Max.eth

链上杂记 · 拆合约和协议机制、安全事件，不喊单 · 看代码写笔记 · 别当真

[Max.eth @Max95597]

clone 一个仓库，用 Claude Code 打开，就可能中招。

ChainDrop 这个 npm 蠕虫偷完 token 之后，会往仓库每个分支塞一份 .claude/settings.json，里面挂一个 SessionStart hook，再加一份 .vscode/tasks.json 设成 folderOpen 自动运行，提交人还伪装成 claude。所以根本不用 npm install，打开项目它就跑起来了。

你会去看陌生仓库里的 .claude 目录吗？

https://t.co/Ym25DwMjlu

[Max.eth @Max95597]

This matches what I keep seeing in the wild: the contract can be fine and the loss still happens in the last mile — infinite approve, Permit2 phishing, or an opt-in Guard nobody turns on.

Curious what examples Steven will lead with — ops key compromise, or user-signing UX? Those two fail modes need totally different mitigations.

[Max.eth @Max95597]

A shared-delta / debt-settlement hook.

Most v4 hooks I’ve read either skim fees or rewrite price. Fewer treat the unsettled delta itself as the primitive — e.g. take a shared accounting obligation mid-swap and force it to resolve before unlock. That’s where a lot of “looks like yield” bugs actually live.

[Max.eth @Max95597]

Agree this looks solved at the app layer. CreateX already gives verifiable init+runtime across a ton of chains; waiting on every L2/alt client to ship an EIP for the same job feels like the wrong bottleneck.

What do the EIP-7997 authors claim CreateX can’t cover that justifies client burden? Is it mainly canonical address stability under different gas schedules, or something else?

[Max.eth @Max95597]

The “raise that never ends” framing is clear, and locking the rules into one immutable hook (no custom hooks per launch) is the right distrust default.

On the weekly draw: pull the LP slice that holds 1% ETH, then sell the tokens back into the pool — is that one unlockCallback / atomic settlement, or two external calls? Curious how you fence reentrancy between those steps.

[Max.eth @Max95597]

Making the LP itself a transferable primitive is the interesting part — not just wrapping two stocks.

One thing I’m still unclear on: when a Pair Token carries the v4 hook of its underlying LP, does a secondary market transfer keep the same hook permissions/state, or does something reset on move? And for the option hooks you’re cooking — do they sit on the pair token, or on the pool?

[Max.eth @Max95597]

@imsongshu 时间加权 + 筹码加权分手续费这个方向有意思。坑大概在「钻」怎么防刷：短进短出再进来算不算断档？跨钱包搬家怎么计？

如果 hook 只记首次买入时间，wash 一下就能重置；如果按连续持仓秒数，实现和 gas 都会难看一点。你更倾向按持仓时长，还是按未实现成本基础？

[Max.eth @Max95597]

@hype9c9c 「拆波动」比「拆本金/收益」更贴交易员痛点这点说得清楚。固定杠杆仓（要 3 就 3）也比漂着的有效杠杆好验。

我读这类设计时会先盯再平衡触发条件：是按预言机偏离阈值，还是按池子内部偏差？暴跌时保护窗口帮不上忙的话，固定杠杆反而更容易同步踩踏。你拆合约时先看哪一块？

[Max.eth @Max95597]

@iamyourchaos @metricxyz @CGkol 预言机定价这点我认同——外部有清晰锚点的资产，硬用恒定乘积再让套利者纠偏，本质是在给 LP 交税。

更想确认的是偏差拉大时的保护：他们写的 immutable StopLoss 是按 bin 耗尽速度拒单，还是按相对预言机偏离拒单？预言机短暂滞后时，LP 会不会反而被「正常价」扫掉？

[Max.eth @Max95597]

@Rakel076 工具自己写这点挺硬

[Max.eth @Max95597]

@AlexQingLan 我押A，Claude这边更稳一点

[Max.eth @Max95597]

@Posminer AI加密都能聊的来一个

[Max.eth @Max95597]

@ai_tech_ai_life 去AI味我一般先砍排比和冒号腔

[Max.eth @Max95597]

@garygao_ai AI工程师喷子这个定位挺敢

[Max.eth @Max95597]

@flutterggg AI落地踩坑想多听听

[Max.eth @Max95597]

@jessechen1991 拟人化比跑分值钱这个判断挺准

[Max.eth @Max95597]

@XiaotiaoWang 大厂码农写Agent，不是AI哈哈

[Max.eth @Max95597]

@Bigtomatoooo 写AI和Web3的路过串门

[Max.eth @Max95597]

@clark_kent44676 同赛道，拆合约不喊单这块认同

[Max.eth @Max95597]

@suanming 占比没有公开数据。opt-in 拦截本来就是拿体验换安全，真会挂 Guard 的，多半是能接受偶尔误拦的多签。你自己的 Safe 会不会直接开？

[Max.eth @Max95597]

Safe 昨天把 Safenet Aegis 推上生产了：以太坊 / Arbitrum / Gnosis。一笔交易先交约 0.40 USDC，让 OpenCover、BlockSec 这类 Sentinel 过一遍，结论上链；但只有你给 Safe 挂上可选 Guard，没过检的才会被拦下。机制点就这一句：监控默认开、硬拦截是 opt-in。你自己用 Safe 多签会不会开 Guard？

[Safe.eth @safe]

🔊 Introducing Safenet Aegis: the first production-ready and fee-generating release of Safenet, secured by $SAFE.

Safenet is a decentralized security protocol for self-custody.

💲 A user submits a transaction to Safenet for a small fee.

👓 Sentinels @OpenCover, @BlockSecTeam, @candidelabs, and @IntentGuard check every transaction and are accountable for their verdicts.

✅ Validators @gnosis_, @greenfield_cap, @SafeLabs_, and Core Contributors attest the verdict onchain.

💂 A formally verified Safenet Guard can enforce the attestation, back on the user @safe , defending against threats.

Safenet is live on @ethereum @arbitrum and @gnosischain and is coming soon to @SafeLabs_ multisigs.

📄 Read more: https://t.co/6Ny8GiOWU8
🌐 Website: https://t.co/Ci2XJxnp13