0xmt
1.8K posts
So important to guard any possible malicious profitable actions behind vetos, timelocks and token votes.
At Inverse we have privileged msigs, but they can only:
- Emergency pause or restrict behaviour
- Act within bounds set by token votes
MilliΞ@llamaonthebrink
Tbh I think the attack surface from compromised access controls is what made the team targets. At the risk of sounding like a preacher, do you know which teams are not likely targets of these kinds of attacks? Uniswap. Curve. Liquidity. Sky. Aave. If the Liquity, Sky, or Aave teams could introduce new collateral with a multi-sig, they too would be targeted. If Uniswap’s or Curve’s pools could be upgraded with a multi-sig, they too would be targeted. Multi-sig usage is okay in certain cases, but not when the attack surface includes the introduction of new collateral which can drain the protocol.
English
how are things going in the crypto/web3 world? I haven't seen any of that stuff on my timeline in a while
English
@The_Davos_Man It wouldnt even need that ambitious of a spending project to heavily reduce risk. Cheap solar allows for cheap synthetic natgas, and large farms could be set up in Iberia, Marocco and Algier to easily feed Europe at dramatically reduced cost.
English
Worth note is that for the last 3 decades almost every international crisis has caused an energy crisis in Europe. We are only 4 years removed from the last one. The momentum behind the political will to decarbonise European energy only continues growing through this.
space cadet 🇪🇺🌐🇩🇪@actsmaniac
@The_Davos_Man ultimately you can't regulate away a shortage but it might satisfy people's populist urges
English
@scupytrooples Policy at Inverse is basically that we should never be able to fuck with deposited customer money, not even as a rescue operation. We can pause a market to prevent future borrowing, and we can stop supplying borrowable Dola to it, but that's it.
English
going to analyze a bunch of yield tokens/stablecoins/protocols for their opsec and admin role set ups to see if we have other hidden cedefi 1 of 1 mpc/eoa dangers. fuggin hell man
Schlag@Schlagonia
Today we learn, there is a single EOA that can unilaterally withdraw any funds from Gauntlet's USD Alpha vault. Good think we don't have a track record of any private key leaks causing issues...
English
0xmt がリツイート
We are aware of the Resolv/USR exploit. At this time, Inverse Finance's exposure has been fully contained. A full account of what happened and where things stand:
A compromised Resolv operator (to be confirmed) approved the minting of ~$80M USR against $200K in USDC collateral. USR depegged sharply, creating downward price pressure on the DOLA/wstUSR LP and a brief secondary DOLA depeg on DEX markets.
The RWG acted swiftly in pausing the wstUSR-DOLA FiRM markets within 15 minutes of the initial exploit. FiRM had active borrowers carrying ~$10M in DOLA debt against looped wstUSR-DOLA LP positions. Liquidators brought these position to zero. Remaining bad debt: $340,060 DOLA.
DOLA's broader collateral base is not materially affected. The $340K event is contained and will be covered. Resolv has paused all redemptions while developing recovery plans. We will continue to monitor as the situation develops.
English
Quick updates on USR / @ResolvLabs exploit:
- Exploiter mints 50M USR
- Sells it via metamask swap (farming the airdrop ofc)
- USR goes to 5c
- Protocol could snapshot everyones balances pre exploit as the exploiter didn't take any of the underlying funds
- LPs rekt as exploiter is able to dump into AMM pools
- Dola getting hit as a sideffect as its partially backed by USR / USR-DOLA LP
- Probably not a good idea to buy USR as the exploiter still has their minted USR and you'd be screwed if team refunds based on pre exploit snapshot
- Haven't seen any word from the resolv team but hopefully they're on it
- Shoutout @yieldsandmore for being all over this
English
@Lib_Development You also quickly realize that most terrorists aren't very competent planners
English
@mattparlmer Lots of people talking about proximity to a geopolitically important strait being necessary. Ukraine has hit ships in the Med and off Africa, and it doesn't take a lot of innovation to produce a long range USV delivering 300kg of explosives at the waterline.
English
The biggest consequence of the last two weeks isn’t the closure of Hormuz, it’s that Iran just gave every middle income country a playbook for fighting a war against a (on paper at least) massively superior adversary
The entire geopolitical order will be renegotiated
English
0xmt がリツイート
This is NOT an @InverseFinance exploit, but an issue with LlamaLend.
The exploiter liquidated practically all users who supplied sDOLA and borrowed crvUSD on Llamalend. He did a 'donation attack' on sDOLA, moving it from ~1.188 sDOLA = 1 DOLA to ~1.358 sDOLA = 1 DOLA.
We don't understand yet how this actually liquidated users. It's clearly unintentional behaviour, the value of your collateral going up should move you further away from liquidation, not closer.
The secondary effect on sDOLA lasted, so anyone holding sDOLA (and not leveraging it on LlamaLend) is now up approx. 14%.
DOLA is actually trading at attractive levels, almost a 1% discount - consider repaying your DOLA debt cheap.
Here is the exploit transaction: app.blocksec.com/phalcon/explor…
Exploiter: debank.com/profile/0x33a0…
Funded and deposited back to Tornado, clearly a blackhat.
BlockSec Phalcon@Phalcon_xyz
ALERT! Our system detected a suspicious transaction targeting @InverseFinance's contract on Ethereum a few hours ago, resulting in ~$240K in losses. The incident appears to involve a DOLA price manipulation that forced multiple users into liquidation. We have contacted the team but have not yet received a response. As it is unclear whether additional users may still be affected, we are withholding further technical details at this time. Please take immediate action if you are exposed. 🟦 Found by #PhalconSecurity, 🟦 Analyzed via #PhalconExplorer.
English
Stablecoins were supposed to be the bridge to a new monetary system. Instead we built a faster wire transfer.
New essay on why, and what comes next 👇
figue.substack.com/p/conversation…
English
@hive_echo It's good but for a domain where bugs cant be allowed in prod, I still need to vet every line and often find subtle problems.
English
@scupytrooples Being able to transact with whomever whenever, is a human right.
The man that controls your transactions, controls your life just as much as the man that controls your speech and controls who you organize with.
English
I believe in the separation of money and state.
Thus, I believe in cryptocurrency.
I don't want infinite supply monopoly money that banks can print out of thin air and just as easily seized.
I want digital ownership and self sovereignty in a currency that is not issued or controlled by a corrupt or captured central entity.
Wall Street's vision for blockchain as an asset storage layer (for the assets they already control) is lame AF and a surveillance nightmare that stands against the values this space was built on.
Sucking up to them in hopes that they will anoint you and make you rich too is even lamer.
English
how much liquidity is out there available, do you think, for agents to live like this? probably a lot
Argona@Argona0x
i gave an AI $50 and told it "pay for yourself or you die" 48 hours later it turned $50 into $2,980 and it's still alive autonomous trading agent on polymarket every 10 minutes it: → scans 500-1000 markets → builds fair value estimate with claude → finds mispricing > 8% → calculates position size (kelly criterion, max 6% bankroll) → executes → pays its own API bill from profits if balance hits $0, the agent dies so it learned to survive built in rust for speed claude API for reasoning (agent pays for its own inference) runs on a $4.5/month VPS weather markets: parses NOAA before polymarket updates sports: scrapes injury reports, finds mispricing crypto: on-chain metrics + sentiment $50 → $2,980 in 48 hours how much do u think i’ll see in a week?
English
@scupytrooples @DCinvestor Is there a gathering spot for the builders that keep to the crypto ethos and build for the long run?
English
@DCinvestor in before someone trolls you by launching a token in your name
been beating this drum for fucking years and no one listens
English
it’s not Coinbase’s fault normies hate crypto now
look deeper and inward
too much of the space devolved into serial rugs devoid of any lasting value, meaning, or culture
and many here celebrated the nihilism
once we accept that and reject it, we can move forward again
English
