我的猫叫金条

‼️ Polymarket, the decentralized prediction market platform, has allegedly been breached, with 300,000+ records and an exploit kit leaked on a popular cybercrime forum. The actor states Polymarket has no bug bounty program and was not notified. ⠀ ‣ Threat Actor: xorcat ‣ Category: Data Leak / Exploit Kit ‣ Victim: Polymarket ‣ Industry: Cryptocurrency / Prediction Markets ⠀ The actor states the data was pulled via undocumented API endpoints, pagination bypass, and CORS misconfiguration on Polymarket's Gamma and CLOB APIs. The pack also includes working POCs for multiple CVEs and an auto-dump script. Date of extraction: 2026-04-27. ⠀ What's in it: ⠀ ▪️ 300,000+ total records ▪️ ~750 MB extracted / ~8.3 MB compressed JSONs ▪️ 10,000 unique user profiles with full PII (name, pseudonym, bio, profile image, proxy wallet, base address) ▪️ 4,111 comments with attached profile objects ▪️ 1,000 report records containing 58 unique ETH addresses + admin_auth_addr indicator ▪️ 48,536 gamma markets with full metadata, condition IDs, token IDs ▪️ 250,000+ active CLOB markets with FPMM addresses ▪️ 292+ events with submitter/resolver ETH addresses and internal usernames ▪️ 100 reward configurations with USDC contract addresses and daily rates ▪️ 9,000 follower profiles with names, pseudonyms, proxy wallets ▪️ Internal user IDs exposed in createdBy/updatedBy fields ⠀ Vulnerabilities included (POCs in ZIP): ⠀ ▪️ CVE-2025-62718: Axios NO_PROXY Bypass (CVSS 9.9, SSRF to internal services) ▪️ CORS Misconfiguration on CLOB API (wildcard origin + credentials=true) ▪️ CVE-2024-51479: Next.js Middleware Auth Bypass (CVSS 7.5) ▪️ CLOB Pagination Validation Bypass (limit=999999 accepted, no rate limiting) ▪️ Unauthenticated /comments/{id} endpoint (brute-forceable, leaks full profiles) ▪️ Unauthenticated /reports endpoint (leaks user activity + admin indicator) ▪️ Unauthenticated /v1/data/followers/{address} (full social graph enumeration) ⠀ Pack contents: ⠀ ▪️ All dumped JSONs (markets, events, profiles, comments, reports, rewards, series) ▪️ 5 working POCs (CORS exploit, Axios SSRF, Next.js bypass, pagination DoS, WebSocket exploit) ▪️ Auto-dump script (continuously pulls fresh data until endpoints are patched) ▪️ Full redteam report with MITRE ATT&CK mapping ▪️ Additional 350MB data dump

前几天港股IPO打新，群核科技上市直接暴涨，打新党又赢麻了。 然后看到「曦智科技」要来了。这票基本面不用看，这是电，这是光，这是唯一的神话。 新股评级：「拿命干」 （评级体系：拿命干 > 满仓干 > 梭哈 > 偷鸡 > 放弃） 已经打了，等开盘。

Commodity Exchange Traded Funds (ETFs) are essentially compliant products that package the business model of "holding commodities long-term and continuously generating rental income" and offer it to retail investors. Fund companies receive a share of the rental income earned by large investors who hold substantial amounts of commodities, lend related assets, and participate in derivatives market transactions, while also charging management fees. Fund companies are not simply optimistic about the market prospects of a particular commodity, but rather value its asset attribute of continuously generating "rent." Since May 13, 2016, the day BitMEX launched the world's first BTC perpetual contract, a funding rate mechanism has been implemented. From then on, long-term BTC holders could obtain rental income through hedging operations, marking its true transformation into a "rental asset." Before this, it existed merely as a speculative target for evangelistic beliefs; afterwards, it possessed a stable positive cash flow logic.

我现在每周日会固定吃一顿萨利亚 然后边吃边刷推看看有哪些热门最佳实践，然后ssh回家让cc自己更新一下工作流 本周增加了 handoff ，推荐给大家😄

🚀我把Predict-Raven开源了，这是一个可以在预测市场上自主交易的Agent框架。 在一个月的时间里他已经取得了实盘+8%的收益。我身边一小撮对AI trading和Polymarket感兴趣的极客和交易员朋友，已经开始部署和测试它 Predict-Raven有点像一只盘旋在上空持续寻找机会的小乌鸦，它会定时扫描数千个市场，持续地搜集证据，评估事件真实发生概率，再对比市场隐含的赔率。当它发现足够大的偏差时，就会自动下单、风控、止损，并记录下来自己的决策思路和依据 我做这个项目的动机源自主观性较强的几点判断： 1. AI已经拥有了和人类相等甚至超过人类的推理能力 2. 交易，在本质上可能和其他推理任务并没有不同，AI缺少的，可能只是更好的交互环境和上下文 3. 预测市场在交易里又尤为特殊，他们交易的，本质上是主观预估概率vs市场隐含概率的gap。如果你能比市场更准确地预测未来，你就能持续地获得收益。而预测本身，可能可以拆成两个相对独立的能力：信息搜集和推理。ai在一系列高难度benchmark的进步表明，ai在agentic search和reasoing上终会战胜人类，或者，已经战胜 人类的优势是直觉和通过社交来获得隐含信息。再退几步说，哪怕AI的推理能力仍然稍弱于人类，也能通过同时扫描复数个市场和7x24的待机，来等候定价错误的市场出现实现盈利，战胜市场某种程度上也是胜出人类的baseline。就像在德扑中：牌技高低只是盈利能力的一部分，更重要的是“找局”能力，能不能稳定地找上有漏洞的对手。以盈利为目的时，永远要在自己有edge的场子玩。 预测市场，尤其是科技和政治市场，是一个还没被充分开发的蓝海，当做市商还在畏惧库存管理和逆向选择时。agent真的有可能跑出一些优势；同时我也相信：开源协作会比闭门造车更快跑出东西，对于 Predict-Raven 来讲，还非常有趣的一点是，它也有类似龙虾 soul.md 的架构，允许用户按照自己的偏好和设定去交易。 举个例子，我经过测试并打磨的一个用例是告诉 Agent：市场存在 long-shot bias，即市场会高估小概率事件发生的概率。同时，我让它限定在流动性非常差的政治和科技市场，因为我相信这些地方被不正确定价的概率更高，竞争也不激烈。大家可以很自由地把自己的交易原则代入到小乌鸦里，并通过一些参数增加强约束 哪怕这已经是一个经过很多轮迭代的项目，我也想向大家坦白这个项目还有非常多可以改进的地方。比如真实的测试资金只有500u，而预期的策略容量可能在15万美金以上。目前的一些最优先的需求还包括：更高频的交易，持久化运行和云端部署。我觉得现在也是一个合适的时机把它发布向公众，通过building in public收获非常珍贵的反馈，来调整后续的开发方向 我会挑选五位转发并私信我的朋友，可以简单介绍下自己想参与到Predict-Raven的原因，我将手把手地帮你们搭建属于自己的预测市场agent. repo，实盘地址和持仓、决策分析网站如下

🚨 BREAKING: President Trump IS SAFE after the shooter is down — he recommends CONTINUING the event LFG 47! “The shooter has been apprehended, and I have recommended that we “LET THE SHOW GO ON” but, will entirely be guided by Law Enforcement. They will make a decision shortly. Regardless of that decision, the evening will be much different than planned, and we’ll just, plain, have to do it again. President DONALD J. TRUMP”