Building the best on-chain experience @ Jupiter Exchange. The menace behind 🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍🦍.sol
Jupiter
Joined June 2008
- Tweets574
- Following430
- Followers1.5K
- Likes1.6K
If you use TG bots to trade, back up your private keys!
@telegram helppp
How I lost my money using @telegram trading bots 🧵
1/5 I've been using trading bots like @pp_trading @bananagun @MaestroBots @TrojanOnSolana @bullx_io @ShurikenTrade just to name a few...
Just want to take a moment to thank every single @JupiterExchange user personally. Without any of you, I'll still be building software that few people uses and trust me, that gets old fast. Through your usage, you've helped me level up as an engineer, attempting to solve both UX and performance in the web3 space. Let's journey to greater heights together!
If you need to download CSVs of your @JupiterExchange DCAs and VAs for audit or tax purposes, check it out!
Big shout out to @callum_codes for building this amazing open sourced project that helps millions of users. If any of you are a frequent limit order user or swaps in general, feel free to contribute to this repo!
Jupalyse now includes trades for @JupiterExchange Value Averages (VAs)
Thanks to @defiracer for pointing me in the right direction!
Also made this UI a bit nicer :)
jupalyse.vercel.app
Josh X Jupiter retweeted
I've built Jupalyse - view all your @JupiterExchange DCAs + export a CSV your accountant probably won't hate
jupalyse.vercel.app
Open source: github.com/mcintyre94/Jupaly…
LMK if it's useful/any feedback! 🪐
We can, now, easily if a Solana program is upgradeable and if it's upgradeability is secured by a multisig or not
Thx @solscanofficial you guys are goated!
Shortly after I tweeted about this, the Solscan team reached out and they immediately started work on this. You guys are awesome!
How to know if a Solana Program is upgradeable and whether it's upgradeable by a private key or a multisig?
Whenever we interact with any dapps / protocols, swap, lend, borrow, trade etc+, there is always some levels of risk. Apart from code audits, we should also check that it's not easily upgradeable.
Using cold / hardware wallets does not protect us if we interacted with malicious program instructions and allowed blind signing.
@KaminoFinance is one protocol that I frequently use. Their program upgrade authority belongs to a multisig but how do we verify as a layuser?
Here is at least one or the only Kamino Finance program solscan.io/account/KLend2g3c…
1. Under overview, there is a "Upgrade Authority" field (see pic)
2. Click on the address
3. One of the early signs that it might be a multisig is by looking at "isOnCurve". If it says "false" then the address is a PDA (program derived address), which also means there is no corresponding private key associated to it
4. But... we can't be too sure that it belongs to a multisig, the address might still be just about any PDAs
5. We will need to look into the transactions done by the address. Here's one example: solscan.io/tx/HdLeRqDtfvinTx…
6. We can see from this transaction that it interacts with @multisig (a leading multisig solution on Solana)
7. This is a good sign that the program update authority belongs to a Squads multisig
8. Of course, to be 100% sure, you're gonna hv to read through the txn instructions to double check, just in case the txns are spoof-ed to interact w a multisig.
@solscanofficial @multisig Perhaps there is a way to surface this data more visibly on block explorers?
----
About Upgradeability
On EVM, smart contracts are not upgradeable by default, but most EVM devs who needs upgradeability use a proxy pattern to upgrade smart contracts.
Upgrading is a double edged sword. It is bad in the sense that its mutable. But it is also important in the sense that vulnerabilities can be patched by dev teams.
Solana programs by default are upgradeable and it can also be made not upgradeable.
How to know if a Solana Program is upgradeable and whether it's upgradeable by a private key or a multisig?
Whenever we interact with any dapps / protocols, swap, lend, borrow, trade etc+, there is always some levels of risk. Apart from code audits, we should also check that it's not easily upgradeable.
Using cold / hardware wallets does not protect us if we interacted with malicious program instructions and allowed blind signing.
@KaminoFinance is one protocol that I frequently use. Their program upgrade authority belongs to a multisig but how do we verify as a layuser?
Here is at least one or the only Kamino Finance program solscan.io/account/KLend2g3c…
1. Under overview, there is a "Upgrade Authority" field (see pic)
2. Click on the address
3. One of the early signs that it might be a multisig is by looking at "isOnCurve". If it says "false" then the address is a PDA (program derived address), which also means there is no corresponding private key associated to it
4. But... we can't be too sure that it belongs to a multisig, the address might still be just about any PDAs
5. We will need to look into the transactions done by the address. Here's one example: solscan.io/tx/HdLeRqDtfvinTx…
6. We can see from this transaction that it interacts with @multisig (a leading multisig solution on Solana)
7. This is a good sign that the program update authority belongs to a Squads multisig
8. Of course, to be 100% sure, you're gonna hv to read through the txn instructions to double check, just in case the txns are spoof-ed to interact w a multisig.
@solscanofficial @multisig Perhaps there is a way to surface this data more visibly on block explorers?
----
About Upgradeability
On EVM, smart contracts are not upgradeable by default, but most EVM devs who needs upgradeability use a proxy pattern to upgrade smart contracts.
Upgrading is a double edged sword. It is bad in the sense that its mutable. But it is also important in the sense that vulnerabilities can be patched by dev teams.
Solana programs by default are upgradeable and it can also be made not upgradeable.
Hey guys,
I am the engineer in charge of building Jupiter’s Value Average and Ape programs.
On September 13th, both Value Average and Ape programs were force closed by an unauthorized user who gained access to my private key used for program deployments. No user funds were compromised but the closing of these programs has rendered all functionalities related to the program inaccessible.
We immediately restored the functionality of the platform and all of user balances, and conducted a full security review. If you have missing tokens or questions, open a ticket in Discord.
This was isolated to Ape & VA, as they are newer programs which might require frequent updates. All other Jupiter programs are not affected and will not be affected by similar causes.
Before explaining the details of the incident, I want to say that I am deeply sorry for what has happened. I was entrusted by the team to rapidly fix all matters related to these programs and to move the program upgrade to a multisig, which I failed to do in a timely manner.
One of the main causes of this incident was due to the fact that both the Ape and VA programs were upgradeable by a single private key. Apart from these 2 newer programs, all other Jupiter programs require multi-signatures for any program upgrades.
To prevent similar incidents from happening in the future, all Jupiter programs, as soon as in use by users, would require multi-signatures for any program upgrades on top of going through multiple third-party professional audits.
If you have any questions / concerns, please reach out to us via Discord.
Once again, I am deeply sorry for this incident.
Josh X Jupiter retweeted
I saw a new feature added in June on @JupiterExchange and wanted to give it whirl to see what it was about.
I threw 1 SOL at it to understand what it does.
🚨 This maybe the most slept on tool Jupiter provides. 🚨
In less than 2 months I’m up almost 10%.
TP-ed for a nice ~+40% profit in slightly over a month 🥳
Had I bought all on the day I started this VA, I would have only made 5.5%. VA, semi passive degening ftw.
p.s. Immediately after TP-ing, restarted VA-ing into WIF again. Let's see if I was better off hodling. 😐
If we haven't hit the macro top, Value Average is going to turn out amazing.
Buy less as prices goes up, buys more if prices go down. Successfully dodge yesterday's scam pump.
edge.jup.ag/va
If we haven't hit the macro top, Value Average is going to turn out amazing.
Buy less as prices goes up, buys more if prices go down. Successfully dodge yesterday's scam pump.
edge.jup.ag/va
Josh X Jupiter retweeted
Sometimes it’s time to take a breather and celebrate, sometimes it’s time to buckle in and ship hard.
And now is the time for the latter.
Whether it’s small product features, big platform protocols, small ideas, big ideas, small bug fixes, big infra upgrades, small community initiatives, big community growth plans - we will ship these.
We will ship hard now, and we will not hope for anything that’s not in our control. We will emerge far stronger and better when we come out from the other side.
We always do, that’s the Jupiter way. 🐱
Josh X Jupiter retweeted
Despite the chain congestion, @JupiterExchange ‘s Value Average buys are still consistently landing over the past 2 days.
Team is constantly delivering value despite the worst conditions.
Josh X Jupiter retweeted
took me the whole day to deploy a program on solana.
sharing the steps here:
1. git clone github.com/solana-labs/solan…
2. git checkout v1.16.27
3. modify this from `5` to `100`: github.com/solana-labs/solan…, this will allow retries up to 100 times.
4. cargo run -p solana-cli program write-buffer
5. now just wait until it can fully write the program to the buffer account.
