Sabitlenmiş Tweet
This is something every defi user should read.
This article dives into what went wrong, and how to use AI to become your own auditor.
Complete with an enormous full list of prompts.
$USR $RLP $RESOLV
Luis@TrenchWeb3
English
Luis
2K posts
Luis
@TrenchWeb3
Founder @tryminted | Ex @BNPParibas | Ex M&A @JNJInnovation | Builder (1 acquired) | Ex Top 25 trader on @hyperliquidx | Advisor @okx | Angel Investor
Katılım Nisan 2024
172 Takip Edilen1.9K Takipçiler
@bkiepuszewski @CantonNetwork We have a validator. Just build something good that brings value to the network.
English
Visa announced to be a supervalidator on @CantonNetwork . This means that they joined a closed consortium of "validators" (they are not really validating anything) which you and I will never be able to join. This is what "institutional adoption" looks like today 😭
English
@paskal_navi Yeah tell me about it. Add tipping anyway even though it’s open bar. Cheap bastards
English
The most unexpected flex at a crypto conference? Saying "I'm skipping the after-party, my kids are waiting at home." The silence that follows is louder than any bull market.
English
The USDC cabal needed to be destroyed. Losing its main distribution partner in Coinbase is the best thing for onchain yield that could’ve happened.
DeFi Dad ⟠ defidad.eth@DeFi_Dad
Is anyone else reading this as bullish for onchain yields? Idle money would move back onchain to capture stablecoin yields vs sit on fintech platforms or CEXs where they earn nothing. The US doesn’t want us to earn passive yield on stablecoins—they want you to be poor.
English
Is anyone else reading this as bullish for onchain yields? Idle money would move back onchain to capture stablecoin yields vs sit on fintech platforms or CEXs where they earn nothing.
The US doesn’t want us to earn passive yield on stablecoins—they want you to be poor.
nico@0xNIC0
Said it would happen. Now all custodial stablecoin issuers will no longer be able to offer yield. No more CEX based delta neutrals, off chain hedge fund vaults, no more “give us your capital and we passively earn for you” If it’s not DeFi, it’s not allowed. 🤝🎉🥳🍾
English
Two people laundered stolen Bitcoin for 6 years and got caught because the wife was posting rap videos on YouTube
In 2016 hackers stole 120,000 BTC from Bitfinex worth $72 million at the time
Ilya Lichtenstein and his wife Heather Morgan spent years laundering it through thousands of small transactions, gift cards, gold and fake identities
Meanwhile Heather was uploading rap videos to YouTube calling herself "Razzlekhan" and "the crocodile of Wall Street"
By 2022 the stolen BTC was worth $4.5 billion
The DOJ arrested them in February 2022 and called it the largest financial seizure in US history at the time
She was making music videos about being a tech entrepreneur while sitting on $4.5 billion in stolen Bitcoin
English
@DeFi_Dad None of them did a lick of DD. Thats the truth.
x.com/TrenchWeb3/sta…
Luis@TrenchWeb3
English
I'm extremely bullish on the open competition playing out between curators. Fierce competition to protect lenders and borrowers is a good thing.
I appreciate you publicly sparring and holding each other accountable, the dialogues are good for DeFi.
English
The Resolv Situation serves as a reminder to everyone in the Risk / Vault Curator space.
When the tide goes out, we see who is wearing pants… as in who has proper risk management practices in place and who was hoping to build it before something happened.
Bots auto allocating to downgraded collateral tells you the curator was not monitoring the collateral. Ie: no Hypernative or Hexagate monitoring to prevent adding exposure when exploit occurs.
Hard coding oracles transfers risk to the lending protocol. When these protocols are presented as infrastructure with agnostic positioning, anyone can configure them and whenever something goes wrong both infra and curator brands are impacted.
Let’s recap some recent Morpho oracle issues:
- Renzo’s TGE event, spot differed from NAV and users liquidated (should be NAV oracle but was spot)
- Usual NAV update (governance devalued an asset triggering collateral downgrade causing liquidations)
- Resolv hardcoded oracle (created exposure to infinite mint risk)
One common theme, oracles not reflecting the true value of an asset, and that doesn’t mean taking the founding teams word for it - it means building PoR monitoring, tracking NAV and having robust security measures in place.
English
@ResolvLabs Ya’ll will hire 10 consultants for this post mortem but won’t implement BASIC circuit breakers like SERVICE_ROLE key redundancy.
Come on son.
English
This notice is issued on behalf of Resolv Digital Assets Ltd. in relation to the Resolv protocol.
Earlier today, a malicious actor gained unauthorized access to Resolv infrastructure through compromised private key, resulting in the minting of approximately $80M of uncollateralized USR. A full post-mortem is currently in progress and will be shared once completed.
The incident was identified quickly, and the relevant smart contracts were promptly paused. Approximately 9M USR held by the attacker has since been burned in order to reduce the potential impact.
The protocol currently holds approximately $141M in assets, with the only realized impact identified to date being approximately $0.5M in redemptions processed prior to the pause.
Current USR supply consists of 102M pre-incident USR and approximately 71M newly and illicitly minted tokens.
As an initial step in the recovery process, we are preparing to enable redemptions for all pre-incident USR, beginning with allowlisted users. The current target start date is 23 March 2026. Affected users should coordinate directly with RDAL through official channels.
This incident resulted from unauthorized third-party actions, including a targeted infrastructure compromise and cyberattack. Resolv’s underlying collateral was not directly compromised.
We are actively:
• tracing and seeking to contain illicitly minted USR and other affected assets
• coordinating with partners and counterparties
• working with law enforcement and onchain analytics firms to identify those responsible
We will pursue all available avenues to recover assets and hold those responsible accountable.
We strongly advise against trading USR or related Resolv tokens at this time while recovery measures are being implemented. Actions of users during post-exploit period may affect the recovery.
Further updates regarding illicit USR, and RLP will be communicated in the near term.
English
Wild.@ResolvLabs raised $10M seed from Coinbase Ventures, Maven 11, Robot Ventures, Arrington, and more.
The mint function had no max cap, no collateral ratio check, no multisig. One compromised key = unlimited mint. $23M gone. Massive defi contagion.
The question isn't who hacked them, it's who tf is underwriting this shit?
Resolv Labs@ResolvLabs
The previously disclosed exploit involving ~80M unbacked USR remains under active investigation. Until further notice, we strongly recommend avoiding trading or interacting with Resolv assets at this time to prevent supporting secondary market activity related to the exploit.
English
This exploit had absolutely nothing to do with asset verification.
It was key leak/exploit.
BD people should be banned from ANY technical posting 🙄
jenn@jensenhaji
Minting exploits like Resolv is a design area @m0 really differentiates on by shifting from internal minting logic to external verification using an external "Proof of Asset" oracle. The protocol doesn't just check its own internal accounting, it requires an independent, third-party verification that the collateral actually exists before the minting transaction can be finalized.
English
The previously disclosed exploit involving ~80M unbacked USR remains under active investigation.
Until further notice, we strongly recommend avoiding trading or interacting with Resolv assets at this time to prevent supporting secondary market activity related to the exploit.
Resolv Labs@ResolvLabs
We are currently investigating a security incident involving unauthorized minting of USR. At this stage: The collateral pool remains fully intact. No underlying assets have been lost. The issue appears isolated to USR issuance mechanics. Our immediate priority is to: 1) Contain the incident 2) Assess impact 3) Ensure legitimate users are not affected We are actively investigating and will share more updates shortly.
English
@TrenchWeb3 Exactly right. Smart contracts got hardened, so the attack surface moved to everything around them.
English
Here’s the thing. Hackers have realized that smart contracts actually work pretty well and are becoming more and more difficult to hack.
It’s much easier to hack users than it is the contracts. Usually single points of failure, like front ends, or private keys. I don’t know how this was overlooked without some type of circuit breaker.
You can have 100 audits, but if you’re using keys to mint you’re cooked.
Vadim@zacodil
The Resolv USR exploit wasn't a bug - it was a feature working exactly as designed. And that's the problem. How USR minting works: you deposit USDC, then an off-chain service with a privileged key decides how much USR to mint for you. The contract checks the minimum but has no maximum. No cap. No ratio to collateral. Whatever the key holder says - gets minted. You could deposit $1 and mint billions. This design was live since day one. It wasn't a code bug. The threat model was simply: "the key won't leak." It did. Attacker got the key. Deposited $200K across two txs, minted 80M unbacked USR. Dumped on DEXes, walked away with ~$23M in ETH. Single point of failure: one private key, no on-chain sanity checks. No max mint ratio, no multisig, no timelock. One compromised key = unlimited money printer. The contract worked perfectly. That's the scariest part.
English
Atomic Institutional lending/borrowing. Who's building this? Oh yeah, we did.
Viktor | RockawayX@viktorfischer
The future of Defi is super easy "1-click" borrowing / lending against all kinds of tokenized assets. This is a multi-trillion dollar market. In tradfi it takes ±1 month to borrow against your different types of assets. In crypto, it takes ±1 second. Few. 🚀
English
If the FTC decides that @paulbarron makes people really dumb, they might just pull the plug on his show. Did I get this right?
PaulBarron@paulbarron
"IF" the SEC decides that "private institutional chains" create an unfair advantage over the public markets, they could, and I think will, pull the plug on the interoperability that $CC Canton needs to survive.🤣
English
Luis retweetledi
JUST IN: 🇺🇸 SEC approves Nasdaq rule to allow tokenized stocks & securities trading.
English