Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain

No, the first working full chain was entirely invalidated and they fixed all the bugs involved in that chain. So we had to start from scratch at the beginning of August and both found the vulns and built the exploit in 6 days, for $40k. We actually found ~11 vulns throughout those 6 days; we submitted three as a full chain, the middle stage collided, and we submitted one of the backups as a replacement for that stage.

Edit: the other piece that I think isn't mentioned is that after Oege gave us the challenge of getting the full chain we didn't actually have a team hired and working on it until around May!

This exploit is mitigated by disabling JIT, which you can do in edge. Chrome only has a "disable v8 optimizations", which doesn't entirely disable JIT, but might still mitigate this bug. Not sure about all the other chrome forks.

$40k spend in tokens, $250k reward from Google.