Julio

[Zircuit @Zircuit]

Zircuit Finance is now live.

Institutional-grade yield. Transparent structure. Security-first design.

Targeting 8–11% APR with no deposit minimums and 0% management fee.

[Zircuit @Zircuit]

02.17. The wait is over.

Zircuit Finance vaults open tomorrow.

[Zircuit @Zircuit]

We're opening applications for the Zircuit Ambassador Program 💚

If you create dev content, explainers, memes, or ecosystem highlights and want to grow with Zircuit, we’d love to hear from you!

Apply by Monday 11:59 PM EST 👇
https://t.co/jgn3gc6Pb6

[Zircuit @Zircuit]

Zircuit is featured on Ξ https://t.co/A3qICwibvR Ξ

[Clown World ™ 🤡 @ClownWorld]

This is gold 🤣🤣🤣

[Zircuit @Zircuit]

The Zircuit Finance waitlist is officially live.

Limited wallets will be admitted into the alpha.

Secure your spot: https://t.co/RpfBgyDKMR

[Zircuit @Zircuit]

Honored to be selected for Binance Alpha 2.0. Zircuit is building the future of secure, scalable, and AI-integrated blockchains.

[Pavel Shabarkin @shabarkin]

On Feb 17 2025 I reported a critical vulnerability to @Scroll_ZKP. $100m+ in TVL was at risk for more than 2 months.

Anyone could force Scroll L2 into an indefinite re-org, halting the chain so that no user transactions would be included in blocks and the chain would not move forward. All funds on L2 would be frozen.

@Scroll_ZKP downplayed the report. There was no meaningful communication about the issue—only continuous ghosting and silence. The @immunefi team mediated, yet did not correctly classify the vulnerability, which clearly falls under "Primacy of Impact." When I requested a re-evaluation, I received no response.

As a result, I am disclosing this to the public to highlight Scroll's lack of security proficiency, their unfair resolution process, and their treatment of white-hats.

You can find the link to the full report and complete timeline below.

@redhairshanks86 @0xBalloonLover @Wublockchain @coindesk @cointelegraph @TheBlock__ @aave @EtherFi @ambient_finance @l2beat

Full impact of the issue:

- The Scroll chain can be halted deliberately at zero cost to the attacker.
- Withdrawals remain blocked for the duration of the attack (potentially indefinitely, as it is free to sustain).
- Halted block production prevents critical time-dependent DeFi actions (e.g., topping up positions to avoid liquidation, oracle price updates), putting user funds at risk.
- The sequencer stops collecting transaction fees because no L2 user transactions can be included in blocks.
- Anyone on the internet can trigger the attack, and Scroll has no preventative measures.

---

Timeline

- **Feb 17 2025** – Issue submitted on Immunefi.
- **Feb 18 2025** – Scroll claims the issue was known from a Trail of Bits audit 14 months earlier and says it will be fixed in the Euclid upgrade (still 2+ months away). Scroll closes the report.
- **Feb 18 2025** – I request Immunefi triage, providing code commits that show Scroll attempted—but failed—to fix the issue. I emphasize that, while the attack vector is similar, the impact and exploitation mechanism are different.
- **Feb 24 2025** – Immunefi reopens the report for discussion with Scroll.
- **Feb 27 2025** – Immunefi asks Scroll for an update.
- **Mar 03 2025** – I contact Scroll to stress that the issue is public and exploitable on the live protocol.
- **Mar 03 2025** – I DM @yezhang1998 on Twitter about the Immunefi report.
- **Mar 04 2025** – Scroll says the issue is out of scope, labeling it "Throttling or suppression of operations without loss of user funds," and notes a similar report from Nov 06 2024.
- **Mar 04 2025** – I request Immunefi mediation to confirm the submission's uniqueness and ensure a fair bounty.
- **Mar 13 2025** – I ask Immunefi for an update.
- **Mar 17 2025** – Immunefi classifies the issue as **High severity** ("causing network processing nodes to handle transactions from the mempool beyond set parameters"). They confirm the bug is unique, acknowledge Scroll's attempted fix was ineffective, and suggest a goodwill bounty because Euclid will deprecate the vulnerable functionality (in ~1.5 months).
- **Mar 17 2025** – I reiterate that an attacker could freeze $100m+ on L2 and highlight Scroll's "Primacy of Impact" policy, which requires considering broader consequences.
- **Mar 19 2025** – Scroll acknowledges receipt and promises to follow up shortly.
- **Mar 27 2025** – I ask Scroll for an update.
- **Apr 03 2025** – I ask Scroll for an update.
- **Apr 03 2025** – Immunefi also asks Scroll for an update.
- **Apr 09 2025** – Immunefi contacts Scroll directly.
- **Apr 09 2025** – Scroll offers a payment of only **$1000**, stating the mechanism will be deprecated in the Euclid upgrade (3-4 weeks away).
- **Apr 09 2025** – I reject the bounty, explaining the protocol is still vulnerable and detailing potential losses had the vulnerability been exploited on Feb 17 2025.
- **Apr 15 2025** – I ask Immunefi to confirm "Primacy of Impact" applies and that the network remains vulnerable.
- **Apr 22 2025** – Scroll responds with a single "." and closes the report.
- **Apr 22 2025** – I ask Immunefi to explain Scroll's response and provide an update.
- **Apr 29 2025** – I notify both Scroll and Immunefi that I will publicly disclose the vulnerability on Apr 30 2025 unless the report is treated and rewarded fairly.

Here is the full audit report with a complete explanation of the issue, PoC scripts, a local network setup guide, and a PoC video. A full triage history (screenshots) is included at the end of the blog post—please review it!

https://t.co/dOqk0vh9ng

[Zircuit @Zircuit]

We are thrilled to share that @BinanceLabs has invested in Zircuit 🐈

🧵

[Zircuit @Zircuit]

2 BILLION!!! 💚

stay tuned—we're cooking

[Zircuit @Zircuit]

1 BILLION 💚

[Zircuit @Zircuit]

Introducing Zircuit ✨ an EVM-compatible zero-knowledge rollup powering the limitless potential of web3 ❇️
https://t.co/AqT9YhhU8h

[Jack Niewold 🫡 @JackNiewold]

THE CELSIUS BLOWUP, EXPLAINED.

Huge sectors of crypto are imploding, and crypto unicorns might be coming down with it.

Luna was first, but now $10b giant Celsius is facing insolvency and even bankruptcy.

Let's dive in:

[Julio @A_Julls]

@Min_marianela @juancarlos1921 @jlm2985 @arnoldo_benitez aquellos tiempos jajaja

[Julio @A_Julls]

Rumbeando con #arango http://t.co/VJl5ZMWVnm

[Julio @A_Julls]

Q brutal #GameOfThrones!!! #TheRainsOfCastamere WTF!! Excelente!

[Julio @A_Julls]

@iAndrearq jajaja mala mia! Ya ta!

[Julio @A_Julls]

@mananarisa @Danituit @iAndrearq denle tiempo al tiempo vale! :)

[Julio @A_Julls]

@graphmelette ahi voy poco a poco ... :)