This is exactly what the space needs. It's a tough piece of analysis, especially when you're tracking all the wallets in realtime. Congrats to @CloakdDev & co for pulling this off.
Goes well beyond the usual bubble maps.
Let's help make the space safer for everybody.
The @phantom security issues mentioned here deserve a comprehensive public reply in the interests of the community.
@CloakdDev doesn't create a thread unless it's something worth creating a thread about.
@Backpack and @solflare_wallet are not affected.
🧵/1 So lets break this down
Firstly let's make this clear - Everything was reported for FREE in my spare time.
It was made clear to @Phantom multiple times i don't want payment, I just want the issue fixed!!!
I reported some even more serious Vulns about 6 months ago to @phantom which are still live and exploitable (again same excuse - they cant replicate) so bear that in mind while reading this
> Originally reported a vulnerability around the token endpoints on 23rd Dec
> Find remote wiper vulnerability in the ZK stack on Phantom & notified them
> Ignored for a month and not a single member of @phantom asked for further details or reached out
> ZKTokens gets turned off silently ~Jan 14th
> Phantom team member states a "fix is underway" on 16th Jan - For what???
> After chasing 2x a week to get this fixed they finally respond after a public post
> Ron reaches out asking for more info & is provided more than enough information to replicate the bug
> Provide video evidence of the wiper vuln and makes phantom fall into an unrecoverable state


