Dustin Godevais 🌖

I am he as you are he as you are me and we are all together former #LUNAtic $KUJI current $RUJI maxi and $TCY 🐂

[Dustin Godevais 🌖 @DustinGodevais]

Protocol treasury will acquire almost a quarter of $TCY supply at these prices 😋

[Aaluxx⚡️🍫🛡️ @AaluxxMyth]

Treasury DCA into TCY has been topped up with a further 15 sBTC 🔥

https://t.co/Q1bQPBXyW4

[Aaluxx⚡️🍫🛡️ @AaluxxMyth]

Yeah…

Anyway, TC still finding its footing in this brave new world with AI lurking and being weaponized both in attacks but, more frustratingly, in the constant submission of AI slop spam. I will work with core team and the ecosystem to get TC’s security posture up to par, but it will undoubtedly look different than the previous L1 landscape of bug bounties via platforms, they became literally unusable.

How to filter the noise is now an important problem to solve, and how to manage submissions in a trustless environment also. The role of security researchers will also evolve, but the threatening recourse breaking responsible disclosure is not the path.

On the other hand, apologies to the honest, hard working contributors and researchers who’ve had a negative experiences in the past, please reach out to me if there is something to address from the past honorably. For now, I am aware of https://t.co/kU1gZWIJ9z and @kayabaNerve , my DM’s are open good sers 🙂 I think I can largely speak for TC nodes and users that security is valued, even if it has been mishandled in the past.

[Dustin Godevais 🌖 @DustinGodevais]

@Jatinkkalra @THORChain I really like this idea

https://t.co/f5WbIabjwK

[Dustin Godevais 🌖 @DustinGodevais]

@AaluxxMyth @FadeTheFacade @THORChain @CBarraford One more thought and then I’ll shut up about it lol

It also helps with all these ex post facto analysis claims because if you posted a tiny bond for a supposed $8.5 million TLV exposure and claim credit for finding the issue afterwards then you instantly lose credibility

[Dustin Godevais 🌖 @DustinGodevais]

@AaluxxMyth @FadeTheFacade @THORChain @CBarraford One more thought and then I’ll shut up about it lol

It also helps with all these ex post facto analysis claims because if you posted a tiny bond for a supposed $8.5 million TLV exposure and claim credit for finding the issue afterwards then you instantly lose credibility

[Dustin Godevais 🌖 @DustinGodevais]

@AaluxxMyth @FadeTheFacade @THORChain @CBarraford Bond size will be correlated with white hacker conviction so that is another nice feature as well for prioritization.

[Dustin Godevais 🌖 @DustinGodevais]

@AaluxxMyth @FadeTheFacade @THORChain @CBarraford Assuming profit motive and TC credibility to actually pay out then I think it offers the correct incentive alignment.

While I have your attention @AaluxxMyth I also think 1 percent of node income should go to dedicate white hat hacker bounty for this program (max credibility)

[Dustin Godevais 🌖 @DustinGodevais]

@griffgreen See the beautiful thing about Thorchain is you can go create an ADR right now that directs 1% of system income to bug bounties. Be the change you want to see in the world.

[Dustin Godevais 🌖 @DustinGodevais]

@griffgreen $RUNE down so much it hardly makes a difference lol. I do believe in the cockroach narrative. Despite all this they are still around somehow which has admittedly earned my respect

[Dustin Godevais 🌖 @DustinGodevais]

@thinkwhysly @CBarraford @v12sec @THORChain If TC is able to maintain credibility that it will eventually pay out (obviously an open question if the above is true) then profit motive will overrule any hesitancy IMO.

If white hat hackers are willing to disclose responsibly for free then we haven’t lost in that case either

[Dustin Godevais 🌖 @DustinGodevais]

@griffgreen It is my understanding that they are likely to revisit this stance in the near future. A lot of people just have no idea how Thorchain actually works though and yet still provide commentary

[Dustin Godevais 🌖 @DustinGodevais]

People really do have @THORChain derangement syndrome

Ignore the haters $RUNE

[Dustin Godevais 🌖 @DustinGodevais]

@RaymondMontreal @zachxbt @v12sec @THORChain I feel like this issue can be easily addressed though https://t.co/ldUztg7iDv

[Dustin Godevais 🌖 @DustinGodevais]

@CBarraford @v12sec @THORChain If you’re concerned about AI slop couldn’t you have submitters post a bond for their submission. Assuming TC hasn’t lost all credibility at this point to pay out that self should filter out low quality submissions. If the attempt is earnest then just return the money.

[Dustin Godevais 🌖 @DustinGodevais]

@CBarraford @v12sec @THORChain If you’re concerned about AI slop couldn’t you have submitters post a bond for their submission. Assuming TC hasn’t lost all credibility at this point to pay out that self should filter out low quality submissions. If the attempt is earnest then just return the money.

[Dustin Godevais 🌖 @DustinGodevais]

@AmericanAir about to take a 7.5 hour flight to london without a tray table.

Can’t work. No eating. No offer to compensate me.

Awesome.

[Dustin Godevais 🌖 @DustinGodevais]

Hopefully there aren’t any bad actor nodes still left on the network because shifting the lib to private won’t help.

That said probably still a reasonable precaution. DKLS is the way forward IMO

[THORChain @THORChain]

THORChain Incident Update #5
The devs and security teams are working hard to bring the network safely back online. The focus is on getting this right, without rushing any steps. Security and stability remain the top priorities.

Nodes have upgraded to v3.18.1, which contained a patch and restores @RujiraNetwork's ability to manage credit accounts (borrow / repay).

ADR028 has been approved by the nodes. The next major step is cutting and testing v3.19.0. Additional changes are being made to the release and will be tested on stagenet before moving to mainnet. The target is to have it on stagenet by EOD tomorrow, though an exact timeline is yet to be confirmed.

Once finalised and pushed for mainnet adoption, all node operators are asked to upgrade as quickly as possible so the network can come back online safely and efficiently.

With ADR028 now approved, the bounty is active, meaning the hacker has an open window to return a portion of the funds. The protocol will also cover the remaining loss using POL. The figures are still being defined and will be shared in a follow-up announcement.

One important note: tss-lib has temporarily been moved to closed source for the next few weeks to allow THORSec to complete a full security audit without exposing ongoing remediation work. The repository will be reopened once this is complete.

More updates coming soon. We appreciate the patience and support.

[Dustin Godevais 🌖 @DustinGodevais]

@hexonaut @maraoz Thorchain’s TSS issue was not simply opsec

[Dustin Godevais 🌖 @DustinGodevais]

@GeorgeDonnelly Any particular reason?

[Dustin Godevais 🌖 @DustinGodevais]

@ArizagaKev37612 @THORCommunity @THORChain Requires 2/3 node consensus

[Dustin Godevais 🌖 @DustinGodevais]

@DamiDhray Worth it