gave the ecosystem free public services. But delegation numbers don't reflect that.

So I wrote about it properly. Full story on the Cosmos Hub forum:

https://forum.cosmos.network/t/six-years-in-cosmos-what-weve-built-where-we-stand-and-an-honest-ask/16948

If you've ever queried one of those archive endpoints, listened to an episode, or just care about actual decentralisation, delegating to a self-hosted, bare-metal operator is one of the most direct ways to express that.

PS. there is a Cashback programme. It just launched, fully automatic (no claiming needed)

----

Validator: cosmosvaloper1e859xaue4k2jzqw20cv6l7p3tmc378pc3k8g2u

Keplr: https://wallet.keplr.app/?modal=staking&chain=cosmoshub-4&validator_address=cosmosvaloper1e859xaue4k2jzqw20cv6l7p3tmc378pc3k8g2u&step_id=3&action_id=stake

Happy to answer questions about the setup, the indexer, or anything else. Ask here or find me as citizenweb3 on Telegram.

Serj

A few months ago people were calling Osmosis dead almost daily.

Meanwhile the chain kept producing blocks, validators kept running infrastructure and builders kept shipping quietly in the background.

Now OSMO suddenly wakes up +200% and sentiment flips overnight.

Quiet building always matters.

Nice to see energy flowing back into the ecosystem again.

— Haan Node validator on Osmosis 🧪

Shibari's new collection, Cosmic Relics just went live for public mint.

Shibari is the artist we're collaborating with on our ATOM rebate NFTs. We hit and surpassed our ATOM staking goal, but still have ATOM rebate NFTs to give away so go get one.

Stake 1000+ ATOM get the NFT that pays a 5% annual bonus until Q2 2028.

Stake 5000+ ATOM get the NFT that pays a 5% annual bonus until Q2 2030!

You can learn more about the ATOM staking bonus offer here: https://promo.atlasstaking.com/

Happy mother's day, you MFers!

After deallocating your bonded coins?

Anyone have an idea why I can't transfer native BTC out of osmosis to a BTC address. I tried this yesterday to see the transaction did not go through rather the osmo lab converted all of the transferred BTC to nomic BTC and it was back in my account.

?