0xGene retweeted
$AXTI -30% AH, "It is not a name that you can just buy and hold without too much risk management"
I already exited $AXTI as it has many Asian HF players and can be rug-pulled easily. It’s not a name you can just buy and hold without too much risk management.
I might enter again if the price is reasonable, but will set a tight stop loss or trailing stop.
0xGene retweeted
We @VennBuild just discovered a critical backdoor on thousands of smart contracts leaving over $10,000,000 at risk for months
Along with the help of security researchers @dedaub @pcaversaccio, the seals team @seal_911 and others, we managed to rescue the majority of funds before the attacker could make their move.
This is the story of how a sophisticated attacker (cough Lazarus) put backdoors in thousands of contracts and ALMOST got away with it 🧵
0xGene retweeted
On April 17th the U.S. Trade Representative's office is expected to impose fees of up to $1.5M per port call for ships made in China and for $500k to $1M if the ocean carrier owns a single ship made in China or even has one on order from a Chinese shipyard. 🧵 1/
0xGene retweeted
1/ Longer form thoughts re Trump memecoin.
Its suggestive of a term that's short-term great for price / liquidity but long-term suboptimal for industry development.
My concern is on a mid-long term timeframe. Short-term I'm trading the shitters with you all.
Here's why.
0xGene retweeted
确实比较拗口，我来试着用人话翻译一下 @VitalikButerin 的发言。
首先，一开始，原帖就是这一个非常标准的【看好Crypto打败股权】的哥们儿的常见激进派观点。
字面翻译：
“科技界的每个人都低估了高效资本形成对构建未来的重要性，低估了 100 倍。
发明SAFE协议并使其能够通过一页协议出售股权，可能创造了超过 1000 亿美元的股权价值。还有数十个这样的解锁机会等待发现。”
原帖一句话概括：SAFE协议（代币认购合同）比股权牛逼多了。
论据是，股权写1000多页，SAFE只要1页纸就搞定了。
PS：题外话，其实SAFE一般大概20多页吧。
然后，Vitalik转发了一下说：
字面翻译：
“对我来说，这里真正重要的事情是创建能够持久激励开源、开放标准和安全性的资金结构，抑制围墙花园心态和掠夺性行为，并普遍促进成为对更广泛生态系统的正和参与者。”
人话翻译开始：
因为原帖观点太激进了，尽管V神是加密货币的支持者，但是想往回拉一点。
所以，他觉得：
加密货币融资的重点，不是SAFE协议多牛逼融资多快。
重点在于，融资的话得干点实事儿，例如：
-代码开源
-做一些行业标准等等
但是，如果加密融资是为了一些坏事，他反对，例如：
1.围墙花园心态（walled-garden mentality）
这个其实是互联网黑话，指的是互联网巨头，圈地垄断控制用户心智。
典型的，比如Meta，用户在facebook、whatsup和Instagram之间转来转去，以为看到了很多东西，孰不知都是小扎一家的。
加密圈的话，可能是暗示交易所巨头，比如交易所既搞CEX、还要搞web3钱包，还要搞自己的EVM链，搞meme，搞defi，搞AI Agent，总而言之让用户转来转去都逃不出交易所老板的手掌心。
所以我能理解为什么他反对围墙花园。
2.掠夺性心态（extractiveness）
【掠夺性心态】就是【割韭菜把韭菜根都刨没了】的文艺说法。
割韭菜不用我举例了吧，我们这个行业这种故事很多呀。
比如弄个AI加速的DAO组织，圈一堆AI Agent的加密KOL和机构人士、项目方创始人之类的...数不胜数。
最后，他认为这些都是“零和游戏”甚至“负和游戏”，大家应该玩点“正和游戏（positive-sum）”。
所谓【正和游戏】简单概括就是：干点实事，让生态更好，让用户更好，大家都赚钱，实现多方共赢
英译中+中译中，翻译完毕
希望帮助大家理解🤣
0xGene retweeted
Why USD0++'s Depeg was Imminent
I used to work on Morgan Stanley’s high-yield bond desk, so I’ve seen my fair share of distressed assets and quirky mechanisms. "High-yield" sounds fancy, but let’s call it what it is: trading the shittiest of shit bonds. Think defaults waiting to happen—the gutter trash of the credit world.
What’s happening with USD0++ feels like déjà vu. Let me clarify: I’m not saying it’s trash—it’s collateralized by very safe assets, but let's say there are definitely some high-yield elements at play, along with a whole lot of tranching.
As of writing, USD0++ is trading at $0.94, a 6% depeg from its supposed $1 peg on DEXes. Why? After the protocol's announcement of its “dual exit” option, hundreds of millions of USD0++ got dumped by DeFi traders, leaving its largest Curve pool wildly imbalanced.
What is USD0 / USD0++?
USD0 is a simple stablecoin. The real point of this entire game is to convert it to USD0++, the staked version. USD0++ is where the action happens because it earns you $USUAL tokens (we’ll get to those in a bit).
But here’s the kicker: Holding USD0++ locks you in for four years—a detail many DeFi farmers glossed over. In essence, USD0++ functions as a zero-coupon bond—you lock up your money and earn nothing until the end of the term.
If you expect 4% annually over four years, the fair value of USD0++ today should be around $0.855. This means you’d buy it at $0.855, hold it for four years, and redeem it at $1 for a risk-free 4% return.
Before today’s announcement, you could redeem USD0++ 1:1. Now, that’s all changing.
The Dual Exit Details for USD0++
Here’s how the new exit mechanisms work:
1. Conditional Exit: Redeem USD0++ at 1:1, but you forfeit part of your accrued yields. This “Early Unstaking” option launches next week - I'm guessing you'll need to burn $USUAL to exit.
2. Unconditional Exit: Redeem at a floor price, currently $0.87, which will gradually rise to $1 over four years. This option is for those who want to keep their upfront rewards.
For those still HODLing their USD0++
There's a trade-off:
1. Choose the speculative strategy by staking USD0 to USD0++ to farm USUAL tokens and chase those headline-grabbing 60% yields.
2. Choose the Base Interest Guarantee option by locking up USD0++ for four years to earn the “real” risk-free yield of 4% annually, payable only at the end.
But why lock up USD0++ for four years when you could buy liquid treasury-backed ETFs from BlackRock, exit anytime, with higher liquidity? DeFi users are farmers, and those shiny 60% yields are what they’re after. Option 1 was the only ‘real’ option—at least, until today’s announcement.
The key takeaway: USD0++ is now being recalibrated to reflect its true nature and value: a zero-coupon bond plus a $USUAL token emission mechanism. But there are more layers to this.
USUAL... USUALx... USUAL*
Right now, the protocol keeps all the revenue from treasury bills, while participants are left with what looks like an ever-emitting token.
There’s a fee-switch coming, though. Soon, 100% of the interest revenue from treasury bills will go to USUAL stakers, who will earn another token called USUALx (with a 10% fee for unstaking). It gets even more complicated: early investors receive a token called USUAL* (or USUAL Star), entitling them to 10% of all USUAL emissions and 33% of penalty fees.
Lots of Moving Pieces
Here’s how to read it:
1. USD0 Holders: surrendering your interest yield to use the stablecoin, effectively financing this game for the other counterparties—USD0++, USUAL holders, USUALx holders, and USUAL* holders.
2. USD0++ holders: surrendering your interest yield for 4 years, effectively financing this game by betting that $USUAL tokens emitted will be worth more than the interest yield.
3. USUAL / USUALx stakers: betting on the USUAL token to rise / capturing the interest yield surrendered by USD0 and USD0++ holders.
4. USUAL* holders: get 10% of all $USUAL emissions, as well as 33% of penalty fees, receiving a percentage of the value chain.
Just my two gweis, and as always, DYOR
0xGene retweeted
终于写完了 Uniswap V4 的全文，虽然核心 AMM 机制与 Uniswap V3 一致，但文章和 Uniswap V3 一样长。估计未来的 DeFi 协议都会标配 ERC6909 / ERC7751 / Flash Accounting / Hook。
特别感谢 @jeffishjeff 与我的讨论使得本文内容更加准确。
0xGene retweeted
Today, Bitcoin’s market cap has exceeded $1.3T. Yet, it's still limited by its lack of native asset solutions.
Introducing FBTC, a fresh Bitcoin asset designed to liberate the growth power of BTC, supported by @0xMantle and @AntalphaGlobal.
Read how 👇
0xGene retweeted
1/ Finished a preliminary deep dive into the Kyber exploit, and think I now have a pretty good understanding of what happened.
This is easily the most complex and carefully engineered smart contract exploit I've ever seen...
0xGene retweeted
If you are curious about the market impact on Binance.
Here are some real-time analytics you can find from our team @21co__ on @DuneAnalytics
- Binance's outflows in the last 24 hours: $2.2 billion
- Total assets: $58.1B
- $10.8B in stablecoins
- #Bitcoin is their largest holding amounting to $19.2B or 32% of their total assets. The second largest is #Ethereum with $9.6B
0xGene retweeted
If you've ever watched an episode of Mayday / Air Crash Investigation, you know that pilots have checklists for almost any emergency situation. These checklists are concise and immediately actionable with no filler, which is exactly what you want during a crisis.
0xGene retweeted
Account Abstraction is a big and trendy movement now which indicates Web3's dedication to achieve a non-custodial solution to govern users assets on the internet w/o sacrificing the user experience. Interestingly enough, similar to Web3 trying to get rid of the 12 mnemonic words, Web 2 is also pushing to get rid of the password. Is there a point where these two worlds can intercept ? let’s dive in!
The original phrase for users to obtain security on the internet is the password. There are the Cookies-based workflow and JWT-Based workflow to validate users passwords in the server and then send back Session ID or JWT token back to the client, allowing them to login the account.
The password authentication for accounts is putting so much responsibility on users, the most recommended way is to use combinations of letters, numbers and marks, each corresponding to only one platform and also remind yourself to change it every month. Commonly people use password management tools like Onepassword to manage different accounts, however, the server problems are also outside users’ scope. Whether the platform has hashed the passwords and whether they have maintained secure server configs.
To ease the pain of password management, OpenID and OAuth were made to enable users to use 3rd party identity providers for account authentication. Therefore now when we browse platforms and websites we can also choose to login in with google account or facebook account. @worldnetwork supports both OpenID and OAuth, so that maybe in the future we can login to accounts with our worldID. The downside of the Single-sign-on is now my google account is way too important because it indirectly holds all of my other accounts.
What’s for another security layer? Multi-Factor Authentication, that could be your secondary email address, phone number, authenticator and touchID and Face ID. This method is very effective to really authenticate the identity, especially with biometric authentication.
Apple is definitely a pioneer in biometric authentication since not only it started to introduce touchID on Iphone 5, it has also stored users’ biometric data in a subsystem called Secure Enclave.
1/Secure Enclave includes Secure Element, which is a specially designed chip to provide an isolated and secure environment to compute and store data. It is designed to protect users from side-channel attacks, Power Analysis attacks, Cold Boot attacks and Fault attacks. If someone get hold of your secure element based device, it is extremely hard to brute force and steal what’s stored inside.
Use case for Secure Element, hardware wallet,yubikey, Intel SGX, which often used to store keyshare by MPC providers , etc.,
2/ Secure Enclave has its own operating system, called SepOS, which is strictly separated from the main operating system(iOS). However, it is close sourced, so we don’t know how exactly it works.
3/ When storing sensitive data like faceID or TouchID, Secure Enclave generates key pairs and uses those in encryption/decryption of sensitive data. It natively support secp256r1 curve signature, which is very similar to Ethereum’s secp256k1 curve.
4/ The simplified mechanism for how it works goes like:
iOS: “ I need you to check something for me.”
SE: “ okay.”
iOS: “ Does this match the device owner’s face?”
SE: “Yes it does.”
Secure Enclave is generally good, there are still risks associated with supply chain attack and close source firmware. Imagine if Secure Enclave is mainly used to govern people’s assets,then there are gonna be attacks. After All there is no immunity in security, the security exists when the attacking cost is worth more than the stolen goods.
WebAuthn API is a specification written by W3C and FIDO, it is connecting the Secure Element devices and servers to achieve a passwordless environment. The most extraordinary technique that it uses comes as no surprise to us, the Public key Cryptography.
Remember that Secure Enclave will generate key pairs for our biometric data, it could be used more than just unlocking your device. Now you can store the public key on the platform's server with WebAuthn and log-in to your account with your Touch ID or Face ID. For the first time on the internet, users can physically authenticate their identity. Furthermore, b/c it is the public key that was stored on the server, it really prevents leaks of credentials from server attack and improper configs,
This year, Apple also launched Passkey, which enables universal login across platforms and devices. it utilizes the following
1/ Secure Enclave securing faceID and TouchID
2/ iCloud Keychain storing public key credentials
3/ Backended with WebAuthn to coordinate keypair creation and authentication between the hardware and the server
However personally, I‘m slightly concerned about passkey, for its reliance on iCloud Keychain. Secure Enclave is straightforward and hardware bounded, which means if someone stole your device, the data stored inside is lost forever, however not stolen. For passkey, please make sure there isn’t any recovery method to allow the private key to be uploaded to iCloud Keychain.
@opclave@BananaHQio are utilizing Secure Enclave or Passkey to achieve Account Abstraction. Needless to say I think they did achieve a way better user experience w/o sacrificing the level of security(Amazing!!!). Ultimately this method is also powerful to onboarding more users as it leverages the mobile market, imagine one day we can use native mobile Dapp on our phone with a built-in noncustodial wallet which the security is not governed by chrome, but by secure enclave.
But.. currently there’s still some potential problems (i could be overthinking tho)
1/ Both secure enclave and passkey only natively support secp256r1 curve signature, It will be costly to verify signatures using smart contracts on Ethereum. @opclave are pushing for a secp256r1 curve signature precompile to lower the cost (pls support!). Currently a native AA enabled L2 is more friendly to adopt the solution;
2/ Apple has a hard rule with 30% of revenue sharing for any apps on the Apple store. That’s a very realistic bottleneck for web3 mobile dapp from thriving;
3/ Supply chain attack when huge onboarding has been achieved? SepOS being closed sourced?
Finally, I am glad to see that the internet industry in general is improving the security for users. It is fundamental b/c it determines what kind of ecosystem is going to be built on top of it.e.g. I put my life-worth and passport only inside a bank vault. Both AA world and passkey world are making the internet more secure and most significantly enabling users to migrate more valuable things to the internet. Maybe one day to push users to move their assets in the bank to cryptocurrency, which is the assets they can truly own. HOWEVER, SECURITY FIRST!!!!
0xGene retweeted
The lockup assets on the Multichain MPC address have been moved to an unknown address abnormally.
The team is not sure what happened and is currently investigating.
It is recommended that all users suspend the use of Multichain services and revoke all contract approvals related to Multichain.
0xGene retweeted
in law/policy debates, what I really struggle with these days is justifying special (lighter) rules/regs for DeFi/smart contracts when the best narratives have been eroded by years of teams, communities and users not caring about trust minimization and at times willfully advocating for more trustful solutions in order to maximize financial returns
smart contracts were portrayed to regulators, legislators & policymakers as immutable, always-available, permissionlessly creatable and accessible 'public goods', b/c this is indeed how they initially were on Ethereum 1, but this is no longer the case for I would guess a majority of smart contract apps with real users
now we have:
-->widespread multisig-managed proxy upgradeability on ethereum
-->many chains with smart contracts that are mutable-by-default (no need for a proxy upgrade pattern) (Cosmos/Tendermint chains, Solana, etc.)
-->rollups that are centrally controlled (with some checks/balances to prevent outright theft, but yes still centrally controlled)
-->gen 2 L1s with state rent & other features that ensure there always needs to be a team invested in keeping that smart contract available (Solana)
-->many chains that require permission to deploy a smart contract on them (app-chains)
-->smart contracts that may be immutable on one chain (eg Ethereum) but are necessarily mutable/multisig-controlled on all other chains/rollups, b/c the 'governance hub' can only be on one chain & chains/rollups are bad at talking to each other
-->many teams use pure rights reservation (no license), BSL or even completely black-box code so that competing or replacement deployments are not possible without their permission, and in the latter case (black box code) users do not even know what code they are entrusting their assets to (Curve (no license), Uniswap (BSL), Kujira (black box code))
-->on solana, the situation can be especially bad, as every token is a subcontract of a contract deployed by a certain team (rather than just being an interface 'standard'), and that contract can be both proprietary and black box...if I understand correctly, Metaplex team can rug every NFT on solana ...
-->even for immutable smart contracts with DAO governance, there is often a multisig that has 'veto authority' over governance (Aave, NounsDAO, etc.)
there can still be forms of trust reduction etc. in all of this (the idea of an FTX in smart contract form is much more trust-reduced than the real FTX-a fully black-box custodial platform)
and certain combinations of facts (eg, copyright reserved code but the smart contracts are immutable and guaranteed available) are less pernicious than others
but the bottom line is that the tradeoffs are much more subtle compared to the story typically given to regulators, policymakers and legislators and, worse, "blockchain/crypto/DeFi" is viewed as one space to regulate all together but can strike dramatically different trust / policy tradeoffs within it
it is going to be very tough to get good legal outcomes for the industry if things keep going like this...we will indeed turn into CeDeFi and devs & other ecosystem players indeed will be fiduciaries as @angela_walch predicted...
