0x20Jerry

互粉

[0x20Jerry @0x20Jerry]

No way!

[Donald J. Trump @realDonaldTrump]

My NEW Official Trump Meme is HERE! It’s time to celebrate everything we stand for: WINNING! Join my very special Trump Community. GET YOUR $TRUMP NOW. Go to https://t.co/GX3ZxT5xyq — Have Fun!

[0xAA @0xAA_Science]

不要安装这个solidity vscode插件，适合盗钱包的木马！
170万下载和5⭐好评是刷的，专黑开发者，太可怕了兄弟们！

[Pacman | Blur + Blast @PacmanBlur]

building anything significant typically takes a lot of time. this creates a challenge in the crypto market which is fast paced and impatient (it's also what makes it fun). the market is global and highly competitive, so it doesn't make sense to talk too much until you're closer to launch.

navigating challenges like this are just one of the aspects that make building in crypto interesting, at a meta level.

i don't think there's any easy solution — at the end of the day you just need to focus and ship, but i'm grateful for the opportunity to continue building for the best market in the world

[Cos(余弦)😶‍🌫️ @evilcos]

这事有点复杂了，大量的假充值测试，黑白帽就是一念之间的事，资产边界没处理清楚很容易被定义为黑帽，如一位搞安全的朋友所说，这如果在国内，网络安全法定义清晰，执法就可以立即行动了。

[Austin Griffith @austingriffith]

👋 hey if you are sending around links to etherscan for people to interact with a contract, you should really try 🥷 https://t.co/i3ozhi9PpQ instead (it's just better UX and you have more control of what gets displayed using the link)

[Cos(余弦)😶‍🌫️ @evilcos]

广而告之，这个开源 bot 有偷私钥后门代码，如果你不熟悉代码，看到花里胡哨的代码（“乱码”）就需要警惕了，可能偷偷藏了什么猫腻。Crypto 都讲究开源，开源了，巴不得提供高可读性代码，谁还整这些花里胡哨的代码🤣

另外，作者似乎删除了后门文件。有下载使用这个 bot 的玩家可以联系。

[Cards Ahoy! 💥 @cardsahoygame]

Ahoy!💥🚀

Get ready for the much-anticipated Arena gameplay, launching at UTC Apr 3rd 0:00!

1 Ahoy box for 20: RT+like+drop your game ID

What is Arena?
❗️Min prize 1000,000 $CAC
❗️Not related to cards only related to minds
❗️least-cost 👉 big surprise

How to play? ⬇️
https://t.co/gMPagZ7zMB

Briefly:
1️⃣ Purchase Arena Tickets with $CAC (standard 400 $CAC , advanced 4000 $CAC)
2️⃣ Build your deck in 5 rounds of card selection, show your strategy with the cards in same level & random rarity (Fair enough?)
3️⃣ Earn rewards based on your win count up to 12 wins, (additional bonuses based on your arena leaderboard ranking!)

The more players, the bigger the prize pool, more than that:
1️⃣Every 5 matches give you a Treasury clue for a prize draw. Each period, 6 lucky winners split a massive 1,000,000 $CAC jackpot!
2️⃣ Lots of $CAC, Battle shells, Arena points, and Alchemy cards for leaderboard rewards, the top three players also get extra Mythic Box Fragments!

Feeling the thrill? Join us in the Arena tomorrow and find out who's the true champion!
#CardsAhoyOpenBeta

[Folius Ventures @FoliusVentures]

基于语言隔阂，文化差异，及赛道萌芽等因素，西方用户及投资人对于亚太深耕Web3的初创消费公司所知甚少。我们为此特意整理了一份观察分享，以飨读者。特别感谢@Chrislulu816和@KD2Moon共同撰写此文。
Folius Web3中国开发报告 (消费者应用专题)：
中文：https://t.co/x8mzceFmOr
英文：https://t.co/UjIKPgWYaD

2023年是Folius 一级市场投资最繁忙的一年（特别是第二和第四季度），通过每周���析 25-50个项目（绝大多数由华人创始团队领衔）。我们发现了一些西方���角或许难以捕捉的规律和范式。 我们愈发坚信，普世应用即将伴随华人开发者红利、迎来其春暖花开时刻。具体而言：

1/ 1500-2000万的中国互联网精英群体正成为Web3领域华人创业者的强大后盾，有望在未来3年内以每周1-2个顶尖团队的速度，投身于Web3创业大潮。
2/ 与中国Web2的限制性环境形成鲜明对比，Web3的迅猛发展成为推动这批人才跨界探索的强大动力。现在的 Web3正如过去90年代的A股、00年代的H股，以及10年代的纳斯达克。
3/ 我们认为Web3基础设施已经足够成熟，交易成本、上手门槛、开发和模块化解决方案以及经济模型设计都有了显著改善，未来12至18个月内可能会出现一些影响深远的应用。
4/ 我们细数了华人创业者的特质和偏好，总结出7类优势和7类挑战。
5/ 我们还深入研究了最适合这群创新者的业务类型——即具有可观DAU潜力的2C产品（主要是内容、平台和创作者中心），我们的投资组合展示了创新者如何实现潜力@GasHeroOfficial、@Stepnofficial、@Matr1xOfficial、@MetaCeneGame、@SleeplessAI_Lab、@0xMJM、@myshell_ai、@Memeland、@Ryzz_tv、@sparklefun2023、@JamboTechnology、@0xSpotlight。
6/ 我们未能一一列举所有卓越的 infra 项目（如@Scroll_ZKP、@_kaitoai、@ChainbaseHQ、@DeBankDeFi、@megaeth等），他们的创新同样不应被忽视。鉴于我们的篇幅限制，我们目前只能���盖2C领域。
7/ 对于亚太地区的潜在创业者和世界各地的早期投资者，我们希望本报告对于行业、同行、及自身的了解有所加深。值得一提的是，Folius致力于支持尤其是亚太地区的创始人——而如果你正在打造令人兴奋的产品，或者有着颠覆性的创意，别犹豫，请立刻联系我们！

[vitalik.eth @VitalikButerin]

Make Ethereum cypherpunk again

https://t.co/qEiOcZLEeg

[BlockBeats｜We're hiring! @BlockBeatsAsia]

新的教程出炉🔖

最近去中心化Ordinals索引服务Trac也开始支持Dogecoin，使得Dogecoin网络得以扩展其功能，包括支持DRC-20代币铸造。DRC-20铸造费用远低于比特币网络，这吸引了众多用户的参与。

小编带你走一遍如何手搓DRC20铭文。注意：这不是投资建议，DYOR

https://t.co/FHzGYWWlXg

[OpenZeppelin @OpenZeppelin]

The OpenZeppelin ZKP team found an interesting critical vulnerability during an audit of @LineaBuild’s PLONK verifier.

A malicious prover could have stolen assets in the rollup by proving an invalid state transition. This was due to an incorrect application of the Fiat-Shamir transformation when computing the final PLONK challenge. Called the ‘Last Challenge’ attack, we think it is worth sharing more broadly so that others can learn from these patterns 🎅

Learn more on the Fiat-Shamir transformation, what makes it a common source of vulnerabilities, and how to protect zk systems against these in our writeup, all accompanied by our intern’s amazing animations:

https://t.co/VhFlg3yjgs

[OpenZeppelin @OpenZeppelin]

🚨 Important Security Alert to the Community 🚨

We are publicly disclosing a critical vulnerability arising from a problematic integration of the standard ERC-2771 and self delegatecall with user input data, including but not limited to multicall. This issue poses a significant risk of address spoofing attacks for projects combining these patterns.

This issue is caused by a problematic integration pattern, and is not particular to the implementations contained in the OpenZeppelin Contracts library.

Nonetheless, our team has been diligently working together with the whitehat community to identify and notify potentially vulnerable projects. We are committed to keeping the ecosystem safe and informed.

For an in-depth analysis and actionable steps to secure your contracts, please read our comprehensive public disclosure on our blog.

🔗https://t.co/hwp1HIh0EA

[Scam Sniffer | Web3 Anti-Scam @realScamSniffer]

ERC2771ContextUpgradeable + MulticallUpgradeable👇
https://t.co/a7GFM3lfzo

[Cos(余弦)😶‍🌫️ @evilcos]

这个钓鱼技巧可以的，用 Create2 来预创建资金接收地址（一旦钓鱼成功才会创建，而且是一个合约地址，否则这个地址什么都没），这样可以绕过许多钱包的安全检测机制。看哪些钱包能及时跟进增强下…😃

[Scam Sniffer | Web3 Anti-Scam @realScamSniffer]

1/ Wallet Drainers are misusing Create2 to bypass security alerts in some wallets by generating new addresses for each malicious signature.

After a discussion with @SlowMist_Team, a group has employed the same technique in Address Poisoning to steal $3M since Aug.

[Cos(余弦)😶‍🌫️ @evilcos]

为了节省 Gas，牺牲默认安全性？大家用 Solidity 0.8.22 时，要注意 for 循环不再默认抗溢出了。如果这样玩，哪天再出溢出攻击也不会惊讶…