Protocol engineering at @VelocityDEX. Opinions are my own.
San Diego
Joined May 2021
- Tweets19.3K
- Following2.4K
- Followers22.7K
- Likes62K
Pinned Tweet
While it's been an epic few years at Helium, I couldn't resist the call of another migration-level challenge. Those of you who know me know I can't resist chewing some glass.
As such, I am going to join @DriftProtocol team and help them relaunch. Why? Because I genuinely believe that Drift provides a valuable set of primitives to the ecosystem and is worth saving. This is also the best path to funding user recovery; we must build something so useful it can generate the revenue needed for the recovery pool. Tall order.
The landscape has shifted. Trust is eroded. Things that are worthwhile are rarely easy, and this is no exception. I fully acknowledge I could be applying for a job at Wendy’s in 6 months.
Everyone has forks in the road in their careers, easier paths vs harder paths. I have chosen the harder path at every turn; and it has paid off. Not every swing hits, but even in failure you massively level up your skillset.
My focus is on improving the security stance of Drift, getting it relaunched, then turning it into the best perps exchange in existence:
First, that means working with STRIDE to ensure we're following the best multisig and opsec practices. I won’t be taking this endeavor alone, the chads at @asymmetric_re and @osec_io have been incredibly helpful and continue to be deeply involved in auditing both new code and new operational practices. Security does not come from one individual, it comes from cultivating a culture of security and having outside professionals continuously verify that work.
Second, I am overhauling the codebase (within reason). Over the years it has picked up a large set of features, many of which no longer need to be used. The protocol has solid bones, but tight coupling has led to a buildup of tech debt that is easier to fix during this downtime.
Third, I want to build multiple levels of security and circuit breakers into the protocol. DeFi protocols must be structured to limit the ability of a single incident or contagion to create havoc. I will be thinking from the perspective of defense-in-depth; there should be layers of protection to prevent incidents like the April 1st hack. The program should reject suspicious changes even if they come from an operational multisig.
Lastly, and more long term, I want Drift to become the most compelling perps exchange on the market. I am very much looking forward to entering the arena that is perps on Solana. It is an honor to be competing with the chads on all the other teams (Phoenix, Bulk, Gm, Imperial, Pacifica, etc). Steel sharpens steel, and I eagerly await the firehose of knowledge over these next few months.
Solana needs as many shots on goal as it can get. One (or many) of us will win.
Reminder that if you have over $10m TVL it’s free to go through STRIDE. If you have over $10m TVL and you haven’t gone through STRIDE, that is wildly irresponsible.
Just do it. It’s so incredibly valuable.
Shoutout @asymmetric_re! We recently went through STRIDE at @ImperialPerps.
The changes we made as a result of the program have made the incidents of the last few days much less stressful!
The inevitable response to this take is condemnation from the culture, NFT, gaming etc crowd. But finance focus is not the nail in the coffin for “web3”
Finance is hard. It has more stringent requirements. When I worked in TradFi, we had to abandon most off-the-shelf software because it took bad trade offs on important considerations like latency and consistency. Great finance software can work for everything else. Great everything software will not work for finance.
Solana going laser focused on solving the hardest problem (finance) doesn’t mean you can’t use it for culture, gaming, etc. The best way to win is not to be everything to everyone. Creatives will always find ways to use tools beyond their intended scope.
When you have a hammer everything looks like a nail. But maybe we start by hitting the actual nails first.
Depending on who you talk to, our industry growing up is either doom or glory.
We are finally globally relevant and that necessarily means we are less insular.
Because this industry was created by the stubborn resolute and unwavering conviction of contrarians, misfits, and fringe actors, we relished in the pirate mindset. We loved our insularity. (Tbh, I miss it too at times).
The “web3” thesis where programmable blockchains are supposed to be decentralized computing infrastructure for many apps ultimately incinerated billions of dollars of venture capital because it led tech minded builders and their investors to prioritize app sovereignty over unified liquidity. This was wrong on first principles.
As it turns out, blockchain has and always will be financial infrastructure. Finance superpowered by tech and programmability. Decentralization, neutrality, and censorship resistance have never been more important.
Whether this excites you going forward depends on whether you’re more west coast or east coast; San Francisco or New York; more tech or finance minded.
From the west coast crowd, I often hear disappointment (“oh in the end blockchain is only about finance?! That’s it?”)
I couldn’t be more excited, and I think the mandate has never been more clear and also attainable.
Capital formation isn’t an abstract thing that bankers do when you are ready to IPO.
Capital formation enables innovation. It allows us to take big bets on the future. Liquid markets enable capital formation. Over the long term, there can not be a larger global capital market than the internet capital market. The biggest market to possibly unify is that of people on the internet who use money.
Like all things the internet has ever touched, the online/onchain experience is never the same as the pre internet experience. Just as we needed network engineers to imagine and build blockchain networks, we need consumer tech minds to complement finance minds to deliver new ways of accessing finance.
This is not and has never been a small vision for blockchain. In fact, I would argue that it’s a core intent of a “peer to peer electronic cash network.”
We welcome those who want to double down on finance for the internet to come join the Solana ecosystem and make good on this mission.
I think it’s fine and even great that the risk-on talent from blockchain is now expanding new frontiers away from blockchain. New frontiers are only ever explored by those with stubborn resolute unwavering conviction.
I've said it before and I'll keep saying it. Do not use Pinocchio. "I'm super smart, doesn't apply to me!" No, that's just hubris.
If you absolutely need low CUs, use Quasar or Anchor v2
Using Pinocchio is like building a car from scratch to get to the park across the street.
Marked safe from ever using such a trash language
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Most things that are old/unmaintained will get exploited as AI advances. Swallowed up by the rising tide.
This includes old smart contracts, even if immutable.
If you have funds in wound down protocols, or protocols where the team has gone quiet, you should withdraw.
Apparently there’s a patch for the critical PHP vulnerabilities but a few things that are alarming.
1) Many websites that use php with sensitive information are simply abandoned. There will be no upgrade. That means they’re going to get pwned and leaked. That’s a LOT of the internet
2) This requires active participants to upgrade their sites that even know about this vulnerability. If you’re on X you’re at the tip of the tip of the spear. Most people don’t know about this.
3) Anthropic says that this is ONE of SEVERAL critical vulnerabilities that they have found. Which means there’s more chaos coming.
TLDR: A large portion of the unmaintained internet is about to be pwned and god help us all or something like that.
Noah retweeted
How can he keep getting away with it
The best argument in favor of Solana is trying to use other blockchains.
Every time there's an exploit, I see so many stories of "I lost my life savings"
If you're reading this, stop. Take inventory.
Is 10% or more of your savings in any one protocol or storage mechanism? You need to diversify.
Same applies to tradfi. Don't put it all in one stock. One ETF. If you have money in a bank, make sure it's below the FDIC insured amount. What is your brokerage covered for?
Noah retweeted
Massive thanks to the Solana users, program devs, auditors, and core devs that read earlier versions of solanabook.org, provided invaluable feedback and sometimes tore it apart.
@r0bre, @alex_n_kahn, @callum_codes, @redacted_noah, @a_milz, @bw_solana, @pavankat, @DoctorBlocks, @CoryAbdalla, @deanmlittle, @therealchaseeb, Angus from @solana_SRI and a few people who aren't on X. 🫡
Any remaining errors are mine alone.
