There is a delicate balance between doing research to keep up, and actually hunting for bugs.

Spend too much time researching, and you'll have no time to hack.

Spend too much time hacking, and you'll fall out of date.

Here is how I balance things:

Some people start their bug hunting by jumping right into the code.

I usually don't. Starting with the documentation focuses your code review and helps you go right for the parts that matter!

⚡️Slitherin v0.7.0 is here! 🎉

5 new security detectors aimed at integration vulnerabilities 💪

Plus, Slitherin is now integrated into Napalm by Consensys Diligence 🤝

Stay tuned for details about how it works and how to use it to secure your codebase 🔔

pessimistic.io/slitherin

A while back I was reading this article by Paul Graham which described something that I use for my bounty hunting all the time!

It’s the top idea in your mind:

Oracle Extractable Value can wreck your protocol.

Still most people opt to ignore it, and say 'it's out of scope'.

Here is why I think they are wrong:

So you've found a bug.

Great success!

Now you've got a different problem. What kind of Proof of Concept do you write?