Software Engineer at Chia Network Inc and creator of @sage_wallet and the Rue programming language. Haven't found a reason not to use Rust for everything yet.
Siesta Key, FL
Joined May 2020
- Tweets6.9K
- Following895
- Followers1.6K
- Likes3.1K
Pinned Tweet
I'm excited to announce the release of the latest version of the Rue programming language! Read more about it on the blog post and its documentation:
Rigidity 🌱 retweeted
Sage 0.13.1 has been released! This primarily includes bug fixes for Sage Apps and various other features.
You can get it at sagewallet.net/ or with the GitHub link below.
Rigidity 🌱 retweeted
We were unable to make TibetSwap sustainable over the past 4 years or secure the support needed to keep it going. We are proud of what we built, and grateful to the community that made it worthwhile.
blog.kuhi.to/so-long-and-tha…
Rigidity 🌱 retweeted
We're announcing 4 important updates about TibetSwap:
1. A plan to refund affected users
2. A detailed post-mortem
3. A farewell
4. A request for donations
We plan to refund all assets, except bridged liquidity, by the end of next week. TibetSwap will not be re-launching.
Rigidity 🌱 retweeted
The unstake transactions are much more complex than normal ones, and the website will ask you for the private key of the wallet you originally used to stake your NFTs.
Because transferring a single NFT takes a lot of block space, the website will automatically split your NFTs into batches. Each batch needs a signature from your key that depends on the reward distributor singleton coin, which everyone will be trying to spend at the same time. As such, to make the process reliable, the browser needs to sign on your behalf for each retry. Other assets in your wallet aren't queried or used.
Your private key stays in the browser. Still, we recommend caution - that is, sending all your assets (except for some XCH you'll use for fees) to another wallet before pasting the key.
And, of course, triple-check you're using the right website!
Rigidity 🌱 retweeted
The reward distributor codebase has gone through many reviews, both by humans and agents. Some time ago, I asked @Rigidity16 for one such review of the code for CATalog. On May 5, 2026, he spotted a bug related to how the refund process works - the process of asserting a slot existed was itself flawed, and allowed someone to 'prove' that arbitrary slots existed.
I quickly realized this extended beyond CATalog to XCHandles and the reward distributor. This was well before XCHandles was deployed. The only at-risk dApp was the DataLayer Minions reward distributor, which used the pattern when starting a new epoch.
Fortunately, the action is only executable on August 29 each year, which gave us more than enough time to prepare for a recovery.
On August 29, 2026, I successfully forged an epoch slot and was able to recover 100% of the DIG locked in the distributor. The DIG that was allocated to staked NFTs but not claimed by their owners yet will be sent to the appropriate addresses at a later date. The remaining DIG will be used to seed 19 years of rewards for the new distributor. Rewards will be added on Monday to give everyone time to migrate.
Given recent developments, the codebases for the reward distributor, XCHandles, and CATalog have also been recently scanned by the latest models, including Daybreak Blue and Fable 5/5.1.
I would also like to give a special thanks to @hadamcik , who was the first to use Daybreak Blue to audit the code and privately sent me his findings. Those findings included two viable attack paths, both of which have now been patched.
The action layer CHIP contains a warning about the insecure 'slot oracle' pattern along with the fix (having each slot also store a counter). Thank you to everyone for migrating promptly, as well as everyone who helped review and secure the code.
Rigidity 🌱 retweeted
We are working on an agreement with @chia_project to make all affected users whole. We currently expect this agreement to be finalized next week.
Rigidity 🌱 retweeted
As we continue our work on the post-mortem, we would like to post an update on the current situation:
Rigidity 🌱 retweeted
It appears the attacker did not accept our 10% bounty proposal, as they have recently deposited 10 ETH (~$25,000) into a popular cryptocurrency mixer service (Tornado Cash).
Rigidity 🌱 retweeted
We have sent the following message to the wallet holding the funds from the exploit:
"
Hello,
We acknowledge the vulnerability you have identified in warp.green’s ERC-20 bridge.
Rigidity 🌱 retweeted
We have identified the vulnerability involved in the exploit, which is related to the Chia-side part of the ERC20 bridge, and confirmed that no other malicious transactions have taken place.
Rigidity 🌱 retweeted
We have recently identified two suspicious transactions of 85,000 wUSDC.b and 8,000 wUSDC. Preliminary analysis suggests they are malicious.
We are coordonating with validators to pause the protocol. Updates will be posted on this account.
Rigidity 🌱 retweeted
Heads up: if you currently have any open wUSDC/b offers, please cancel them for now.
warp.green has identified suspicious wUSDC-related transactions and is investigating. Until the situation is clearer, we’d recommend not creating or filling any wUSDC offers.
Rigidity 🌱 retweeted
The XCHandles website is now live!
xchandles.com
A few surprises for you in the thread below:
