toly 🇺🇸
109.5K posts
toly 🇺🇸
@toly
Co-Founder of Solana Labs. Award winning phone creator. NFA, don’t trust me, mostly technical gibberish. https://t.co/LomgbTpb6h
🏔️🏔️🏔️ Katılım Şubat 2014
6.9K Takip Edilen823.9K Takipçiler
@candyflipline @0xSoju @DriftProtocol @SimkinStepan @multisig Is it indexable? Like can we display if program upgrade multisig has time delay enabled? @jacobvcreech maybe that’s something we can add to the explorer, at least shame the protocols that aren’t doing it
English
@0xSoju @toly @DriftProtocol @SimkinStepan @multisig Imo, squads smart accounts primitive addresses this problem. the account logic is built around settings there, so it forces you to choose time lock upon account creation.
#core-concepts" target="_blank" rel="nofollow noopener">github.com/Squads-Protoco…
English
toly 🇺🇸 retweetledi
Take care @DriftProtocol users & team.
All of Solana is rooting for you right now.
As for everyone else — let’s do reviews and tighten our opsec security together.
We’re in this together 🥳
English
toly 🇺🇸 retweetledi
@candyflipline @0xSoju @DriftProtocol @SimkinStepan @multisig Is there a module to just simply kill all the humans and address this entire class of problems?
English
A simple way to end 2 wars at once is to let Ukraine recover the enriched uranium and take on the risk of the operation.
Faytuks Network@FaytuksNetwork
BREAKING: President Trump requested a plan to seize nearly 1,000 lbs of highly enriched uranium from Iran. The U.S. military briefed him on a complex operation involving airlifting excavation equipment, building a runway inside Iran for cargo planes to extract the material, and potentially deploying hundreds of troops. - WaPo
English
@toly @0xSoju @DriftProtocol @SimkinStepan @multisig it's part of multisig
#L26" target="_blank" rel="nofollow noopener">github.com/Squads-Protoco…
docs.squads.so/main/developme…
English
@candyflipline @0xSoju @DriftProtocol @SimkinStepan @multisig Is that part of @multisig or just fuse?
English
@toly @0xSoju @DriftProtocol @SimkinStepan @multisig that's how squads time-locks work
irc fuse cards withdrawal logic uses them. after the txn is signed, it's frozen for X seconds before execution.
English
@wetfinger Add them to nato. They already gave up all nukes once, seem like good chaps
English
@toly why should a non-nato state be allowed to have weapons of mass destruction ?
English
@Tristan0x Time delay on all multisig actions unless all 5 sign. This feels like something @multisig can add as a module
English
We're going to do a proper retro on this with regards to team opsec and multisig admin wallet practices. You can have all the guardrails in place for your protocol but if they're secured by a single signer, that's a liability
Interested to see how the admin got compromised too
English
This really sucks to see. Seems like admin key compromise -> fake collateral asset listing -> inflate collateral weighting on multi-collat engine (similar to mango hack) -> override withdraw limits -> drain all spot pools.
Hope they manage to recover some of the funds. Godspeed
Drift@DriftProtocol
Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke. We’ll provide additional updates from this account as more information is available to share.
English
@0xSoju @DriftProtocol @SimkinStepan @multisig Require all 5 signers to sign to instant commit. If all 5 are compromised, so help you god
English
@0xSoju @DriftProtocol @SimkinStepan @multisig Have the team submit a hash of the payload to unlock it for X days, then have it be cleared for execution X days later or cancelled
English
@UbermenschSymm1 @0xSoju @DriftProtocol Require all 5 signers to sign to instant commit. If all 5 are compromised, so help you god
English
@toly @0xSoju @DriftProtocol until you try to deal with some attack and now you gotta wait 24hrs during which everything is drained. only negative side i can think of, otherwise agree
Ubermensch@UbermenschSymm1
I think when writing programs we should suppose that admin keys can be compromised and add as many measures as possible against that. for example, adding some kind of delay(from initial instruction) before activating new listing as collateral would probably stop this attack. but no one would write that if always supposed that multisig is never compromised
English
@toly @brian_smith_0 Hopefully they’ll at least have a better name. Something fun and lively. “durable nonce” was far too nerdy. Whoever named it must be a hella nerd.
English
i missed the fact that these drift related squads txs had durable nonces... that changes things. perhaps all my wallet security rants are misapplied here.
the drift admins may not have completely exposed their keys. just signed a rogue tx sometime in the last 10 days / 2 days respectively. theres no way to tell when it was signed, just sometime in the window.
so if thats the case, perhaps proper wallet security was in place - but they were somehow tricked into signing something without knowing. a key thing to look at here would be a fake squads page, since it seems like those wallets were signing legit squads txs during the window.
wallet1: solscan.io/account/39JyWr…
nonce1: solscan.io/account/7s7s6s…
nonce1 used in attack: solscan.io/tx/2HvMSgDEfKh…
wallet2: solscan.io/account/6UJbu9…
nonce2: solscan.io/account/EmYEry…
nonce2 used in attack: solscan.io/tx/4BKBmAJn6Td…
English
@LoganJastremski Mcp doesn’t block payments or any other usecase. It gives the active LPs an optional latency bump equal to the economic tick.
Fcfs just makes zero sense in a state machine that can’t enforce price time ordering globally.
English
This is correct
Memes and Payments don't need MCP
Yet, if we want real daily volumes to the tune of 100B to 1T+ MCP is going to be a requirement for the microstructure to improve and then ultimately surpass
Arjun@clipsofcrypto
Does Solana actually need MCP to win? Ellipsis Labs CEO Eugene Chen on what's most critical for Solana's success "MCP is the most important for a very specific set of applications... ones that are very sensitive to market microstructure. It matters if the effective take rate from the chain is half a basis point versus five basis points" "Solana could win payments without MCP. Memecoins can win without improving market structure. But high frequency trading, heavy duty finance on the chain... that is going to be very difficult to win without MCP" "If Solana doesn't care about winning trading, then MCP is not too important either. That's a decision the whole Solana ecosystem has to make"
English
@brian_smith_0 @TheSoftwareJedi Whatever would replace them would have the same attack vector though.
English
