@chainlink Chromion grand winner | Featured by @CyfrinUpdraft | Built Yieldcoin with CRE & CCIP
Joined December 2024
- Tweets1.4K
- Following338
- Followers604
- Likes7.2K
Contract Level retweeted
Using hardware wallets, EDRs, multisigs, YubiKeys, etc. won’t prevent this.
The weakest link is between the chair and the screen.
‼️ $39,889 lost due to an address poisoning attack
The victim first sent a 115.14 $USDT test transfer
Phishing bot picked it up and mirrored it with a fake transaction for the exact same amount to a lookalike address
When the victim went to send the rest, they probably copied the address from their transaction history
Real address:
0x053DBA7292957341779cB0e9aae1AA7B139aDa3A
Fake address:
0x053dc459bade1baf76AEd6E8630823f8392FDA3A
The funds are already on a consolidation wallet and converted to $DAI
Contract Level retweeted
If your auditor finds critical vulnerabilities, your internal process failed. The audit didn't save you. It caught what should never have reached it. When your contract hits the auditor, they should find nothing. That is the proof your security actually works.
Contract Level retweeted
🏗️ Developer Update 🏗️
Chainlink Functions & Automation have officially upgraded from being stand-alone services to CRE workflows.
This consolidation supports a unified dev experience that reduces integration friction while strengthening the network's economics via reduced operating costs.
Leading protocols have already upgraded to CRE, including @aave, @Polymarket, @SkyEcosystem, and @opinionlabsxyz.
Contract Level retweeted
I’m a few years late to this discussion, but I’ve never liked thinking of reentrancy as a root cause. It's just a property of a path.
I prefer to consider only control flows, state changes, and permissions, then draw the attack graph.
Patterns are boundaries.
Contract Level retweeted
The goal was never to replace auditors. It's to stop wasting them. If automation catches the reentrancy and the missing access control before the audit starts, your auditors spend their time on the hard, novel problems only humans find. Automate the known. Reserve humans for the unknown.
Contract Level retweeted
Do not ship code you do not understand
The code wouldn't compile, so the Coldcard dev DISABLED THE HARDWARE RNG (Random Number Generation) to make the error go away. 🤯
"From here, I assume in a bout of frustration, he set `MICROPY_HW_ENABLE_RNG` to 0, which would have resolved the compiler error.
Sometimes when developers are flailing, they’ll try random things to see if it helps. Setting `MICROPY_HW_ENABLE_RNG to 0 would have made the compiler error go away ***for the wrong reason***."
"The compiler error was begging the programmer to reconsider his logic. Instead of that happening, the compiler error was just silenced. The compiler was giving the developer one last chance to reconsider what he was about to do, but the alarm was ignored and silenced.
Now everything is lining up. It looks like the developer tried to override the variable, but ran into conflicting definitions. When confronted with a “duplicate symbol” error, tried changing random things to get the code to run.
He discovered that changing `MICROPY_HW_ENABLE_RNG` to 0 made it compile. He probably had no idea why but came up with a theory."
"Simply put: the firmware change overwrites functions that aren’t used when creating a new wallet while, as a side effect of including the python method overrides, turns off the hardware RNG usage in every case, instead using a very weak random number generator.
The final bit of evidence is the commit message itself. It was simply the message “runs.”
Developers, if you are ever in this scenario, please stop. Whatever you’re getting paid is not worth the devastation you might potentially cause for others.
Do not ship code you do not understand."
insider.btcpp.dev/p/when-ran…
Contract Level retweeted
Yieldcoin v2 epoch net-withdraws successfully settled with CRE & CCIP on testnets.
CRE closed epoch with a net-withdraw amount, and set the parent state for that epoch to EXECUTING: sepolia.arbiscan.io/tx/0xd77…
CRE writes to remote strategy chain to withdraw the epoch's net-withdraw amount, and bridge it across CCIP:
sepolia.basescan.org/tx/0x35…
CCIP bridge msg received on Parent chain, setting the epoch's state to CLAIMABLE: sepolia.arbiscan.io/tx/0xdf2…
This is one of the happiest I've been with my work.
A few hours later, a few rebalances successfully executed. See the ParentVault events: sepolia.arbiscan.io/address/…
CRE updates the Parent rebalance state initially, then instructs CCIP to bridge TVL to the new optimal position. Once the destination chain rebalance into new strategy is a success, CRE writes to Parent again to finalize state and collect a management fee.
Some workflow-level attempts at initiating rebalance have been failing due to concurrent requests to the relay API. The DON makes multiple requests to DefiLlama API via our relay for the pools we are interested in, and sometimes this is too much for the relay, other times it works fine.
I have a good sense of what Yieldcoin v2's infrastructure operational costs will be. Legal will require fundraising.
Btw there's 3 pillars to the yieldcoin v2 crosschain state machine: rebalance, recovery & epoch
If Parent state is REBALANCING, an epoch will not close. If the previous epoch is EXECUTING, a rebalance will not initiate.
Recovery saves failed transition steps that were not intended to revert. If a recovery mode is active, standard protocol operations will not progress. Executing recovery is permissionless because the protocol already authorized the transition and no input is required because the failure was captured in state.
Contract Level retweeted
The art of security research is finding interesting ways in which systems violate the specs. A viable approach is primal-dual: you simultaneously look for parts of the system that are safe and study the suspicious ones until you either find a bug or convince yourself that the system is safe.
Contract Level retweeted
Looks like a real bug has been caught with @certora
For performance fees, hwm is the highest share price the system has ever settled at, and is used to make sure the fee is only charged on *new* gains
The problem was 2 roundings in opposite directions:
- fee share mint amount rounds up (in favour of protocol)
- settlement price rounds down
when the yield that triggers fee collection is tiny, the 2 roundings can push the settlement price a wei or two below the old hwm
The fix is to only update hwm state if the new settlement price is actually higher than the current hwm
Contract Level retweeted
look guys, it's actually pretty simple: on-chain governance is not a solution to a problem, it introduces another _failure mode_. full stop. if governance can approve arbitrary changes to mutable code, you're no longer trusting immutable code, you're trusting governance. no governance is best governance.
Contract Level retweeted
Four scenarios. Each requires its own playbook. Most protocols have zero.
@_SEAL_Org's Multisig Ops "Emergency Playbooks" control requires step-by-step playbooks for key compromise, lost access, communication channel compromise, and urgent protocol actions, each with defined procedures and escalation paths. And all of it accessible through a backup method that doesn't depend on your primary documentation platform.
The scenario coverage matters because each one has a different immediate priority. Key compromise requires rapid signer rotation. Lost access requires recovery procedures. Communication channel compromise requires switching channels while maintaining coordination. Urgent protocol actions require fast, authorized execution under pressure. A single generic playbook can't serve all four.
Self-check:
→ Does your protocol have a specific playbook for each of the four required scenarios?
→ Does each playbook include an escalation path, not just procedural steps?
→ Can every signer independently access the playbooks through a backup method right now?
One generic incident response document is not four scenario-specific playbooks.
Day 21 of 30.
Contract Level retweeted
Most devs optimize for shipping fast.
The best ones also optimize for not getting wrecked 3 months later.
Write extensive tests, think about failure modes and edge cases.
Security isn’t just an auditor’s job. It’s part of being a good developer.
Contract Level retweeted
Chainlink is the standard for asset management, which is why Yieldcoin v2, an automated asset manager, is built with CRE, ACE & CCIP. github.com/contractlevel/yie…