0xGene

Drift 这次真的离谱。 按链上时间线看，攻击在北京时间 00:15 左右就已经开始；一个多小时后社区才开始在 X 上大规模预警，Drift 官方到 02:10 才第一次发声。扯淡的是这是 $2.7 亿 量级的攻击。 📗先说结论：这次更像是社会工程 / 高权限 signer 被定向 compromise，甚至不排除存在内部协助，并不是协议合约本身出现了合约逻辑漏洞。 攻击者拿到的关键权限 Primary Runtime Admin。这个权限本来由一个 2/5 的 Squads 多签控制。攻击者直接利用了其中两个合法 signer（6UJ...924、39Jy...Aq8），发起并完成了一笔完全合法的多签交易，把 Primary Runtime Admin 权限转移到了自己的 EOA：H7Pi...7ZgL。 ⚔️后面的路径就很简单了： 先夺控制权，再改市场参数，然后把协议变成提款机。 💀更诡异的事情💀 9 天前，攻击者就为 Drift admin 相关路径创建了 durable nonce； 7 天前，Drift admin 新建了一个 multisig（5个签名人，4个是全新的，一个是老地址，而且这个老地址在第二次攻击时再次被攻击者“使用”）——对一个已经上线多年的协议来说，这本身就是异常信号； 2 天前，攻击者又为第二条 Drift admin 路径创建了 durable nonce。 这件事情只是再次暴露了一个惨痛的事实：很多defi协议真正脆弱的地方，根本不在合约逻辑，而在高权限控制面；说得直白一点 - 这些管理者真的可靠么？ #DriftExploit #Solana #DeFi #CryptoSecurity #Drift

爸妈最多能保下限, 但是很多爸妈为了保下限, 把上限也盖帽了 (身边太多这种case, 中学不少斯坦福/牛剑/清北本科的现在都在大厂熬年头 卡在E6那种.. 当然, 还有很多爸妈是下限都稀巴烂, 因为自己也保不住.

$AXTI -30% AH, "It is not a name that you can just buy and hold without too much risk management"

Creation manifests through those who want it badly enough.

@0xtodd 转走了的，只是攻击者目前拿着venus的存款凭证，还没来得及取款，被venus暂停合约堵住了。但是怎么解决好像也有点头疼。

等于大户本来就在 Venus 上仓位，黑客没有直接转走大户的存款凭证，反而用闪电贷帮他调了一些仓位，很有可能是黑客为了选择一些更好从 BSC 洗到其他链的资产。

根据 GPT-5 和 Claude 4.1 的分析，单从这笔 txid 代表的交易来说，似乎不是 Venus 协议被黑，它是一笔闪电贷贷款调整。

We @VennBuild just discovered a critical backdoor on thousands of smart contracts leaving over $10,000,000 at risk for months Along with the help of security researchers @dedaub @pcaversaccio, the seals team @seal_911 and others, we managed to rescue the majority of funds before the attacker could make their move. This is the story of how a sophisticated attacker (cough Lazarus) put backdoors in thousands of contracts and ALMOST got away with it 🧵

On April 17th the U.S. Trade Representative's office is expected to impose fees of up to $1.5M per port call for ships made in China and for $500k to $1M if the ocean carrier owns a single ship made in China or even has one on order from a Chinese shipyard. 🧵 1/

现货是现货的打工人，期货是期货的打工人，各自的KPI也不一样，listing的要价/要求也不一样。很简单的事情：上不起/上不了现货，但是合约门槛/成本要低非常非常多。大家以为币安现货和币安合约是一体的，其实从上币的角度大家各扫门前雪。

$MELANIA 翻译下代币经济： 1. 项目方 ICO 15%（还是v2 amm动态价格）； 2. 项目方 10% 随时可卖； 3. 项目金库/社区保留40%（什么鬼）； 4. 团队 35% 从Day30开始解锁10%，剩余12个月全流通。 --- 这也下得去口？meme也玩复古ICO风么

1/ Longer form thoughts re Trump memecoin. Its suggestive of a term that's short-term great for price / liquidity but long-term suboptimal for industry development. My concern is on a mid-long term timeframe. Short-term I'm trading the shitters with you all. Here's why.

确实比较拗口，我来试着用人话翻译一下 @VitalikButerin 的发言。 首先，一开始，原帖就是这一个非常标准的【看好Crypto打败股权】的哥们儿的常见激进派观点。 字面翻译： “科技界的每个人都低估了高效资本形成对构建未来的重要性，低估了 100 倍。 发明SAFE协议并使其能够通过一页协议出售股权，可能创造了超过 1000 亿美元的股权价值。还有数十个这样的解锁机会等待发现。” 原帖一句话概括：SAFE协议（代币认购合同）比股权牛逼多了。 论据是，股权写1000多页，SAFE只要1页纸就搞定了。 PS：题外话，其实SAFE一般大概20多页吧。 然后，Vitalik转发了一下说： 字面翻译： “对我来说，这里真正重要的事情是创建能够持久激励开源、开放标准和安全性的资金结构，抑制围墙花园心态和掠夺性行为，并普遍促进成为对更广泛生态系统的正和参与者。” 人话翻译开始： 因为原帖观点太激进了，尽管V神是加密货币的支持者，但是想往回拉一点。 所以，他觉得： 加密货币融资的重点，不是SAFE协议多牛逼融资多快。 重点在于，融资的话得干点实事儿，例如： -代码开源 -做一些行业标准等等 但是，如果加密融资是为了一些坏事，他反对，例如： 1.围墙花园心态（walled-garden mentality） 这个其实是互联网黑话，指的是互联网巨头，圈地垄断控制用户心智。 典型的，比如Meta，用户在facebook、whatsup和Instagram之间转来转去，以为看到了很多东西，孰不知都是小扎一家的。 加密圈的话，可能是暗示交易所巨头，比如交易所既搞CEX、还要搞web3钱包，还要搞自己的EVM链，搞meme，搞defi，搞AI Agent，总而言之让用户转来转去都逃不出交易所老板的手掌心。 所以我能理解为什么他反对围墙花园。 2.掠夺性心态（extractiveness） 【掠夺性心态】就是【割韭菜把韭菜根都刨没了】的文艺说法。 割韭菜不用我举例了吧，我们这个行业这种故事很多呀。 比如弄个AI加速的DAO组织，圈一堆AI Agent的加密KOL和机构人士、项目方创始人之类的...数不胜数。 最后，他认为这些都是“零和游戏”甚至“负和游戏”，大家应该玩点“正和游戏（positive-sum）”。 所谓【正和游戏】简单概括就是：干点实事，让生态更好，让用户更好，大家都赚钱，实现多方共赢 英译中+中译中，翻译完毕 希望帮助大家理解🤣

Why USD0++'s Depeg was Imminent I used to work on Morgan Stanley’s high-yield bond desk, so I’ve seen my fair share of distressed assets and quirky mechanisms. "High-yield" sounds fancy, but let’s call it what it is: trading the shittiest of shit bonds. Think defaults waiting to happen—the gutter trash of the credit world. What’s happening with USD0++ feels like déjà vu. Let me clarify: I’m not saying it’s trash—it’s collateralized by very safe assets, but let's say there are definitely some high-yield elements at play, along with a whole lot of tranching. As of writing, USD0++ is trading at $0.94, a 6% depeg from its supposed $1 peg on DEXes. Why? After the protocol's announcement of its “dual exit” option, hundreds of millions of USD0++ got dumped by DeFi traders, leaving its largest Curve pool wildly imbalanced. What is USD0 / USD0++? USD0 is a simple stablecoin. The real point of this entire game is to convert it to USD0++, the staked version. USD0++ is where the action happens because it earns you $USUAL tokens (we’ll get to those in a bit). But here’s the kicker: Holding USD0++ locks you in for four years—a detail many DeFi farmers glossed over. In essence, USD0++ functions as a zero-coupon bond—you lock up your money and earn nothing until the end of the term. If you expect 4% annually over four years, the fair value of USD0++ today should be around $0.855. This means you’d buy it at $0.855, hold it for four years, and redeem it at $1 for a risk-free 4% return. Before today’s announcement, you could redeem USD0++ 1:1. Now, that’s all changing. The Dual Exit Details for USD0++ Here’s how the new exit mechanisms work: 1. Conditional Exit: Redeem USD0++ at 1:1, but you forfeit part of your accrued yields. This “Early Unstaking” option launches next week - I'm guessing you'll need to burn $USUAL to exit. 2. Unconditional Exit: Redeem at a floor price, currently $0.87, which will gradually rise to $1 over four years. This option is for those who want to keep their upfront rewards. For those still HODLing their USD0++ There's a trade-off: 1. Choose the speculative strategy by staking USD0 to USD0++ to farm USUAL tokens and chase those headline-grabbing 60% yields. 2. Choose the Base Interest Guarantee option by locking up USD0++ for four years to earn the “real” risk-free yield of 4% annually, payable only at the end. But why lock up USD0++ for four years when you could buy liquid treasury-backed ETFs from BlackRock, exit anytime, with higher liquidity? DeFi users are farmers, and those shiny 60% yields are what they’re after. Option 1 was the only ‘real’ option—at least, until today’s announcement. The key takeaway: USD0++ is now being recalibrated to reflect its true nature and value: a zero-coupon bond plus a $USUAL token emission mechanism. But there are more layers to this. USUAL... USUALx... USUAL* Right now, the protocol keeps all the revenue from treasury bills, while participants are left with what looks like an ever-emitting token. There’s a fee-switch coming, though. Soon, 100% of the interest revenue from treasury bills will go to USUAL stakers, who will earn another token called USUALx (with a 10% fee for unstaking). It gets even more complicated: early investors receive a token called USUAL* (or USUAL Star), entitling them to 10% of all USUAL emissions and 33% of penalty fees. Lots of Moving Pieces Here’s how to read it: 1. USD0 Holders: surrendering your interest yield to use the stablecoin, effectively financing this game for the other counterparties—USD0++, USUAL holders, USUALx holders, and USUAL* holders. 2. USD0++ holders: surrendering your interest yield for 4 years, effectively financing this game by betting that $USUAL tokens emitted will be worth more than the interest yield. 3. USUAL / USUALx stakers: betting on the USUAL token to rise / capturing the interest yield surrendered by USD0 and USD0++ holders. 4. USUAL* holders: get 10% of all $USUAL emissions, as well as 33% of penalty fees, receiving a percentage of the value chain. Just my two gweis, and as always, DYOR

终于写完了 Uniswap V4 的全文，虽然核心 AMM 机制与 Uniswap V3 一致，但文章和 Uniswap V3 一样长。估计未来的 DeFi 协议都会标配 ERC6909 / ERC7751 / Flash Accounting / Hook。 特别感谢 @jeffishjeff 与我的讨论使得本文内容更加准确。

看看美西科技界，"印度人帮印度人，中国人搞中国人”，多无奈的一句话。Eigenlayer时LRT也撕逼，互相没少挑毛病，但大多是场面上公开挑毛病。到了BTC这一波，后进们为了争名额，从交易所上币使绊子，到各路马甲小弟小妹泼脏水，无所不用其极。背后是谁其实都心知肚明，有些人做事不行，使绊子是大宗师。

呼吁下，dapp和插件钱包上起码给个开关

Restaking 时代 defi farmer正式成为了卑微 的进城务工人员，天天吃项目方画的大饼，天天被pua让做各种贡献，好不容易等了半年终于要发工资了，LRT们自己耍赖皮不说，还要把上游的eigen奖励都给你扣了....周扒皮都自愧不如哎（连我都讨薪如此艰难，普通用户基本只能认倒霉了）

“孙币不碰”是一条永远不会让你后悔的币圈金律。 远的都不说了（也说不过来）TUSD 套了多少朋友？ 要是跑得慢，TUSD在币安打新的收益最后全部上缴给孙哥都不够吧，关键还是恶心，就是吃了一坨💩那种恶心。

有必要帮jump辟个谣：谁说我卖完了？ 大家只盯着打了标签的主账户，没人花五分钟看下实际资金链路，质押地址： platform.arkhamintelligence.com/explorer/addre… 上面好好的还躺着44,174stETH准备赎回； 正在赎回的地址在这里：debank.com/profile/0x9862… 11,500steth 正在赎回中； 会不会跌不知道，但Jump前面才砸了已知的60%呀