Bonnai Nouh DJICKO

Software | Blockchain engineer

[Journal du Coin @LeJournalDuCoin]

💰 Hyperliquid domine les blockchains avec près de 40% des frais de transaction payés par les utilisateurs, générant environ 11 millions $ la semaine dernière.

[Bonnai Nouh DJICKO @Bonnaii]

@_SaxX_ @grok est ce vrai ? Qui sont les pirates ? Qu’est ce qui réclament ? Quelles sont les root causes ?

[Mounir Laggoune @moonlaggoune]

💰 Prime de participation: les entreprises de plus de 50 salariés peuvent distribuer une partie de leur bénéfice annuel aux salariés. Elle est obligatoire.

🤝 Prime d’intéressement: elle vise à lier l’atteinte des objectifs des salariés à un gain financier. Elle est facultative.

[Bonnai Nouh DJICKO @Bonnaii]

@bernard_gindre @traderform Sur le plus value

[Bonnai Nouh DJICKO @Bonnaii]

@ThomasCrook2 @traderform C’est sur le plus value que tu paies les charges sociales à 17%. Par contre ce que tu mets est déductible des impôts

[Delta @deltaxbt]

ETH has now dropped almost 25% against BTC since Vitalik got a girlfriend

To all founders:
Please stay single

[cygaar @0xCygaar]

Some reflections on EthCC:

- We need more consumer-focused builders. There is a lot of work being done in infrastructure, but I would love to see more user-facing projects being built. Hopefully I can help out with this going forward.

- There are still a lot of builders excited by crypto. I've been to events where many ppl were depressed by the state of things, I didn't really get that vibe this time around. The common qualm was regarding memecoins being too big a part of the narrative which I agree with.

- I met a ton of talented people this week, overall I felt Brussels was very high signal. However, I did notice that many smart ppl I know opted to stay home and do heads down work.

- Side events have officially taken over the main event as the places to be. I'm not really sure what the point of the booths at the main event do, but getting to have meaningful chats with ppl at side events is super valuable.

- I need to go back and watch some talks. Seems like there were several great talks, but it was extremely important for me to get to meet builders in person.

[Bonnai Nouh DJICKO @Bonnaii]

@CryptoastMedia @LughStablecoin Triste

[cygaar @0xCygaar]

Curious how Coinbase’s new smart wallet works? I was too.

Here’s an overview of how it’s possible to create and use a crypto wallet through Touch ID without ever needing a chrome extension.

1. The secret sauce

Here's a demo video of a smart wallet in action: https://t.co/RTlEkefw7r.

There are a couple things happening here. First a wallet is created through Touch ID, then a transaction is signed via Touch ID, and finally the transaction is fully paid for by Base.

All of this is made possible by Account Abstraction (AA) aka ERC4337.
2. Passkeys

Before we talk about AA, it’s important to understand what passkeys are. Passkeys are a form of authentication that rely on public/private key cryptography rather than traditional passwords. With passkeys, private keys are stored privately on user devices while public keys can be shared with apps. Touch ID / Face ID can be used to prevent unauthorized use of a passkey.

3. Wallet Creation

The first step in the flow above is to create a wallet. This wallet is a “smart wallet” - it’s a smart contract deployed on Base rather than your typical EOA. Smart wallets are perhaps the greatest unlock of AA.

This particular smart wallet contains code that allows for multiple owners, including ones that are passkey-based. Within the AA flow, a smart wallet is created if it doesn’t already exist.

4. Touch ID Signing
Once the wallet exists, the mint transaction can be signed and executed. To accomplish this, the website will prompt the user to sign a user op (think of it as an AA tx). The user first needs to verify they control the passkey (through Touch ID, Face ID, etc) before they can sign the user op. After that, the user op and signature are verified by the smart wallet code and then executed.

5. Free Transactions
You’ll notice that the price paid by the user in the demo is 0. This is because AA adds a paymaster service that can be used to sponsor transactions. In this particular case, Base has a paymaster setup to pay for smart wallet mints. Other applications can use paymaster sponsorships as a way to easily onboard users with needing them to have ETH in their wallets.

6. Conclusion
All the magic here is made possible by Account Abstraction. While AA has been out for a while, Coinbase’s smart wallet is one of the first to leverage account ownership via passkeys. In the future, it’ll also be possible to control wallets through traditional Web2 signin flows like Google SSO.

[ekino @ekino_France]

Fin de journée au @NFCsummit mais la soirée continue avec un festival de films IA gen et un show d’@agoriamusic pour clôturer tout ça ! On se retrouve demain, et pour ceux sur place qui veulent m’écouter parler d’ia et de nft, je passe à 14h15!

[Grégory Raymond 🐳 @gregory_raymond]

🔴 C'est désormais officiel : la SEC a approuvé les premiers ETF Ethereum $ETH

Mais ces derniers ne seront pas lancés demain, comme c'était le cas pour leurs versions Bitcoin

On va essayer de timer tout ça et surtout d'expliquer le processus réglementaire

🧵 À dérouler

[CharlesWang @0xCharlesWang]

How To Avoid MetaMask Infinite Approval Exploits

When interacting with DApps, the smart contract behind the application often needs to perform transactions that involve transferring tokens from your wallet. However, for security reasons, smart contracts cannot directly access your tokens without explicit permission. When a user approves(via the approve() function) a token request in a DApp, they essentially grants the DApp(spender) permission to access a specified amount of their tokens using the `transferFrom` function, as defined in the ERC-20 standard. This function allows the DApp to transfer tokens from the user's account to another account without requiring the user to approve each individual transaction.

After the approve() function is executed, the owner’s address, the spender’s address, and the approved amount are specified. No tokens are moved at this stage; the approval simply authorizes future transfers up to the allowed limit.

When the spender wants to move tokens, they call the transferFrom() function, which checks that the spender's allowance covers the transfer amount and that the owner has enough tokens in their balance. If these conditions are met, the tokens are transferred from the owner to the recipient, the spender's allowance is reduced by the transferred amount, and the transaction is recorded on the blockchain.

Infinite Approval & Exploits

Infinite token approval or unlimited approval requests allow a DApp to spend an unlimited amount of a user’s tokens without needing repeated permissions. This setup simplifies interactions with DApps, reduces the number of approvals required, and, therefore, saves transaction fees and time.
However, infinite token approval carries significant security risks. If the DApp or smart contract is or becomes compromised, malicious actors could potentially drain all the user’s approved tokens.

How to Stay Safe from Infinite Approval Exploit

To protect your assets from infinite token approval exploits, follow these steps:

1. Review & Revoke Unnecessary Approvals

Revoking token approval is not the same as disconnecting your wallet from a dApp. Disconnecting your wallet involves severing the connection between your wallet and the dApp. While this can prevent the dApp from seeing your public address and token balances, it does not revoke the token approvals. If a dApp has prior token approval, it can still access and move those tokens until the approval is explicitly revoked. That is, the dApp can no longer move those tokens on your behalf.

It is important to consider this approach, most especially for degens who regularly interact with multiple DeFi products. This behavior often leaves them with multiple unneeded and unsafe approvals. Frequently audit the permissions granted to dApps and revoke any that seem suspicious or unnecessary.

Etherscan Token Approval Checker: Visit sites such as https://t.co/AarJ6PAcqy, connect your wallet, and revoke permissions for any dApps or tokens you no longer use.

Revoke[dot]cash: This is another tool that helps you manage and revoke token allowances.

2. Double Check Every Infinite Approval

To verify the legitimacy of a dApp, NFT collection, or other blockchain-based service, look up its smart contract address on the relevant block explorer (e.g., Etherscan for Ethereum) and double-check using token listing sites such as coingekco. Every smart contract has a unique address, and any reputable project will make this address readily available to the public.

As explained earlier, certain DApps request infinite token approvals to save time and gas fees. To protect your assets, only approve an infinite amount of tokens for reputable contracts only when necessary. Otherwise, approve only the required amount for a specific transaction or activity and promptly reduce or revoke the approval once the transaction is completed.

[ekino @ekino_France]

Le saviez-vous ?
Avec la nouvelle version de @solidity_lang 0.8.26 Vous pouvez désormais utiliser des instructions require avec des erreurs personnalisées pour réduire le coût du gaz, améliorer la lisibilité et le debug lors de la correction des erreurs.

[cygaar @0xCygaar]

Vitalik just released EIP-7022 which proposes an alternative method to supercharge Ethereum accounts compared to EIP-3074.

7022 is more compatible with the existing ERC-4337 account abstraction work and doesn't add new opcodes to the EVM.

EOAs would essentially turn into smart contracts during the context of a transaction, allowing for more powerful interactions.

[Coin Academy @coinacademy_fr]

🪂 @DefiLlama permet désormais de vérifier votre éligibilité aux airdrops sans connecter votre wallet.

[cygaar @0xCygaar]

When I last posted about client diversity, Geth had an ~84% super majority over Ethereum client distribution.

We've since dropped to ~63%, which is below the critical 2/3 threshold (would've caused finalization of an invalid chain).

Great work by the validators that switched.

[AstraKernel 💫 @AstraKernel]

🦀 List of Resources to learn Rust - Roadmap From Beginner to Advanced Level

🔶 a curated collection of materials designed to assist learners at various stages of their journey with the Rust.

https://t.co/m8WgRU20GC

#rustlang #rust #programming #developers

[cygaar @0xCygaar]

The EVM/Solidity is still widely adopted for several reasons:

1) Huge network effects - so much content and open source code online
2) Syntax is simple, similar enough to Javascript to pick up the basics
3) Dev tooling is amazing (shoutout Foundry/Hardhat)

There are reasons why parallelizing the EVM and pushing it to its limits is widely sought after. Being able to tap into the 9 years of existing deployed contracts makes it much easier to bootstrap developers in your ecosystem.

[cygaar @0xCygaar]

Very cool post from @gakonst and the Reth team on scaling the EVM.

My favorite section talks about AOT compilation which converts EVM bytecode to machine code ahead of time, leading to a 2x performance improvement.

These are the kinds of experiments that will help lower gas fees for everyone.

Reminds me a lot of Android's transition from Dalvik/JIT to ART from a decade ago. We're starting to see the EVM mature in a similar manner to other systems.