waseem retweeted
One of the funnier engineering stories involving Wrath:
Back in late 2021, we were starting to lose dominance on Shopify, as the flows were more or less the same across top bots. The flow looked something like this (quite similar to how a human interacted with a site; great job @jmwind)
Add to cart (0.5s) -> Load checkout (1s) -> Calculating taxes (1s) -> Submit payment (1s)
Given this, there weren't many places to optimize. We realized we could skip the "Calculating taxes" stage by sending an empty total price when placing order (forcing Shopify to do the calculation themselves), and this was an optimization we used for a bit.
In the Shopify REST API described in @offline 's tweet, there was also an endpoint that allowed you to combine the "Add to cart" and "Load checkout" stages, into one "Update checkout" stage that took ~0.5s, shaving an additional 1s off the checkout time.
Excitedly, we decided to run beta builds with this new flow:
Update checkout (0.5s) -> Submit payment (1s)
However, every single task got blocked by bot protection. Unconfirmed, but I suspect that Shopify tracked antibot violations as a heuristic score (i.e. because we did 2 "suspicious" actions, updating the checkout via an API a human wouldn't usually hit, and omitting the total price, they blocked us).
Seeing this, we decided to look for other ways to optimize. Ultimately, the total price is something that should be relatively predictable given the price of the item/shipping rate & the user's billing address. We hacked together a function to predict it, and this evaded antibot while retaining the skipped "Calculating taxes" stage. (screenshot below - we had to handle edge cases for certain states that are tax exempt up to a threshold, etc.)
We launched this to users and saw major success. However, I happened to be from Michigan, and I would always test with a flat 6% tax rate. This would make shoe amounts come out relatively cleanly (e.g. 190 * 1.06 = $201.40, so no rounding was needed).
Unfortunately, NYC has a tax rate of 8.875%, meaning that 190 * 1.08875 = $206.8625. No matter how long we tried, we couldn't figure out a deterministic direction Shopify's internal API would round (sometimes this would come out to $206.86, sometimes $206.87)...
We didn't really have a solution to this so we ultimately accepted that you'd have a lower chance of buying a shoe depending on if your local sales tax rate was more digits. I'm sorry 😂
Probably the hackiest "bypasses" I've ever pulled off in botting:
The Shopify REST API was for a long time the best and fastest way to checkout on Shopify. High rate limits, no captchas, no checkpoint and easy to work with. This is what gave Cyber the edge at the very start in 2018 (Dashe days)
The Shopify team (with @jmwind at the helm) spent years plugging the holes to make sure it wasn't used during drops.
Around 2020, Shopify released Shopify Pay, which allowed you to expedite checkouts on all stores by linking your details to a phone number. Turned out the payment tokens generated through there allowed you to use the payments API as you could 2 years back.
We generated around 3k Shop Pay accounts with randomised details, load balanced them across Cyber tasks (as rate limits were per account) and dominated every single release (...until it got patched).
We called it Fast2.
3 years later I noticed that the payments API could still be used with Shopify mobile apps using Apple Pay. Turns out you could still send the users' tokenised credit card data in the request and that would take precedence - and as long as a valid signed Apple Pay token generated in the last 2 minutes was also in the request data, the payment request would go through and bypass captcha and checkpoint.
Generating those Apple Pay tokens was the challenge, and reversing iOS frameworks was not an option. So I repurposed an old iPhone with a custom sideloaded Apple Pay app that would submit the token to our servers when the flow completed. And by combining accessibility macros, developer sandbox mode to prevent using real credit cards, a voice activation trigger and a old pair of earphones taped onto the microphone - a makeshift Apple Pay token server was born and Fast2 (or was it Fast3?) was back.
@jmwind thank you for providing me with the longest, most multi faceted puzzle ever.
waseem retweeted
if you're ex-sneaker twitter / want to build out of our office pull thru tonight! free coffee & wrath keys will be provided ..
(p.s. @skvrah from nyte is giving free autographs)
waseem retweeted
People ask what it's actually like inside @slashapp. Easiest answer is just come see for yourself
Sunday night, we're turning the office into a late night build session, open to anyone who wants to ship something fun
Only rules are no work, no homework, just the project you've been sitting on. And good coffee and good people included
Come build with us 👇
waseem retweeted
We built action center because it was something we genuinely thought could improve function even for us at Slash. Excited for people to start using this product. Here's me demoing it!
waseem retweeted
we’ve gotten here with just a 15-person engineering team. we’re growing at terminal velocity; if you’re looking for an extremely high ownership + mobility opportunity, dm me! (bonus points if you’ve started a company that’s made $$ / came from sneakers 😉)
We (@slashapp) raised a $100M Series C at $1.4 billion valuation to build the world's most powerful business banking platform.¹
The round was led by @RibbitCapital, and co-led by @khoslaventures & @GoodwaterCap.
And we're releasing Twin: the world’s first AI private banker.
I was the first engineer at @slashapp.
When I joined, it was banking for sneaker resellers.
Then ~80% of revenue disappeared almost overnight.
Most startups die there.
Today Slash is announcing Series C.
Since that pivot: $2M -> $250M ARR in 24 months, $4B processed in 2025.
We (@slashapp) raised a $100M Series C at $1.4 billion valuation to build the world's most powerful business banking platform.¹
The round was led by @RibbitCapital, and co-led by @khoslaventures & @GoodwaterCap.
And we're releasing Twin: the world’s first AI private banker.
waseem retweeted
Excited to share some things I've been working on recently at @slashapp:
Crypto payments on Slash, now extended to invoices.
Pick a chain, pay from your wallet, and the invoice settles instantly.
If you're already using Slash for crypto, invoicing works the same way, and I'm excited for you all to try it!
waseem retweeted
Your finance dashboard is now a prompt.
Query your Slash account from an agent:
• analyze spend
• investigate transactions
• generate reports
Connect via MCP (e.g. ChatGPT) and let your finance agent do the work.
waseem retweeted
Prompt injection shouldn’t be able to steal your credit card.
Our MCP (docs.slash.com/docs/mcp) uses RSA encryption so agents never see raw card details - only tokenized card # + CVV.
To prove it works we bought muffins from a Shopify store with it.
Open source ↓
github.com/jason-slash/shopi…
our internal agent now handles instacart orders end-to-end
we used the new @slashapp mcp server to create one-time-use cards with the correct merchant/utilization limits, which we approve via slack
waseem retweeted
our agentic dashboard builder went live last week and 76 dashboards have already been built. it has fully democratized our data work and no one logs into retool anymore.
(shoutout @waseem0x for building out a custom TV control plane over the weekend to control them via agents)
