Mike B

@keoneHD Umm ackshully bitcoin had omnilayer which is where usdt originated

Crypto’s founding promise was open access to a fair and public financial system. Open networks have made gradual progress toward this goal. The first open network to get traction - Bitcoin - offered a medium of payments and a store of value, but halted at supporting stablecoins, DeFi, or RWAs. The second major open network, Ethereum expanded on that promise by enabling smart contracts, stablecoins, and RWAs, while facing limitations in scale, throughput, and trade execution fairness. The next big open network will be the one that solves trade execution fairness and scale, enabling global markets to actually move on chain.

@tmuxvim been waiting for this

Revise is now in the Claude app directory! 😎 With one click, you can give Claude a fully featured word processor to collaborate with you, in real-time. No more downloading & uploading files, or copy and pasting between windows. Featuring tracked changes and inline comments!

@Bandrel H100’s are not good for cracking cost wise. 5090s can do 300gh+

Passwordless is starting to look really nice right about now.

Have not seen this posted before: The original emails between low carb crusader and the flashbots team

@0x9212ce55 x.com/k0mm4nd/status…

I wonder if that's TEE related...

@0xdoug Why have any lingering approvals at all when it can be done atomically?

Basically the attacker created a bunch of “fake wrapper” that mint-wrapped real tokens like WETH/USDC/USDT. Jared was boiled like a frog. Juicy arbitrages on real pools with the fake wrappers. Jared started small to test the waters, made money, things looked safe, then scaled up

@0xWives @rbthreek fun fact: you can do this with apple pay. They give you a virtual card number that you can refresh at any time.

@rbthreek It’s good at fucking over the free subscription platforms. Generate a 1 time use card number to get free subscription and then they can never bill you again lol. Best innovation

Is this worth?

@icobeast They go on hyperliquid and open a position

So what happens if they finish this proof for ZEC to show the infinite mint bug wasn’t used, and end up realizing it was used

@mike_connor Very interesting theoretical. Could be built into wallet software as an opt in. but frankly probably too much work for something deep down bagholders dont want to know (as the only thing it can prove is the existence of an exploit, but not that it didnt happen)

I think there is technically a way to determine whether the zcash bug has been exploited, _without_ everyone turnstiling out of the orchard pool. (Achieving it _practically_ is... unlikely, but it's interesting...). Unlike turnstiling, the approach wouldn't require users to access their secure spend authorising key (ask), which is important because zcash holders might be reluctant to expose this key. (Classic cold storage opsec). It can be done without revealing the proper nullifiers of any notes. The idea: All users execute a new circuit which proves ownership of an unspent note (as at the block height at which the bug was patched). We sum the values that are outputted by all these circuits. (There are approaches to summing the values without revealing any of the values, but there are tradeoffs here. More on that below). If the sum ever exceeds the amount in the pool, we know the bug was exploited. The circuit: For the block height at which the bug was patched: - Here is a note. - It exists in the tree. - Here is the nullifier secret key (nk) which belongs to the owner of the note. (Notice: we don't require the `ask`, so the circuit never sees enough info to be able to _spend_ someone's notes). - Compute the proper nullifier. - Prove the note is unspent. We don't want to reveal the proper nullifier. Instead, prove the proper nullifier has not been emitted up to the block height. (This requires us to merkleise all historic nullifiers that were emitted from orchard, and record the resulting "nullifier tree root", so that we can do a non-membership proof of this proper nullifier). - Compute an alternative nullifier. We'll expose this, to prevent this note from being counted twice in our summation. The derivation can be the same as the proper nullifier, just with a new domain separator. - Commit to the value of the note, somehow. (The approach here will depend on how we want to sum the notes. Pedersen commitments? MPC secret shares? FHE?) - Public inputs: note tree root, nullifier tree root, alternative nullifier, commitment to the value of the note. Submit the (proof, public inputs) to some verifier. The verifier (which might be a single actor or an MPC network, depending on how we want to securely sum the values) does the following: - Verify the proof - Ensure the roots are correct. - Ensure the alternative commitment is not a duplicate. - Sum the committed note's value. It would be really cool if the values can be summed without leaking any values to anyone. There are MPC protocols whereby a single boolean statement can be learned: "The sum of all values is/isn't greater than the amount held in the shielded pool" I.e. "The bug has/hasn't been exploited". If everyone participates, and if no bug was exploited, the total should match the amount contained in the pool: Once the sum hits the tvl of the pool, if the count of existing (notes - nullifiers) (i.e. the count of unspent notes) exceeds the count of proofs submitted, then we know the bug has been exploited. If _not_ everyone participates, there might still be hope: If the bug _was_ exploited, and if the attacker has already _withdrawn_ material value, we can arrive at our answer faster and _without_ participation from everyone. We'll hit the tvl before we've summed all honest participants' notes (because some of the tvl would have already been rugged). That's compelling, right? Practical problems: - People might not want to participate. - People who've already withdrawn might not care to participate. - People might have lost their keys or notes, so even if everyone wanted to participate, not all notes can participate. But even so, if there has already been a significant amount withdrawn by an attacker, with sufficient participation (not everyone), we could still learn about the attack's existence. Maybe it's simpler to just have people turnstile out. Interesting, though.

@zkpedrongmi @donnoh_eth Pretty disgusting case of bagholder bias encouraging putting users at risk for literally no reason. You should be smarter than this.

@donnoh_eth All that happened was a bug. That bug could’ve been exploited. But even if it did, it wouldn’t affect your shielded assets. But again there’s no reason to believe it isn’t safe or that it was exploited. Don’t ride the FUD 😊

before i put my tin foil hat on, why aren’t people being asked to withdraw from the orchard pool if no one knows if it is safe?? why are so many people instead saying that it is ok to stay in the pool?? am i crazy? 😅

@serpinxbt This literally already happened to the zcash predecessor zcoin. No way to tell the damage.

I had never considered this as a challenge for privacy coins... > exploit went unnoticed for years > could freely mint new zcash:native freely > could sell those tokens while masking where it came from (!) > no way of knowing if this already happened or not (!!)

Now would be a good time to let people know that I specialize in wallet recovery services. If you have any funds stuck in old wallets of any type, reach out. I have scripts for everything and have an airgapped gpu cluster for password cracking. I'm familiar with virtually all wallet formats going back to 2011. I PAY FOR SUCCESSFUL REFERRALS I have been in crypto since 2013 and have helped many, many people recover old wallets throughout the years. Wallet formats have an incredible amount of variance and its very easy for outdated wallets to leave users stranded. I also can bruteforce old wallets. Many wallet formats allow you to give me the data needed to crack it without needing to reveal any sensitive data. I have scripts that can scan entire hard drives for keys/phrases/etc and consult with professional data recovery experts to derive the information needed to recover funds. A dedicated site for this will soon be live but feel free to reach out in DMs. Happy to help with any questions if anyone is in a similar situation. I can do anything within the realm of feasibility. Cost beats out anyone in the industry but heavily depends on the task at hand. Easy stuff I will help for free if time allows for it. Reach out

@cprkrn No need but if you feel you must here's my address Hm7cuiCfpyMBsGhtwkzUSqVRdC5yjV9T1NDYM1ftJeyy

@DefiGod5 Recovered hmu ill send some sol Ty

Lowkey more hype on going viral lmfao 😂

@cremieuxrecueil I'm an expert at wallet recovery if you need any tips, dm me. (won't scam or ask you to do anything sketchy)

Reminding myself to do this next week. Will be delighted if it works.

@cprkrn if you only have the private key (as opposed to seed phrase), I'm struggling to find a mobile wallet that allows direct private key import. I know the exodus desktop wallet allows key sweeping. Maybe blockchain.com's web wallet allows you to do this?

@DefiGod5 Ugh electron scares me. Any mobile apps?

@cprkrn blockchain.com/explorer/addre… Recommend using electron cash, the electrum fork for bitcoin cash, to easily sweep it. Or find any other wallet that supports BCH.

@DefiGod5 ?!??

@0xnirlin I believe hypernative stopped an attack on parallel protocol the other day. But only because the initial attack transaction reverted. things were paused before they could try again.

Has a monitoring tool ever actually prevented a hack? Not detected it after the fact. Not sent a panic alert. Actually prevented it. I think that number is close to zero.

@BlockEnthusiast @Marczeller x.com/MatiasNisenson…

@BlockEnthusiast @Marczeller I have a side biz of helping people recover old wallets and LEND is one of the most common tokens with value found floating around random wallets from the OG days. This hurts to see, especially on such a short notice.

if you still own LEND, Aave labs decided to raise unexpectedly a proposal to AIP stage. You have 5 days to migrate or you will lose your ability to do it and hold worthless tokens. While I supported working on this in the past, doing it overnight in a whole different context of ownership of the DAO is clearly not something I support. We're talking about 30m$ worth of tokens at current market price. here's the migration contact: etherscan.io/address/0x3176…