Systemic 'Theft of Work' in Web3 Security: Forensic Evidence for Marginal, Frax, and Walrus

[donnyoregon]

I'm Corrin (@donnyoregon), an independent Web3 security researcher. I've been documenting a disturbing trend of 'Theft of Work' where protocols and bug bounty platforms collude to steal whitehat research via stealth-patching.

I've published definitive forensic evidence (bytecode diffs, on-chain transaction hashes, storage slot analysis, and chat logs) for several major cases in my repository: https://github.com/donnyoregon/donnyoregon

1. Marginal Protocol — Cantina Complicity

• Vulnerability: Unsafe Downcast & Unchecked Q96 Price Truncation leading to Pool Insolvency.
• The Fraud: Protocol stealth-patched the bug (TX 0xe021...) after rejecting the report as a 'Duplicate' of a previously rejected finding, then locked the dispute.
• Proof: Bytecode scan confirms SafeCast presence in the new implementation which was absent in the original.

2. Frax Finance — Internal Cover-up

• Vulnerability: CannotRedeemZero() DoS in FraxEtherRedemptionQueueV2.
• The Fraud: Reported Dec 5, 2025. Rejected internally, then stealth-patched without credit or compensation.

3. Walrus Protocol — Evidence Tampering

• Vulnerability: Core Data Deletion Disabled on Mainnet & GC Epoch Desync.
• The Fraud: MystenLabs stealth-patched the bug and manually backdated the entire module's commit history to hide the timeline of the fix.

I am calling for better accountability in the security industry. Bug bounty platforms must not be allowed to act as both judge and jury when protocols choose to steal research.

---

Full technical details and forensic evidence are available at: https://github.com/donnyoregon/donnyoregon

[ebndev]

Hi @donnyoregon, thanks for being a part of the GitHub Community!

Unfortunately, we currently do not allow self-promotion for specific projects or repos. We want to make sure there is space for users to ask questions without overwhelming them with other conversations. This type of post is considered "off topic" as GitHub Community Discussions focuses primarily on topics related to GitHub itself or collaboration on project development and ideas.

We appreciate your understanding.

[donnyoregon]

i don see how advising the community on valid security concerns are self promotion in anyway people deserve to know where they are researching or spending money and they kind of projects theyre trusting