明特鲁
1.7K posts
明特鲁
@ming_okx
🇨🇳加密爱好者｜永不梭哈｜合约难民｜山寨人｜空气币和土狗的弱者👎｜交易所的貔貅｜套牢教父🥷
Katılım Kasım 2023
373 Takip Edilen213 Takipçiler
以下是 GitHub 上这份 ICE ION Security Audit 2026 报告的总结（审计日期：2026-04-12，由 Mefai Security Research 完成）：审计概览审计对象：ICE Open Network（ION，TON 的 fork）
范围：对比 白皮书中的安全与架构声明 与 实际公开源代码 的差异
代码来源：github.com/ice-blockchain
整体评分：34/100（HIGH RISK 高风险）
执行摘要（关键结论）报告共发现 13 个重大差异，全部被定为 Critical（致命） 级别。
核心问题在于：项目在白皮书中宣称的安全性、去中心化、创新性等特性，与实际代码实现严重不符。本质上是一个经过简单重命名的 TON 分支，存在大量安全隐患、凭证泄露和功能绕过。主要致命问题列表（全部 Critical）项目本质是 TON 的重品牌 fork
代码中保留 TON 版权头和“rebranding ton to ion”的提交记录，却宣称是原创区块链。
无量子抗性加密
宣称“强量子抗性加密”，实际使用普通 Ed25519，且私钥明文暴露在 YAML 文件中。
私钥明文存储在 GitHub
heimdall/application.yaml 中直接包含完整的 64 字节私钥，与“设备安全元件中不可导出私钥”的声明完全矛盾。
生物识别安全功能被禁用
代码中明确设置 deviceIdentificationDisabled = true，生物识别验证实际未生效。
KYC 验证被绕过
多处代码使用 if true 或直接返回 false，KYC 流程形同虚设，存在 26+ 个类似绕过标志。
无多方计算（MPC）
宣称 3-of-5 MPC 密钥分片，实际私钥完整存储，未进行任何分片。
IDOR 漏洞（用户数据越权访问）
缺少所有权检查，任何用户可通过 ID 访问他人数据，严重隐私泄露。
验证者高度中心化
Team + DAO + Treasury 控制 50% 代币，与“社区选举验证者”严重不符。
号称非托管钱包实际为托管
使用 DFNS 托管方案，ICE 团队持有管理员密钥，可完全控制用户钱包。
认证可被硬编码凭证绕过
application.yaml 中存在 hardcoded confirmation code（如 bogus@example.com: 111），可直接登录。
数据完整性校验被禁用
校验逻辑被 if true || ... 绕过，无法检测数据篡改。
内部基础设施公开暴露
生产环境中暴露内部 WebSocket relay 的真实 IP 地址，可被直接攻击。
生产代码中混入开发凭证（报告中提及但未完整展开）
总体结论审计报告认为，ICE ION 在安全、隐私、去中心化和技术创新等方面的白皮书声明与实际代码实现存在系统性、根本性的不一致。当前实现存在严重的信任风险和安全隐患，建议用户在投入资金或数据前保持高度谨慎。项目若想改善，需要：透明披露其基于 TON 的事实
立即移除所有明文私钥和硬编码凭证
真正实现宣称的安全功能（生物识别、KYC、MPC、数据校验等）
加强访问控制和去中心化治理
这份审计本质上是“白皮书 vs 代码现实”的对比报告，揭示了宣传与实现之间的巨大差距。需要我针对其中某个具体问题展开详细说明吗？
@ice_blockchain @ice_z3us @Auntierekt @Alafasy1246 @Bitcoinhabebe @CryptoTsetter
中文
明特鲁 retweetledi
Mefai reports security vulnerabilities directly to development teams and, in critical cases, to bounty programs. However, as we have established, we will always share security breaches publicly. We have a dedicated section within our project for transparency, and these projects are flagged on our own platform.
ICE Open Network (ice.io) is a TON blockchain fork that claims to offer quantum resistant encryption, decentralized identity, and secure KYC verification. This security audit reveals critical discrepancies between the whitepaper claims and the actual codebase implementation. We aren't here to provide commentary or spread FUD. We are simply reading the code to uncover the reality of what is actually there. We are telling it like it is for the people.
The reason we do this is simple, we audit every project before it is added to our own platform anyway. When a project resorts to lies even for marketing, you see the result. We are here to protect our legion community.
github.com/mefai-dev/secu…
English
🚨 An Update from the CEO
I want to speak openly about the situation we are facing.
For more than four years, our company has operated out of the BVI without a traditional bank account. Throughout that time, the business was funded primarily through token-based agreements. That meant development, infrastructure, marketing, legal, and many other operational costs were covered through tokens rather than fiat. This was possible because we worked with a service provider who believed deeply in our vision and agreed to support the project in exchange for tokens.
For over four years, that provider stood by us and helped us build. However, due to recent market conditions, he lost confidence in the project and decided to claim tokens that were scheduled to unlock after two years, on 7 April. That event triggered the crash you have seen and brought our collaboration with him to an end. It has also placed the company in a very difficult position.
Over the past four years, the total cost of building this project has exceeded $18,000,000 USD. We have invoices, records, and audit trails for every expense. During this entire period, @ice_z3us, @robertpreoteasa, and @ice_apoll0 did not take salaries, because we believed in the long-term vision and chose to keep building.
As many of you know, under our tokenomics, the team managed approximately 4.2 billion tokens across the team, treasury, and ecosystem allocations. Because the monthly operating costs of the project were so high, we entered into a long-term agreement with the service provider under which he would receive a larger amount of tokens after two years in return for supporting the business and helping us scale. That structure was meant to buy us time to build properly and reach a stronger position.
The reality is that the cost of operating the project became far greater than what could reasonably be recovered. The provider ultimately lost money on the arrangement, and after investing around $18,000,000, he chose to exit and sell the tokens he was entitled to. That is what brought us to where we are today.
At this moment, the company still holds a little over 1 billion tokens. As the attached data shows, and based on the average prices at which the provider sold in recent days, it is clear that the company has been operating at a loss from the very beginning. Even so, we kept going because we truly believed in the project.
We have seen many accusations claiming that we, as a team, dumped tokens on the community. That is simply not true. What happened was the termination of an agreement with a long-term service provider, and that outcome has now been reflected in the market.
The project's current operating cost is around $400,000 per month. Many people do not realize how expensive it is to keep a project like this alive at scale. Even if every token we had received had been sold, it still would not have fully covered the total costs and obligations of the business.
We never lied when we said we believed in this project. In fact, we are the ones who have been hurt the most by this situation.
Because I want to remain fully transparent, I have to say this clearly: we are now reviewing whether it is possible to reduce costs significantly over the coming weeks, potentially by half. If we continue operating, it may require us to sell part of the remaining treasury tokens to cover essential expenses. We are no longer in a position where we can keep absorbing losses indefinitely, especially after already carrying losses of roughly $8 million.
What happens next depends on whether the project still has real support from the market and the community. We will watch the coming days carefully and assess whether there is enough confidence and momentum for us to continue building. If there is, we will keep going. If there is not, we will be forced to consider shutting the project down. And if that happens, I want to be clear: we will burn our remaining tokens, not sell them.
It is also important for the community to understand how much of the unlocked token supply was used to support the ecosystem. Out of the 4.2 billion tokens managed across these years, more than 900 million tokens were used for exchange campaigns, KOLs, and liquidity. Many people ask for listings, but few understand what listings actually require: exchange liquidity, market making, campaigns, promotions, and other associated costs. These are real costs, and they are substantial.
There is another truth I have avoided discussing publicly until now, but I believe it is important to say it. Exchanges do not value all user bases equally. Large user numbers from Tier 3 countries did not help with listings in the way many people assumed. In many cases, exchanges specifically asked us for performance and user metrics excluding those regions. This is an uncomfortable reality of the industry, but it is a reality nonetheless.
In the images attached, I have also shared detailed costs, including what different exchanges charged us and how many tokens were required for marketing and listing-related activity. I want people to better understand how this industry really works. We have nothing to hide, and the exchanges involved can confirm the commercial structures.
I am deeply saddened that we are in this position, but I owe you the truth. The documentation is there. The records are there. The transaction history is there.
If anything, we are the ones who lost the most trying to make this vision real.
English
我用豆包给我分析了一下项目方目前的状况：
我直接给你最本质、最冷酷、不带任何情绪的实话：
ICE/ION 走到今天，是「商业模式+资金结构+行业环境+团队决策」四重必死局叠加，不是意外，是必然。
一、最致命：完全依赖单一金主，没有法币现金流
- 4年多没有传统银行账户，所有开发、营销、法务、服务器、上交易所费用，全靠代币支付。
- 唯一出钱的是一个外部服务提供商，垫了约 $1800万 美金，换2年后解锁的代币。
- 本质：项目没有自我造血，全靠一个“爸爸”养着。
- 爸爸一撤、一砸盘，项目直接断血。
二、成本完全失控，烧钱速度远超行业常识
- 每月固定烧 $40万美金（一年 $480万）
- 开发团队、法务、审计、云服务、做市、KOL、交易所上币费、流动性……
- 4年烧掉 $1800万+，团队3年多零薪水
- 现实：公链/钱包类项目，没收入、没应用、没手续费，却按大厂规模烧钱
- 结果：国库代币越卖越便宜，永远填不上成本窟窿
三、代币经济设计（Tokenomics）从根上就是死局
- 团队+国库+生态 ≈ 42亿代币
- 为了让金主垫资，提前承诺大量代币，解锁日一到直接砸盘
- 结构：
- 金主砸盘 → 币价暴跌 → 国库剩余代币价值缩水 → 更不够付运营费 → 只能继续卖 → 再跌
- 死亡螺旋，无解
四、用户质量差，上交易所巨贵，全是沉没成本
- 用户看似多，但大量来自第三世界国家
- 交易所不认这种用户，上币费、做市、流动性要求极高
- 42亿代币里，9亿多花在交易所、做市、KOL、拉新
- 结果：花了大钱，没换来真实流量、没换来交易量、没换来价值
五、熊市+监管双杀，外部环境直接判死刑
- 2025–2026是加密熊市，小币流动性枯竭、没人接盘
- 金主看到市场差+项目烧钱无底洞，彻底失去信心
- 本来等2年解锁，提前砸盘离场
六、团队最后摊牌 = 已经放弃
CEO原文：
“我们正在考虑大幅削减成本（可能砍半）；
可能需要卖掉剩余国库代币付必要开支；
再没社区支持，就关项目、销毁剩余代币。”
翻译成人话：
我们不想扛了，也扛不动了，准备体面死。
一句话总结（最狠实话）
ICE/ION 从第一天就是「用代币当钱烧、靠一个金主续命、没有盈利模式、成本失控」的项目。
不是意外崩盘，是注定早死**，只是刚好在4月7日这一天爆发。**
中文
"We will watch the coming days carefully and assess whether there is enough confidence and momentum for us to continue building. If there is, we will keep going. If there is not, we will be forced to consider shutting the project down."
Ice Open Network@ice_blockchain
🚨 An Update from the CEO I want to speak openly about the situation we are facing. For more than four years, our company has operated out of the BVI without a traditional bank account. Throughout that time, the business was funded primarily through token-based agreements. That meant development, infrastructure, marketing, legal, and many other operational costs were covered through tokens rather than fiat. This was possible because we worked with a service provider who believed deeply in our vision and agreed to support the project in exchange for tokens. For over four years, that provider stood by us and helped us build. However, due to recent market conditions, he lost confidence in the project and decided to claim tokens that were scheduled to unlock after two years, on 7 April. That event triggered the crash you have seen and brought our collaboration with him to an end. It has also placed the company in a very difficult position. Over the past four years, the total cost of building this project has exceeded $18,000,000 USD. We have invoices, records, and audit trails for every expense. During this entire period, @ice_z3us, @robertpreoteasa, and @ice_apoll0 did not take salaries, because we believed in the long-term vision and chose to keep building. As many of you know, under our tokenomics, the team managed approximately 4.2 billion tokens across the team, treasury, and ecosystem allocations. Because the monthly operating costs of the project were so high, we entered into a long-term agreement with the service provider under which he would receive a larger amount of tokens after two years in return for supporting the business and helping us scale. That structure was meant to buy us time to build properly and reach a stronger position. The reality is that the cost of operating the project became far greater than what could reasonably be recovered. The provider ultimately lost money on the arrangement, and after investing around $18,000,000, he chose to exit and sell the tokens he was entitled to. That is what brought us to where we are today. At this moment, the company still holds a little over 1 billion tokens. As the attached data shows, and based on the average prices at which the provider sold in recent days, it is clear that the company has been operating at a loss from the very beginning. Even so, we kept going because we truly believed in the project. We have seen many accusations claiming that we, as a team, dumped tokens on the community. That is simply not true. What happened was the termination of an agreement with a long-term service provider, and that outcome has now been reflected in the market. The project's current operating cost is around $400,000 per month. Many people do not realize how expensive it is to keep a project like this alive at scale. Even if every token we had received had been sold, it still would not have fully covered the total costs and obligations of the business. We never lied when we said we believed in this project. In fact, we are the ones who have been hurt the most by this situation. Because I want to remain fully transparent, I have to say this clearly: we are now reviewing whether it is possible to reduce costs significantly over the coming weeks, potentially by half. If we continue operating, it may require us to sell part of the remaining treasury tokens to cover essential expenses. We are no longer in a position where we can keep absorbing losses indefinitely, especially after already carrying losses of roughly $8 million. What happens next depends on whether the project still has real support from the market and the community. We will watch the coming days carefully and assess whether there is enough confidence and momentum for us to continue building. If there is, we will keep going. If there is not, we will be forced to consider shutting the project down. And if that happens, I want to be clear: we will burn our remaining tokens, not sell them. It is also important for the community to understand how much of the unlocked token supply was used to support the ecosystem. Out of the 4.2 billion tokens managed across these years, more than 900 million tokens were used for exchange campaigns, KOLs, and liquidity. Many people ask for listings, but few understand what listings actually require: exchange liquidity, market making, campaigns, promotions, and other associated costs. These are real costs, and they are substantial. There is another truth I have avoided discussing publicly until now, but I believe it is important to say it. Exchanges do not value all user bases equally. Large user numbers from Tier 3 countries did not help with listings in the way many people assumed. In many cases, exchanges specifically asked us for performance and user metrics excluding those regions. This is an uncomfortable reality of the industry, but it is a reality nonetheless. In the images attached, I have also shared detailed costs, including what different exchanges charged us and how many tokens were required for marketing and listing-related activity. I want people to better understand how this industry really works. We have nothing to hide, and the exchanges involved can confirm the commercial structures. I am deeply saddened that we are in this position, but I owe you the truth. The documentation is there. The records are there. The transaction history is there. If anything, we are the ones who lost the most trying to make this vision real.
English
中文
把一直支持 #ION 项目的坚定持有者，弄跑路了，我不知道项目方怎么想的。
They’ve run off the diehard holders who’ve been backing the #ION project all along. I have no idea what the project team is thinking.
@ice_blockchain @ice_z3us @ibby_ice @Bitcoinhabebe
中文
中文
明特鲁 retweetledi
Habeebe delete this tweet lol he is in huge depression i m happy 😁😁 i don't care mthfuker $ion community
English
@Bitcoinhabebe @ice_blockchain Hello boss, what should we do? I am a long-term holder like you, what should I do now? I am going to die.
English
Over 2 years, I accumulated over 200M $ION tokens which at one point were worth over 2 million dollars. Not one single dollar was sold by me ever. I never even moved them out of Online+ till now. Having full trust in @ice_blockchain ‘s team & the potential of this going to billions, I kept holding through thick & thin.
Today I am 2 million dollar down, not knowing what’s next & not knowing how to react.
Everything seemed right. The work is being publicly done day in & out by the team. We have tangible results like Online+ , a fully doxxed team & more. Till now idk why the dump today. Everything looks promising. Utilities , launch’s , upcoming tokenised communities , products & more.
@ice_z3us @mikecostache this needs to be addressed & amended. It’s make or break now.
If this is handled well it will have a tremendous effect. Please make it right!
English