Alexfu

No dejes que el honor tome el lugar que debiera adquirir la virtud.

AND🇦🇩 - ES 🇪🇸 - CY🇨🇾

[pashov @pashov]

🤯CODE4RENA SUNSETTING. THE END OF AN ERA

Thank you for everything, code4rena, forever in our hearts <3

[pashov @pashov]

🚨🤯Someone built an AI tool that one-shots the threat model & invariants of your Solidity codebase. Companies used to charge >$20k for this.

It's called X-ray, free and fully open-source. My security team will be using this. Check it out below👇
https://t.co/gh1wC1Bap3

[PolyArbiter @PolyArbiter]

We’re building a latency Football bot for Polymarket. Target: operational before the World Cup. Save this.

The principle: pro sports feeds (Sportradar, Opta) deliver pitch events in ~200-500ms. The Polymarket orderbook takes longer to reprice thin liquidity, market makers pulling quotes while they reassess. That window is the edge.
Yesterday, first live test on Bayern vs Real (Champions League QF).

86th minute, Camavinga gets his second yellow. Pipeline receives the event from Sportradar 280ms after the card. “Bayern advances” market was at ~0.55. Model recomputes to ~0.68 post-red and fires a $500 order.

Partial fill as expected: ~$180 caught around 0.55-0.57, the rest slipped to 0.63. Average 0.59. Market stabilized at 0.67 a few seconds later. Unrealized +$30. +6% in seconds.

It’s a test. But the loop worked end to end detection, decision, fill, before the book caught up.

What we learned: network latency is part of the problem. The real bottleneck is orderbook depth. We’re competing with sharp bots, not retail on their couch. And “next goal” markets have better spreads than qualification markets. Pivoting there.

What we’re building before June: fill routing across 12 venues via Jito atomic bundles. Low-signal event modeling (dangerous fouls, injuries, tactical shifts). UMA oracle hedging. Node co-location near Sportradar servers.

Why the World Cup matters.
104 matches in 39 days. $2.5B+ in projected prediction market volume. Deep liquidity means bigger positions fill cleanly. Thin liquidity in group stages means wider spreads. Both environments leave serious money on the table.

56 days to ship. We’re on it.

[Anthony Bowman @AnthonyBowman43]

https://t.co/owFuTSntOZ

[🐸Smart🐸Contract🐸Programmer🐸 @ProgrammerSmart]

How a peg stability module can accidentally create unbacked stablecoin yield

Peg stability module - swaps stablecoins 1 to 1
Stablecoin savers earn yield by staking their stablecoin into the protocol
Primary yield typically comes from stablecoin borrowers

[Ignas | DeFi @DefiIgnas]

Don’t be exit liquidity for Trump’s cartel:

They deposited $484M of $WLFI tokens to borrow USDC.

Those loans will likely never be repaid.

Instead, when Trump leaves office, or even after the midterms if Republicans lose, $WLFI will dump, and Dolomite will be stuck with BAD DEBT.

As a result, USDC lending rates are at 13.5%. But even that APY isn’t worth the risk of not being able to withdraw your deposit.

Everyone knows this.

No surprise Dolomite's $DOLO trades at just $15M market cap because it's a turkey getting ready for Thanksgiving.

[Alexfu @Alexfu_tw]

@midudev Trabaje en una empresa donde un empleado era un hacker de nor corea, muy surrealista y es mucho mas comun de lo que parece

[Aakash Gupta @aakashgupta]

There's a physicist at Stanford named Safi Bahcall who modeled this exact principle and the math is wild.

He calls it "phase transitions in human networks." When you're stationary, your probability of a lucky event is limited to your existing surface area: the people you already know, the places you already go, the ideas you've already been exposed to. Your opportunity window is fixed.

When you move, your collision rate with new nodes in a network increases nonlinearly. Double your movement (new conversations, new cities, new projects) and your probability of a serendipitous encounter doesn't double. It roughly quadruples. Because each new node connects you to their entire network, not just to them.

Richard Wiseman ran a 10-year study at the University of Hertfordshire tracking self-described "lucky" and "unlucky" people. The single biggest differentiator wasn't IQ, education, or family money. Lucky people scored significantly higher on one trait: openness to experience. They talked to strangers more, varied their routines more, and said yes to invitations at nearly twice the rate.

The "unlucky" group followed the same routes, ate at the same restaurants, and talked to the same 5 people. Their networks were closed loops. No new inputs, no new collisions.

Luck isn't random. Luck is surface area. And surface area is a function of movement.

The lobster emoji is doing more work than most people realize. Lobsters grow by shedding their shell when it gets too tight. The growth requires a period of total vulnerability. No protection, no armor, soft body exposed to the ocean.

That's the cost of movement nobody posts about. You have to be uncomfortable first. The new shell only hardens after you've already moved.

[Carlos-cryptofinanzaslibres @escapasistema]

Persigue todo lo que desees, excepto el amor y la muerte; ellos te encontrarán cuando sea el momento.

[ℏεsam @Hesamation]

🚨A group of North Korean hackers possibly exploited a VSCode/Cursor vulnerability to steal $285M.
> they posed as a trading firm for 6 months
> met the devs at a conference
> deposited $1M+ to build trust
> shared repo that likely compromised a contributor
> Cursor sets Workspace Trust off by default
> opening a cloned repo auto-executes a malicious .vscode/tasks.json. no click.
> VSCode asks you if “you trust the authors of this project”, and you likely said yes every time
> Cursor has this setting disabled “to prevent confusion between Workspace Trust’s ‘Restricted Mode’ and Cursor’s ‘Privacy Mode’
> still not fixed.

TO BE TRANSPARENT, Drift’s forensic investigation is still ongoing and VSCode/Cursor is mentioned as “one possibility”, but the risk is real and if you’re a dev using Cursor with default settings might need to look into this and enable WT.

[DEVAIR (COD) @0xdevair]

AI can find smart contract bugs. But can it prove them?

That's the gap I built DeTest to close.

@PashovAuditGrp solidity-auditor skill is genuinely impressive — 8 parallel agents, 266 attack vectors, structured findings in minutes.

But findings without proof are still just opinions.

DeTest is a Claude Code skill that sits downstream of pashov. It reads the audit report, classifies each finding, writes a Foundry test, runs forge test, iterates up to 3 times, and returns a verdict:

Confirmed— test passes, trace matches the exploit path
UnConfirmed — couldn't prove it
InConclusive — untestable by design (mempool, off-chain actors etc.)

A finding only becomes evidence when a Foundry test passes and the call trace confirms the attack path.

No passing test = no confirmed finding. Simple.

The full pipeline I'm running:

1/ @pashov → discovers vulnerabilities
2/ DeTest → proves or disproves with Foundry tests
3/ @hackenproof triage skill → scope check, duplicate check, severity, submission

Discovery → Verification → Submission.

DeTest is open source.
https://t.co/yNtvshI6pu

Built on top of pashov's work. Powered by Foundry. Running on Claude Code.

Building in public.

[Alexfu @Alexfu_tw]

Nada como agua borjomi con limon y miel

[Anish Moonka @anishmoonka]

Researchers put electrodes in people’s brains and found the network responsible for creative thinking shuts off completely during focused tasks and content consumption.

It only fires when you do nothing.

Your best ideas are behind the screen you won’t put down.

[Alexfu @Alexfu_tw]

@robj3d3 If you ever come to paphos lets do a coffe

[Alexfu @Alexfu_tw]

@robj3d3 Find a local no fancy place that cooks on the grill without seed oils, eat mixed grill or gyros.

you will eat super healthy food for between 7 eur to 13 eur + if you go to same place everyday the will invite you sometimes and you will know the locals and cool things

[Alexfu @Alexfu_tw]

If you train hard even with gloves u get this, so yeah gloves makes u instantly gay

[LUIS @luisomor]

Wearing gloves at the gym is insanely gay

Your hands should be looking like this after spamming hundreds of pullups every week

[Alexfu @Alexfu_tw]

Life lately

[AzFlin 🗿 @AzFlin]

ADHD multitaskers absolutely printing rn

> talk to agent 1
> while you wait for it to respond, talk to agent 2
> while you wait for agent 2 to respond, back to agent 1. if still spinning, talk to agent 3...

[Crypto Jargon @Crypto_Jargon]

THIS GUY JUST EXPLAINED HOW TO BUILD AN ALGORITHMIC TRADING HEDGE FUND 🤯

FROM SCRATCH.

IN UNDER 6 MINUTES.

THIS IS ACTUALLY CRAZY.

[Ian Chan @chanian]

Poker / solver friends:

I decided open source my base implementation of CFRM engine (and port it to Go).

My original implementation took me about a year. gpt-5.3-codex ripped through it in 3.5 minutes. wild world we're living in. codebase below

[batteries, and ui not included]

[Roan @RohOnChain]

As someone who builds institutional level quant systems for prediction markets, this is the closest thing to a quant desk simulation I have ever seen publicly shared.

Runnable code for every model.
Read it before someone takes it down.