clay Trop

$5.4M drained from @gravity_bridge today. Not through a complex math exploit. Not through a reentrancy attack. Through trust. 37 validators unknowingly signed a malicious update. The signing pipeline was poisoned. They never knew what they were approving. The contract had no timelock. No guardian multisig. No circuit breaker. Once the signatures were valid, execution was instant. And irreversible. The scariest vulnerabilities aren't in the math. They're in the assumptions. "Our validators won't be compromised." "Our signing pipeline is safe." It was realistic enough.

Started to aggregate ZK resources I personally used for learning. There's a lot of "awesome ZK" repos, but some of them are lists of lists of lists. If you know anything worth adding, issue a PR or send me a carrier pigeon with a link github.com/0xluk3/ZK-reso…

Stop wondering what tools @zachxbt uses for on-chain investigations. Here’s the list.

4 GitHub repos that replace any Solana security course. 1. Adevar Labs reports GitHub: github.com/AdevarLabs/aud… 2. Frank Auditor reports GitHub: github.com/Frankcastleaud… 3. Zenith reports GitHub: github.com/zenith-securit… 4. Certora reports GitHub: certora.com/reports

Discord role meta is back Open gradient – $4k for full role holders Fluent Project – $6k for inner role Next Discord alpha projects: 1. @hibachi_xyz 2. @inconetwork 3. @risechain 4. @liquidtrading 5. @w3arew3 6. @kash_bot 7. @citrea_xyz These Discord roles could potentially give 3–4 figure rewards Which Discords are you contributing to?

@ForgeAudit This hits. As a builder, I’ve seen how many great ideas stay hidden just because the right doors never opened. We need more spaces like this.

Some of the sharpest builders and auditors in Web3 are still unknown. Not because they lack skill. Because they never got the right support. The builder with a great idea but no network. No budget for an audit. No connection that opens the first door. The auditor with real skills and a growing track record, but never got a real opportunity. They're out there. Still grinding. Still building in silence. Web3 moves better when we lift each other up. Support the builders around you. Back the auditors still finding their footing. Share their work. Give them a shot. You might be looking at the next great name in this space. That's exactly what we are building toward. A place where serious builders and auditors belong. It's one of our biggest visions. Are you one of them?

33 creator agencies you need to know about

Early Projects tracked today AI: • @samwowc • @NolRadar • @BudgetPilotAI • @RoastyAI_com • @SlopSystem • @_sahilyohari • @LeviathanMatrix • @AtlaiTechLTD • @Cite_GEO • @TheKBRCo • @Linkdesk_Ai • @nxtdo_ • @SwarmSmartSys • @atnms_agent DeFi: • @xsc_bnb GameFi: • @playfeltgg • @pulsemaster Infrastructure: • @blockdagnstwork • @AflotonPvtLtd NFT: • @DogskullzNFT Real Estate: • @RWAbyCLYS Social: • @korban_app Tools: • @trackaxo • @seogard_io • @cryptowebsocket • @SpendspaceIO • @PiHiker • @RugRadarlive • @bilinvo • @voidmintlabs • @robaerai • @pompelmi_oss • @nexttweetoffical Others: • @NewsRadarApp • @tradefrenz • @voucherforgesdk • @_Betlys • @bitpulsesocial • @AthoHQ • @H_E_M_P_L_E_X • @arcrypt_bid • @nivofinance • @FundFi_io • @OfficialOmnibit • @tripmartvn Save this for later. Move early or miss it. Always verify before you ape. DYOR & NFA

Daily Projects to keep an eye on: > @SvpChain ( DeFI ) > @ValinorDigital ( RWA raised $25M ) > @veneposa ( Data Layer ) > @GoMyto_ ( AI Agents ) > @AurumXLabs ( AI ) > @AnarchyFinance ( DEX ) > @orbis1_ ( Ai Agents ) > @TowerExchange ( DeFI ) > @matiummarket > @Lynx_Pay ( Payment ) > @ultrametricai ( AI ) > @moonycoin > @warpspeed_eth ( DeFI on Eth ) > @SuperisLabs > @solottoso ( DeFI ) > @DotA_Agents ( AI Agents ) > @notional_xyz ( DeFI ) > @bestceoai ( AI ) > @optivixyz ( DeFI ) > @1nk_bloc ( Social ) > @agenticxo ( AI Agents ) > @lorawtf ( Others ) > @FuxelFox ( Early on Tempo ) > @opnftfun ( NFT ) NFA & DYOR always !

Before you label it Critical, run this check 👇

Early Projects tracked today AI: • @AiChassisLab • @Kalmari_AI • @planet_ai_net • @thinkn_ai • @visaagentai • @ai_aimx • @EpistoAI • @_askaapp • @getleadioz • @NoBet_AI DeFi: • @XFFProtocol • @CatalystFio • @AnarchyFinance GameFi: • @Luckywinfund • @mythlings_ • @Pumpversesol • @conquera_ai Infrastructure: • @solokingmining • @GlobalLiqpro • @SecuritiesDino • @predictlayer • @BMA_onchain NFT: • @LeiInfinix Social: • @BNBshare_fun Tools: • @voidmintlabs • @zbettdesign • @robaerai • @pompelmi_oss • @nexttweetoffical Others: • @Sniperolyd • @FrictionHL • @OraclixMarket • @guilddotcity • @USTrustBank • @PONDA • @zerokvault • @zkpnote • @PSRCCOS • @NeoPepeKEPE • @ethpotfun Save this to bookmarks for later. Filter carefully, validate everything, and move early. DYOR and NFA

Reviewed a protocol recently. Every single function had a modifier. Access control everywhere. Roles, onlyOwner, custom checks, looked bulletproof. Then we saw the ownership transfer function. Zero timelock. No delay. No second confirmation. One compromised key. Full control in a single transaction. They put all the locks on the wrong doors.

Everything on Solana

✅ [New bug bounty] Earn up to $10,000 with @CetusProtocol Scope: Web You will be rewarded based on these tiers: Critical: $10,000 High: $5,000 Medium: $1,000 Low: $100 Start the #bugbounty hunt right now! hackenproof.com/programs/cetus…

Top 15 Projects on Solana by 7D Growth 🔥 ▫️@Momo_Agent_ ⭢ 210.10% ▫️@UnitasLabs ⭢ 67.30% ▫️@swarms_corp ⭢61.70% ▫️@staika_official⭢ 43.70% ▫️@blinks_gg⭢ 43.60% ▫️@PerleLabs ⭢ 43.20% ▫️@reservoir_xyz ⭢ 35.50% ▫️@sns ⭢ 27.10% ▫️@pumpcade ⭢ 22.80% ▫️@swarmnode ⭢ 18.10% ▫️@PayAINetwork ⭢ 14.30% ▫️@kamino ⭢ 14.10% ▫️@PythNetwork⭢ 14.00% ▫️@BioProtocol ⭢ 12.40% ▫️@NATIXNetwork ⭢ 12.30% Are any of these your picks? 👀

These days, we have only 3 metas live: – Perps – RWA – Prediction markets The rest is dead

Every function was correct. The protocol still failed. During a recent review, our team flagged an issue that had nothing to do with the contract's own logic, every function was correct, every check was in place. The problem was the assumption that no other contract would touch the same state mid execution. Contract A reads from a shared dependency. Contract B updates that dependency in the same block. Contract A acts on data that's already outdated. No reentrancy. No overflow. No missing access control. Just two contracts that were never audited as a system. Isolated testing doesn't catch this. Only a full scope review does.

The more advanced technology becomes, the more attackers are ready to hack. Attackers and security are inseparable and cannot be avoided.

Early Projects for the first green day in bull market: > @config_inc ( DePIN ) > @payhaps ( Stablecoin ) > @TamitosGame ( GameFI ) > @NaraBuildAI ( L1 ) > @ElyzionLabs ( DePIN ) > @Woon_agent ( AI Agent ) > @Chainfunded_io ( L1 ) > @cleanailabs ( AI ) > @carte_gg ( GameFI ) > @bettermoney_co ( Stablecoin ) > @emittersxyz ( L1 ) > @erc8126 ( Privacy ) > @m_lighterxyz ( Prep dex ) > @bondt0gether ( DeFI ) > @worldxagents ( AI ) > @flewlive_ ( Privacy ) > @tipstarsgg ( L1 ) > @PixieChess ( GameFI backed by Paradigm ) > @arclens_app ( Others ) > @axonchain.ai ( L1 ) > @Tempfitrade ( Trading on Tempo ) > @BaseDollarOrg NFA and Dyor always !

Congratulations to me 🎉 I just built and shipped a fully on-chain crowdfunding protocol on Ethereum Sepolia. No middlemen. Transparent funding. Smart-contract enforced payouts/refunds.
Frontend + backend indexer + wallet integration all live 🚀 Contract: 0x259c50134002214B149AdC32eC5871d9De5d551E 
GitHub: github.com/DevAyomi/crowd… If you love what I’m building, please do well to ⭐ the repo and follow me on GitHub 🙏