
🛟Trust only what you see onchain. @EthTaipei
Taiwan
Joined March 2015
- Tweets6.5K
- Following3.3K
- Followers866
- Likes9.9K
Pinned Tweet
👀 原來 Pendle 的 PT 不一定保本?
昨天看到 @0xlemoneth 的貼文討論到 Strata 的 jrUSDe 未來的 APY 有可能變成負的,那麽 Pendle 市場的損失是否由 PT jrUSDe 來承擔?
xitter.cf/0xlemoneth/status/1978…
去看了 Pendle 的市場頁面發現多了一個警示語區塊,提醒當底層收益變成負的導致 Watermark 利率高於底層資產和會計資產的匯率時:
➤ YT 將不會產生收益
➤ PT 在到期時的贖回資產可能會低於實際價值
昨晚和 @strata_money 的人詢問後,才發現原來 Pendle 有增加一個文件說明 IBT 的負收益風險,以下簡單說明。
docs.pendle.finance/pendle-v…
@pendle_fi 的機制主要是將生息代幣(Interest-Bearing Tokens, IBTs)拆分成本金代幣(PT)和利息代幣(YT),PT 持有者可以在到期日時贖回本金加上固定的利息(類似於零息債券),而 YT 持有者則透過槓桿的方式來累積利息的部分。
正常情況下,生息代幣的利息都是大於等於 0 的情況,但隨著各式資產的設計推出,在某些情況下 IBT 也有可能產生負收益。先來解釋以下兩個在 Pendle 上的專有名詞:
🔹Exchange Rate:生息代幣(IBT)和會計資產的匯率
🔹Watermark Rate:生息代幣(IBT)和會計資產之間最高紀錄的匯率
當 Exchange Rate 跌破 Watermark Rate 時:
⚠️ PT 在到期贖回的資產將會低於其實際價值,即可能造成本金損失
⚠️ YT 則會停止累積收益,直到 Exchange Rate 恢復到 Watermark Rate 的水準
回到 jrUSDe 這個例子,由 Pendle market page 上 Watermark Rate 的圖表顯示,目前 Watermark Rate > Exchange Rate,也就代表目前 YT 已經不再累積收益,而 PT 在到期時贖回的資產會低於帳面預期。
ENA 新協議 @strata_money 出師不利? 第一次就要賠!
根據今天打到合約的 $USDT 數量與目前質押在 $sUSDe 合約的數量來計算,下禮拜的 sUSDe 收益只有 2.25%!
而為了維持 srUSDe 的 4.75% 年化,就得從 jrUSDe 負利率來扣
目前 srUSDe的 TVL 是 jrUSDe 的 8 倍,所以為了彌補不足 Sky Saving Rate (4.75%) 這部分的 2.5% 損失,jrUSDe 就得給出 -20% 的年化!
扣掉原本的 2.25%,jrUSDe 下禮拜可能是 -17.75%。
不過有一點比較好奇,因為 jrUSDe 在 @pendle_fi 是有池子的,這樣購買 YT 的人頂多是拿不到利息,也沒辦法扣他的本金,所以這部分的本金損失應該是由 PT 來承擔?
之前玩的 pendle 好像都沒有遇過這部分,所以不太清楚這裡怎麼計算
另外,由於 sUSDe 達到近期新低,所以基本上各種循環貸都要開始賠錢,尤其是之前和 @aave 的活動導致大量循環貸,雖然已經退出不少,但留在裡面的量體也還是很多,這部分倒是可以觀察一下會不會導致負溢價越來越嚴重。
目前 $sUSDe 的負溢價已經是 -0.3%,花 7 天解鎖年化已經達到 16%,如果繼續上升,又相信 Ethena USDe 的穩定性,那可以簡單當作七天高息短期定存來用
照目前的情況看來,最勝利的還是放在 @binance 裡面吃固定 12% 的人?
雖然 10/11 跌到 0.65 導致爆倉,但根據我身邊有玩的人回報,這部分的損失都已經收到賠償,現在利息只有 2% 但他們還可以繼續吃 12% 的年化收益。
另一方面來看,這模式等於交易所用戶吸血鏈上協議用戶,這也和最近各個項目的 TGE 類似,為了給 Binance Alpha 或是其他交易所做活動,導致項目方送出大量籌碼,這部分就只能從自己協議的用戶上扣,所以刷交互參與項目的使用者都不滿,但對交易所用戶來說卻是日常的一次『大毛』,上一個應該是 @falconfinance ?
不過好在幣安的活動只剩下一個禮拜,再加上 sUSDe 一個禮拜的獎勵延遲,等到 10 月底利率應該就能回穩一點(至少可以和國債利率差不多 吧)
The most iconic trades of past cycles came from huge inefficiencies across markets. Any trader would go back in time for them, but those premiums are long gone.
The same opportunity lives on in perp funding rates, tradable now on our new Spread Markets.
andylinee.eth retweeted
I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography.
The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices.
(and it's also another reason, along with quantum, why ECDSA might fall even faster than expected, hence the "fresh address" recommendation)
So far most people have been in the mode of thinking "elliptic curves broken, hashes safe, lattices safe". But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math.
The basic threat model is: factoring is something that naively takes 2^(n/2) time, but over decades smart people have found and optimized number field sieves, and degraded that to 2^O(n^(1/3)), which is why RSA keys and signatures need to be ~400 bytes (and not 64 bytes). What if there are skeletons in the closet like that, both for elliptic curves and lattices, that we are simply not smart enough to discover - but bots soon will be?
This is a major part of the reason why for the past year ethereum's lean roadmap has been going in the "hash-only" direction: no lattices, no ML-DSA, no Falcon, no lattice-based commitments inside ZK proofs, etc. Signatures in lean ethereum are all hash-based, either WOTS or SPHINCS-.
For signatures and proofs, we already know how to go hash-only. The bigger challenge is for *public-key encryption* - and this goes far beyond blockchains. Secure communication, anonymizing protocols, lots of things need public-key encryption.
And unfortunately there are long-standing mathematical theorems showing why public-key encryption cannot be done with hashes alone. You have to have some kind of trapdoor object that has at least one form of usable "structure" - either group theory (incl. isogenies) or lattices or code-based or potentially in the future even more newfangled and spooky things (local mixing?). But for anything that has structure, you should assume that AI will make at least some progress in breaking that structure. Here, one reasonable inference is that if you want to make something plausibly long-term secure, multiply the key sizes by 10.
To me that's a very plausible world and something not at all extreme to predict. If AI will bring us 50 years of math in 2 years, then that 50 years of math may very plausibly include a "naive factoring -> GNFS" level of improvement to our ability to break lattices. In that world, lattices will still exist, but they will have to be significantly bigger to guarantee the same level of safety.
And at those new larger sizes, hash-based constructions will beat lattice-based constructions on concrete efficiency in every use case where hash-based constructions are possible at all.
Theoretically, of course it's possible that hashes are broken too (eg. P = NP would imply that). But I think P = NP is very unlikely. And intuitively, it's much more likely that a mathematical object has exactly no exploitable structure (like hashes are intended to), than that a mathematical object has exactly ~3 forms of exploitable structure (for elliptic curves: associativity, Schoof, pairings) and not some secret fourth form of structure we have not yet discovered that greatly degrades its security (for elliptic curves, ECDLP and pairing security). Similar for LWE, SVP, RLWE and the zoo of lattice problems.
For this reason, we do not yet see any reason to worry and start padding the byte size of hashes (if we start to worry more, we would pad the round count first before doing anything to the byte size).
Concrete TLDR, my own personal views:
* Hash-based > lattice-based, in those situations where hash-based is possible at all
* For anything lattice-based, be much more paranoid on param sizes. Remember that blockchains are only a small portion of the cryptography story; this point goes far beyond blockchains and applies to eg. access to websites, secure messaging, Tor / VPNs ...
* For privacy protocols, strongly favor NOT putting encrypted notes onchain. Instead, send them offchain through some third-party mechanism.
* If it's not difficult for you, keeping your funds in addresses which have not yet been used to make a transaction is a good idea. If it's easy for you, do it. **But be careful about migrations; I personally have lost more money in botched migrations than I have lost in all hacks combined**.
* For multisig wallets, doing confirmations offchain is better than onchain, because this way the signatures of signer wallets do not get exposed to the public, so if ECDSA falls to AI much faster than expected, at least the multisig "gracefully degrades" to a 1-of-1 where the 1 is whoever was gathering the signatures - a much better place to be than "anyone can take the money"
firefly.social/post/x/210783…
andylinee.eth retweeted
Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.
Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase).
Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets.
IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster).
Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot.
Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time?
Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.)
Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once.
Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case.
I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026).
Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS.
Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security.
The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.
andylinee.eth retweeted
Today the EF and OA announce zkAPI—a new means for private AI
Picture this: deposit ether into a vault, sign a zk proof, get a fixed amount of private inference. Advances like these help us move past middlemen's requirements that we link our data and identities.
Read more below
Quick updates on the Open Anonymity project (@OpenAnonProject)!
1. OA-chat is live! You can now signup: chat.openanonymity.ai
2. We collaborated with @ethereumfndn (@VitalikButerin, @DavideCrapis, @VittoStack, @curryrasul) to develop zkAPI, a new zero-knowledge protocol for accessing gated / paid APIs with unlinkability. It’s like a generalization of OA unlinkable inference that also abstracts payments away. Now also available on OA-chat!
I'm excited because more infrastructure should exist where privacy and sovereignty is foundational and people are in control.
andylinee.eth retweeted
Hood Summit Day 2 總結 🎯
主軸:AI 交易是關鍵,股票私募市場也將是重心 💰
HOOD Summit
1️⃣ 代理交易三層:Trading MCP 是外部 AI 接口。Legend 是進階交易台,第三方 Agent 可直接運作。Loops 能夠幫助用戶按條件重複下單,執行 24 小時的交易,尚未上線
2️⃣ 美區 Perps 走 Bitstamp 全球流動性池,未來數月才上。合規部分先上 Bitstamp,不代表撇除和 Lighter 未來在鏈上市場的合作關係,將低 $LIT 利空疑慮。
3️⃣ Robinhood chain 生態更多討論不在主舞台,而在 Vlad × Andy 的場外訪談
======
@therollupco Andy @andyyy 訪談重點
1. 鏈上量是口頭數字。過去幾天 Robinhood Chain 永續約 $10 億,DEX 現貨另約 $10 億。這是主舞台沒提及的
2. 開發者口徑。鏈上線約兩到三個月(主網 7/1 時上線),Vlad 稱當前 Robinhood Chain 為開發者活躍度第一,費用壓低。沒點名對手,也沒發路線圖
3. 代幣化規模,不是上架日。股票代幣現約 200 檔、目標數千,優先非美用戶。私募走 Robinhood Ventures 承銷、幫未上市公司規劃 IPO
持續關注 @robinhoodeco_zh 帶給你最完整的 Robinhood Chain 生態解析, 一起跟我們淘金!🎯💰
交流群 Telegram 連結:t.me/robinhood_chain_zh
andylinee.eth retweeted
Introducing PancakeSwap’s Pre-Access Portal
→ Tokenized, indirect exposure to private companies before they go public
→ Fully onchain, self-custodial
→ Accessible via @BinanceWallet
First project reveal coming soon 🍽️
More details: blog.pancakeswap.finance/art…
🤖 Made with AI
andylinee.eth retweeted
Introducing Pre-Access campaigns, hosted by @PancakeSwap. 🧵
Get indirect exposure to popular companies before they potentially go public.
Available through Binance Wallet.
First project revealed soon.
FAQ: binance.com/en/support/faq/d…
Keep reading 👇
andylinee.eth retweeted
Dividend benefits for Stock Tokens are getting an upgrade.
Dividend benefits are now applied automatically on the ex-dividend date instead of weeks later on payment day.
That means more immediate stock-equivalent economics from day one, no dividend dilution after the ex-date, and tighter pricing.
Already live across most Stock Tokens, with more to come 🔥
尽量减少在手机上做交易。
除了大家知道的“更容易随心所欲”以外,
还有个更关键问题:
屏幕小视野小,更容易执迷于当下。
以大家在手机上最常看的日K线为例,
日K线一屏的范围上限是3~6个月,
像盲人摸象,上下文严重不足,
像身在此山中,不知庐山真面目。
⬇️图中,
左边是BTC 2022年底,右边是2026现在。
如果不看右侧价格坐标轴上,
小数字20k和80k的区别,
看K线时几乎傻傻分不清。
如果一屏看不到足够的走势上下文,
缺乏“低有多低,高有多高”的参照,
就会导致思维被局限在当下的得失中:
“现在已经很低了”
“现在已经很高了”
是这种上下文不足情况下,最常见幻觉。
当然,你可以左右拖动、切换周期,
但伴随的是思路的反复断裂,
需要你拼接思维碎片,加剧忙乱,
这进一步缩小了你的注意力窗口。
即使是14寸笔记本电脑,
都能一屏内看到3~6年的日K线。
关键不是说“看得越多越好”,
而是让你:
“更不容易忘记究竟身处哪里”。
从这个角度上讲,iPhone Duo
可能是能帮你,少亏一点、Duo赚一点?
HOW TO TRACE STOLEN CRYPTO
Blockchain forensics is the practice of following funds across public ledgers until a wallet has a name attached.
Our research team wrote a guide on the methods investigators use, and how they were applied to the LuBian theft. Check it out below:
info.arkm.com/research/block…
andylinee.eth retweeted
Skill issue, don't route to bad hooks
We're happy to help teams struggling with this problem. Or they could waste their time on dumb posts... v4 hooks have unlocked huge amounts of innovation
visit developers.uniswap.org if you want an api that:
- has best prices on the markets
- avoids malicious hooks
- routes to all uniswap liquidity with no added fees
- crosschain swaps
- is now a full aggregator, integrating external liquidity with aggregator hooks
这篇文章特别有思考意义,发射台最终的竞争不止有代币模型,还有平等主义和文化归因。
如何理解呢?
Pump采取了Bounding Curve的创新发射机制,一开始给了散户很公平的参与机制,但稳居发射台头号宝座后,不发空投,回购不透明,规则说变就变等等,让其产生了巨大的信任危机。
最关键是,Bounding Curve只能保证开盘公平,但每天几千个流水盘开出来的时候,科学家,狙,老鼠仓等靠速度和信息差先散户一步获利,到最后成了,大家都能公平地来提供流动性而不是公平地分享利润。
事实上,这种机制只会无限放大PVP,让散户很难避免被收割;
Stonk没有特别高明的发射机制,它把发力点放在了非公平发射而是公平透明化“分润”这件事上,尽量全流通,生态手续费回流到平台币,即便持有生态内代币也能每天收到空投。
最关键是,相比其他平台上的项目拼速通流和拼手速,Stonk生态内一个个看着很Low但却捡回了熟悉的味道,平台可以有无数个一样的币低成本涌现,但谁能跑出来全靠社区自身养共识,比如,PURR Vs S3的共识之争就是典型。xitter.cf/tmel0211/status/209724…
而且目前Stonk生态还是非共识集聚地,大部分代币基本都在500k-1m的市值区间,即便是博弈,要付出的成本和代价要小很多。
总归而言,Stonk种下的是PVE的文化种子,即便有PVP也是散户和社区共识之间的低市值、更透明的化的P,且这个过程散户还能获得空投反哺,相比Pump式散户和不透明的暗庄斗法要“公平”太多。
其他的大家参考文章吧。
Pump fun, Stonk fun, the war between them, and why I think STONK is a better investment going forward.
If you're one of the ten people active in crypto right now, you've probably seen a lot of hullabaloo on the timeline about these platforms
A critical mass of people are coming out to denounce pump, and I want to explain what's going on, and I want to do so purely from an investment perspective, as someone that recently sold the last of his PUMP tokens for solana:6GmAFSYs4gk3FDao5FzzySQpPZaWsa4rUJHacpMpUNgx
I'm going to talk about:
- Why PUMP feels like ETH during ETH's 2024 underperformance
- The token model
- Cultural issues (strictly related to price premium)
- Solana's incentives for which platform succeeds
(None of this is financial advice, this is purely my own views, which may be in parts inaccurate or flawed, but represent my best understanding of things)
(Warning: Long post)
The comparison to ETH:
PUMP, the token, this past bear market reminds me a lot of Ethereum during the 2022-2023 bear market:
ETH had a massive mcap, and that was based on:
The assumption that it was, and *would remain* the only show in town, having defeated too many "ETH killer" alternative L1s to count (EOS, Tezos, etc). "This time isn't different" heavily favored ETH continuing its dominance, and after two cycles (nearly a decade) of trivially swatting away competitors, it justified its valuation.
The air was thick with assumption-based complacency around this. "Eth 2k -> 20k" became a meme, which was eventually replaced by "10k", then "frontrun 10k at 8k", followed by "6k is ok", followed by Eth, very disappointingly, barely sweeping its previous cycle highs.
Then Solana persisted its development, refinement, and app ecosystem, and exploded. It looked and felt amazing to use, and began the cycle new, cheap, and in public, and *CRITICALLY*, enabling people who believed early to enjoy all of its token's upside. Not only was it "this feels good to use, and makes sense to me", but also had organic community-based reinforcement via "I was allowed to get a big piece of the pie early, and will do well alongside the platform".
It seemed impossible, and its resurgence seemed fleeting, until it absolutely ate eth's lunch, moving up something like nearly 40x from the bottom.
PUMP is similar - it was early to the bonding curve (a novel and revolutionary product), it built a massive war chest, and it defended its moat aggressively, defeating numerous "alt token launch platforms" (Bonk, Moonshot, Jup, Bags, etc).
I think there's a similar sense of complacency around PUMP continuing to dominate the space, and that's slowly being shattered by RH chain + Pons, and Stonk Fun on Solana; both platforms finding runaway PMF, and *CRITICALLY*, bringing its users along for the ride with fair, public launches, for as cheap as you wanted it, as early as you found it. (I think both platforms do well, respectively, alongside each other, but that's another story).
The Token Model:
PUMP was so dominant and unrivaled that it could afford to, despite absolutely CRUSHING it on industry-leading fees and building a massive war chest (that persisted for many, many quarters in a row) do a public sale of tokens at a 4 billion dollar valuation to raise nearly a billion additional dollars. Many people argued "hey this isn't necessary", or "hey, you guys are sitting on a mountain of capital, why not do an airdrop? this is the opposite of that. do you really need to squeeze more money?
But because they had crushed all competition, there really was no alternative or "protest vote" platform to move to. And also because of that, the sale was a huge success.
The problem with this:
There are over a billion dollars locked up in a non-egalitarian, "previous-era" VC model, which creates pressure on supply. They do buy-back and burn with a substantial amount of fees in a way that's compelling, but these two forces are at odds. I believe the buybacks+burns are happening (it would be a massive scandal if they weren't), but PUMP's cultural issues and trust deficit (more on that later) had a lot of people believing even the stated buybacks were fugazi.
For solana:6GmAFSYs4gk3FDao5FzzySQpPZaWsa4rUJHacpMpUNgx and Stonk fun, they launched in the post-Hyperliquid era of Egalitarianism, where the idea is "our platform will do better if we let the public come along for the ride as early as possible. If we win, they win, and vice versa. Let's win together, and use the good will generated and success people feel to create a PR + adoption-adherence flywheel".
Stonk fun followed this, and said "Let's make 100% of supply available on day 1, for virtually free. And then rather than hoarding fees, let's use those fees to buy back and burn our token, and also buy the top ecosystem tokens, so holders of Stonk Fun launches also win."
This creates a recursive loop of "Buy something on Stonk Fun, fees go to buying back + burning the STONK token, and also the project you just bought goes up too. Other people see this happening, and they rush to (very happily) take part, and enjoy the sense of community that builds when there's a mechanistic PVE setup the rewards holding a few tokens, rather than rotating endlessly.
I, for example, kicked tires on STONK and bought some in late August for 18 million mcap, which is a comically deep value for a major platform. This is how egalitarian launches work, though - all tokens are circulating, rather than a company or group of VCs putting 5% of the float out (driving up the FDV to insane levels), and then slamming sells on your head with the 95% they reserved in a scrooge mcduck-style vault, for months-years. The token price oftentimes goes sideways, while mcap balloons -- basically a public ledger of how fucked over you got. This same phenomenon is what lead to memecoin populism in late 2023 - a rebellion again this sort of token launch, but that's another story.
Additionally, Stonk Fun not only offers virtually unrivaled access to RWA (stock) pairs, but reflection, or "yield" tokens as they're coming to be known, allow setups that, rather than seeing fees go straight to a company, reward long term holders with the right-side of a pair (like KNOTS/STONK, a memecoin that pays out stonk to holders). This further incentivizes PVE holding, and brings us back to a calmer, happier, more community-oriented era of memecoin trading.
Pump's launch today is a reactionary version of this, where they re-route the modest amount of "creator fees" that accrue to holders, which feels like a cynical bolt-on to try to claw back much of the attention and foothold it's lost, but mechansitically, doesn't come nearly close to what's happening (and the excitement around it) on Stonk Fun, or PONS for that matter.
Cultural Issues:
Pump fun has allegations of deceit/double-promises ("airdrop soon!"), dropping its buyback/burn fees without feedback or warning, bankrolling antisocial behavior (remember the bagworking 'disrupt sporting events' meta? the 'poor/desperate third worlders forehead tattoo' bounty product?), undisclosed paid partnerships and deals, and probably worst of all:
(allegedly) Directing large groups of insiders/associates to bully, intimidate, harass, and humiliate anyone that show dissent or disagreement with them on the timeline. To the point where people even I talk to directly have silently disagreed with Pump, or wanted to support another network, but have voiced a real and genuine fear of speaking out, pointing to examples of multi-month harassment campaigns directed at them. I don't have smoking gun proof that this is true, but these allegations are everywhere, and have persisted for a long time. This sort of fear-based information space tactic is straight out of the playbook of totalitarian societies, and is just awful. Even under a recent post of mine, a pump fun payrolee quietely told me that they were directed to delete their comment on my post.
Yikes.
I've looked past that, because I, as an investor (read: hypocritical pig) am in crypto to make money, and Pump generates massive fees, but *as an investor*, it's a concern because the above is a big part of the fact that their *token* has a price appreciation drag in the form of a *trust deficit*, rather than a *trust premium*, where a token trades at above what it'd normally be valued, based on the org behind it being proactive and egalitarian (see: hyperliquid/jeff)
I think we've reached a point lately, where enough people have seen Stonk Fun get to stock/memefi/yield token pairs early enough, and have enough fees/growth, and let people get as much of the pie as early as possible to enjoy the success,
That people aren't afraid to speak out anymore. And once there's a critical mass, the fear of reprisal diminishes, because Pump simply doesn't have the breadth or resources to target and attack that many people concurrently. Stonk fun vs Pump fun feels like onchain arab spring/star wars/berlin wall falling, metaphorically, in terms of what I'm seeing on the timeline.
Which leads me to the next point --
Solana's incentive for which platform succeeds:
Solana has done a lot over the past few years in terms of creating industry-best UX, speed, and scale. It's, in my mind (as a former Eth maxi), the best blank canvas we have for general purpose activity in crypto. But it has two principle complaints, both of which were/are valid:
1) Tokenomics (Inflation is bad)
This has been largely addressed + ameliorated with recent SIMDs, where disinflation was doubled, and more Sol gets burned
2) Culture Rot
Pump Fun's RUNAWAY past success as Sol's #1 fee-generating app put Solana in a position where they had no other choice but to hitch their wagon to PUMP. I empathize with that.
However, Sol's nascent success in RWAs and a half dozen other verticals has given them a hopeful path increasing optionality for fee diversification,
and now, Stonk Fun has come along and found real PMF in the form of a new/exciting set of primitives (and a massive userbase that gets to enjoy the upside of Stonk Fun's success as if they were all day-1 investors or employees at the company!), and a massive social moat via community/goodwill.
The mechanisms of the platform incentivize "buy and hold" PVE, rather than adrenaline-soaked PVP rotational jungle war. It's a fee-generating MONSTER, and those fees look sustainable. It provides SOL with AMM diversity, rather than the vertical integration at Pump.
And critically - stonk fun doing well directly addresses the "Trust Deficit" valuation drag on SOL (the token) that has spilled over from the cultural dominance/fee dominance of Pump Fun.
--
I've said enough here, but do need to say this - I don't "hate" pump fun. As a token holder, I've simply been disappointed and frustrated. The hope was always (and still is) that they'd just clean up their act a little bit, and they (and token holders) *and* solana could all win. But it just doesn't seem to be happening. If anything, the culture of cynical reactionary product/PR/comms seems to be getting slightly worse as they feel cornered. I'd like to see them do better, and go on to succeed, and compete on the merit of excellent product UX + liquidity, and genuinely wish them the best.
So no, I don't "hate" them, I don't really think about them, or anyone in crypto at all. Crypto to me is simply a lever to generate wealth. And because of all of the above, though this may change down the road, I'm shifting my investment over to to Stonk Fun for the foreseeable future.
Because Doug Funnie Said So,
Diaperliquid.
andylinee.eth retweeted
The @NotionalFinance attack repported by @SpecterAnalyst appears to be caused by an integer overflow.
The ERC1155 implementation allows minting a pair of positions (one long one short) when calling "safeTransferFrom" where from does not have enough position to be transferred.
The attacker minted 1 unit of position first: 1 long goes to a helper contract A and 1 short goes to the main contract.
Then mint another 2^128-1 uint of position: 2^128-1 short to main contract and 2^128-1 long to helper contract B.
These sum up to cause overflow in the main contract, allowing the attacker to end massive long position with no debt in helper contract B. It is then used as collateral to drain the tokens.
The attacker pocketed ~$1.7M in DAI and USDC and deposited to tornado cash.
An attacker drained 2.985B TAC (~$7.5M) from its bonded-token pool via the Cosmos EVM underflow bug that hit @MANTRA_Chain. @TacBuild halted four hours too late, funds already bridged out. @cosmoslabs_io had the bug since April but apparently misjudged its severity.
rekt.news/tac-rekt
過去一週有許多 Cosmos-like 區塊鏈都受到駭客攻擊,主因都是因為沒有及時更新 cosmos/evm 這個上游模組的漏洞修補。
Cosmos Labs 今天終於發佈了整起事件的 Post-Mortem 報告,攻擊主要來自於兩個漏洞:
🔍 漏洞 1: vesting account 餘額下溢(underflow)
- Cosmos EVM 的 StateDB 只追蹤「可花費餘額(spendable)」
- 但 vesting account 在 Cosmos SDK 中有「可花費 + 鎖定(locked)」兩種餘額
- 當 vesting account 通過 staking precompile 委託 超過可花費餘額(即委託鎖定部分)時,SubBalance 函數發生未檢查的下溢 → 餘額 wrap 到 ~2^256
🔍 漏洞 2: 餘額溢出(overflow)→ 盜取受害者資金
- 攻擊者用下溢的 ~2^256 代幣 轉帳給受害者地址(如 0x00 或 genesis 多簽錢包)
- 2^256 - balance(victim) 的溢出淨算後:攻擊者拿到受害者的全部餘額,受害者歸零
- 整個過程 net supply change = 0(供應量不變,但資產被轉移)
🔗單筆交易完成兩個漏洞:
1. 攻擊者預計算合約部署地址(deterministic)
2. 在該地址創建 vesting account
3. 部署惡意合約
4. 執行下溢(委託鎖定餘額)+ 溢出(轉給受害者)→ 一筆交易完成盜取
除了揭露漏洞細節,團隊也說明了為何 Patch 這麼慢的原因:
1. 誤判風險等級:首次回報(2026-04-25)的 PoC 只在 6-decimal 鏈上重現,Cosmos Labs 在 18-decimal 配置上無法重現 → 誤判為「不影響生產鏈」 → 走了 silent patch(公開修補)而非 private patch(私下分發)。
2. 未即時 backport:#1176 在 5 月就合併到 main,但因是 state-breaking(需協調升級),未立即 backport 到 release 分支 → 直到 8 月才 backport(#1253/#1254)。
3. 第三方公開 exploit path:Push Chain 的 fork(pushchain/push-chain-evm#40)在 8/20 07:16 公開了漏洞詳情 + exploit 路徑 → 比首次攻擊(19:06)早了 12 小時,直接降低了攻擊門檻。
Between August 20th and August 25th, attackers exploited a vulnerability in Cosmos EVM to extract funds from multiple Cosmos-based blockchains. We are committed to strengthening the systems and processes we rely on for security and are grateful for the collaboration of the affected teams and security researchers.
Post Mortem:
github.com/cosmos/security/b…




































