Thomas (@Neotamandua) header
Thomas (@Neotamandua) profile picture

Head of Product @DuskFoundation | Software Engineer & Consultant working in Finance #Crypto #Web3 #RWA #FinTech #RegTech #Tokenization #Trading

Europe
Joined April 2024
Photo by Thomas (@Neotamandua)Photo by Thomas (@Neotamandua)
Today's PHP disclosure is by the way a good example of why we at Dusk have invested so much time in making continuous AI-assisted audits and reviews part of how we build. PHP patched two critical bugs, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a web server without logging in. One sits in how PHP cleans up after running out of memory. The other is state that survives from one request to the next after its memory has been freed. The oldest affected code goes back to PHP 5.4 in 2012. Calif and Wiz found them independently using AI. Calif did it with no special setup and only models anyone can access. PHP runs a huge part of the web and a lot of people have looked at its code over the years, yet these bugs sat there for over a decade. Getting the fixes right took the PHP team weeks. This won't be the last case like it. The same tools are available to attackers, and a lot of older code has never been looked at this deeply, as the speed at which AI can inspect, test and validate invariants is impossible for a human to match. It also matches what we see in our own stack. Most of what turns up is in code written before we had these tools, so that's where we've put the majority of our focus, going back through all of our older code. The fixes go out in our public repos, like the Phoenix release below. The tools only get you so far. Finding bugs is a numbers game in the end, and with enough compute you'll find something in almost any codebase. The hard part is understanding what you found and which invariants matter in the first place. Without that you end up with fixes that don't hold up. A bad fix is dangerous because it gives people a false sense of safety. Judging what's a real issue and fixing it properly still takes people who know what they're doing, especially when dealing with cryptography. That costs a lot of time, testing and compute upfront. Our bet is that it pays off in the long run though. CVEs for reference: github.com/php/php-src/secur… github.com/php/php-src/secur…
This Phoenix release comes out of a re-review of our whole cryptography stack, which we started months ago. With how much easier AI has made exploit hunting since, and the incidents we've all been seeing, I'm glad we did. A lot of effort, testing and compute went into it. We also rechecked the implementation against the protocol's formal proofs. It doesn't guarantee we're bug free, but we should be a lot safer than before.
5
11
2
48
2,411
Thomas retweeted
france is the leading country on the planet for crypto kidnappings and wrench attacks largely because their tax authority leaked the personal data of everyone now they want to increase by 50,000x the amount of data they collect and hence leak zero
128
127
15
1,869
108,268
Berlin zahlt nicht. Die Ransomware-Gruppe Rhysida fordert 30 Bitcoin vom Land - oder droht mit der Veröffentlichung von 5,8 Terabyte gestohlener Daten. Viele Schlagzeilen rücken Bitcoin in den Vordergrund. Das ist der falsche Fokus. Das eigentliche Problem: Wie konnten 46.500 Verträge, 80.000 Ordnungswidrigkeitsverfahren und Login-Daten überhaupt abfliessen? Bitcoin ist das Zahlungsmittel der Täter - nicht die Ursache des Angriffs. Und genau hier wird DAC8 zum Problem. Ab 2027 melden Krypto-Dienstleister Namen, Adressen, Steuer-IDs und detaillierte Transaktionsdaten an das Bundeszentralamt für Steuern - die dann grenzüberschreitend ausgetauscht werden. Für Kriminelle wäre das eine fertige Zielliste: Identität, Wohnort, Krypto-Aktivität - alles an einem Ort. Berlin zeigt, dass staatliche Systeme keine sicheren Datentresore sind. Je mehr sensible Daten gesammelt werden, desto grösser wird der Schaden wenn es jemanden trifft. Das Berliner Problem ist kein Bitcoin-Problem. Es ist ein Datenschutz-Problem. Quelle: Blocktrainer, 30.08.2026
34
71
9
607
33,674
Thomas retweeted
When the dust settles, we'll have to talk about the fact that not a single vulnerability was found by a US frontier model. Instead, we're spending $10k a day on open weights models like Kimi K3 and Qwen 3.8 to find vulnerabilities in Bitcoin infrastructure. It's a disaster.
116
426
87
3,097
206,822
Thomas retweeted
Institutions want rails they can trust. Users want products they actually enjoy using. @DuskFoundation and the SHIFT team sits together to discuss about what it takes to fix that. 📅 April 28, 3 PM UTC. Set your reminder: teapawt.net/i/spaces/1DGleEolykMJL…
96
37
153
12,664
Tokenized RWAs are under $1T today, but projected to reach $16T this decade. Join this RWA Megaspace on 24th April to upack: 🔹 Where tokenization stands today 🔸 How leading teams are building toward scale 40 speakers. 10 panels. One Space! RSVP 👇 teapawt.net/i/spaces/1DxLdverXrRxm
98
59
27
303
269,213
Thomas retweeted
We're excited to join @HouseofChimera's RWA Megaspace this Friday. 🗓️ April 24, 17:00 CET Our Head of Product @Neotamandua will be joining as a speaker. Set a reminder ↓
Tokenized RWAs are under $1T today, but projected to reach $16T this decade. Join this RWA Megaspace on 24th April to upack: 🔹 Where tokenization stands today 🔸 How leading teams are building toward scale 40 speakers. 10 panels. One Space! RSVP 👇 teapawt.net/i/spaces/1DxLdverXrRxm
6
18
66
2,983
Thomas retweeted
DUSK/USDC is now live on Uniswap V4. With USDT delisted from European exchanges under MiCA, EU users lost access to most USDT pairs. We've deployed a $300K DUSK/USDC pool on Ethereum, a MiCA-compliant trading route for DUSK. Access the pool here ↓
22
39
6
139
14,733
Thomas retweeted
Dusk Trade waitlist is now open. Our regulated RWA trading platform, built with NPEX, a licensed exchange with €300M AUM, bringing tokenized assets and funds on-chain. Sign up for a chance to win up to $500 in RWAs 👇
181
320
53
983
131,563
Thomas retweeted
Dusk is joining @binance for a Binance Square AMA. 📅 Jan 22, 2026 at 13:00 UTC 🎙️ @HeinDauven (CTO at Dusk) 🎁 4000 $DUSK in red packet rewards Set a reminder below👇
20
39
13
152
20,427
Private by default, accountable when required. $DUSK shielded transfers hide sender/amount from the public, while the receiver can still verify (and cryptographically prove!) who paid them. That missing piece makes privacy on Dusk much more travel‑rule‑friendly and compliant.
You deserve financial privacy. On Dusk, you can make fully private transfers that hide your personal data, yet remain verifiable for compliance when required. See it in action. 👇
8
60
6
188
40,080
ERC20-like tokens on $DUSK are now in draft. DRC20 is public and open for community contribution. Big thanks to builders helping shape the standard: @sozu_dusk @tminus_dusk @pieswap_dusk @neotamandua A shared baseline makes tokens easier to integrate (wallets, explorers, tooling), safer to implement and faster to ship without everyone reinventing the wheel. And with DuskEVM coming up, having a clear token standard matters even more for bridging between EVM <-> DS.
A DRC20 proposal is now public: a minimal fungible token reference for $DUSK @DuskFoundation. Built as a clean starting point for ecosystem tokens. We’re evolving it in the open with a collective of OSS builders on Dusk. RFCs, issues & PRs welcome: github.com/Dusk-Forge/drc20-…
11
27
1
116
8,589
This is what I worry Europe will get negatively polarized into: an ideology taking pride in a neat, sanitized online environment free of evil corporate and fascist pathogens. I hope European govs do not go this way, and instead take a Pirate Party approach of user empowerment. First, what's wrong with the tweet I'm quoting: The idea that there should be "no space" for something you dislike is fundamentally a totalitarian and anti-pluralistic impulse. It's incompatible with being in an environment that you do not fully control. This is especially true for categories that are subjective and controversial, because you end up trying to fully remove things you think are pathogens, when other people have good faith disagreements, and because you give yourself the maximalist goal of not even giving them breathing room, you create conflict and end up building the machinery of technocratic authoritarianism to impose your victory in the conflict. So sorry, if you want to be a free society, you have to bite the bullet that some people, somewhere, will be selling things that you consider dangerous and saying things you consider disinformation and vicious lies. What is the goal to shoot for? You want to create an environment where those things don't dominate. This is the problem with twitter today: not that it's a safe space where 1000 people talk to each other in a corner about how heritage americans are the master race and putin is good or whatever, but that that crap gets shoved in our face on a mass scale, and the algorithms actively favor it. The right metaphor is not castles and walls, but biological - think, why European forests don't have tropical lizards. Having incentives for social media platforms to have less of those things instead of more is fundamentally reasonable, @audreyt has talked about how Taiwan has done something similar. You also want to do this in a way where it's clear what the underlying principle is, so it's not a vehicle for imposing arbitrary and frequently changing expert-consensus agendas. You also want to empower users, rather than working against them. People want to see and buy good things instead of bad things. Often the problem is that competition is too difficult in the current market. I actually supported the USB-C standardization mandate; it created more interoperability and thus improved competition and convenience. I would support incentivizing social platforms to be more open, and to be more transparent (eg. my proposal to require algorithms to be continuously published with a 1-2 year delay, with zk-proofs to ensure that the algorithm being used in real time exactly equals the one that gets published later) Being able to better identify what messages are coming from what communities is also good, though I don't support the direction of banning anonymity of individual posters, rather I would want to see more macro-scale analytics, eg. seeing what communities are most strongly saying and amplifying content that semantically matches a particular idea; this can be done in privacy-preserving ways. There is a real opportunity to reaffirm freedom of speech in a unique and different way, that emphasizes pluralism and pushes against unbalanced attempts to manipulate the discourse by individual powerful actors. We want to do this, not go down the dark path of having something that claims to support fundamental rights but actually is not trusted by anyone to be anything other than the fundamental right to follow the footsteps of a few technocratic experts.
𝗡𝗢 space for cyberbullying. 𝗡𝗢 space for dangerous products. 𝗡𝗢 space for hate speech. 𝗡𝗢 space for scams. 𝗬𝗘𝗦. With the Digital Services Act, what is illegal offline remains illegal online. 🔗 link.europa.eu/gbRf9h
629
793
142
5,044
633,480
Our partnership with @chainlink is a key step in bringing regulated assets onchain, at scale, for everyone. Key takeaways: - We are adopting CCIP, Chainlink’s secure messaging and token-transfer standard that connects blockchains. - DataLink will deliver @NPEX onchain, vital as NPEX’s assets move onto DuskEVM. - Data Streams provide high-frequency, low-latency market data feeds designed for onchain trading. Want to go deeper? Our blog post explains everything 👇
22
35
5
140
9,842
DUSK x CHAINLINK We’re proud to partner with @chainlink to bring regulated securities and RWAs onchain, private, compliant, and programmable. The next era of financial markets starts here 🤝
Dusk (@duskfoundation) is adopting the Chainlink interoperability & data standards to enable compliant, cross-chain tokenized securities backed by real-world equities from NPEX, a fully regulated Dutch stock exchange with €200M+ in financing raised & 17.5K+ active investors. prnewswire.com/news-releases… Chainlink CCIP will serve as the canonical interoperability solution for tokenized NPEX assets, while also enabling the Dusk Network’s native token, DUSK, to be natively transferable across Ethereum and Solana via the Cross-Chain Token (CCT) standard. Chainlink DataLink will serve as the exclusive data oracle solution for bringing NPEX exchange data onchain and cross-chain. Dusk and NPEX will become official data publishers of regulated market data, and Chainlink Data Streams will deliver low-latency price updates for institutional-grade DeFi applications on Dusk. Together, this integration brings regulated securities, verified financial data, and cross-chain connectivity into a unified infrastructure, unlocking a new era of institutional capital markets onchain, powered by the Chainlink platform.
27
41
15
193
22,625