We just mass audited @toly 's Percolator protocol across all three repos. 34 on chain instructions. 50+ attack vectors tested. 8 rounding paths traced to the lamport. 6 specialized audit agents running in parallel.
3 findings. All medium-high severity or lower.
Here's what we found and what we couldn't break ๐งต
Hold those $Perk bags folks I see a bright future ahead.
I think this team could specialize in security ๐ค or maybe they already are a big name group @PERK_FUND with a small front. Thinking there is more to this team than anyone realizes.
Our team needs to speak to somebody @HackenProof immediately. We found a vulnerability that puts millions of dollars of funds at risk.
Time is of the essence!!!!
It has now been over 5 hours and both the project team and @HackenProof have failed to respond.
Our team is now watching as multiple users are beginning to attempt the exploit ONCHAIN!
The incompetence of both parties is disturbing!!!
Our team needs to speak to somebody @HackenProof immediately. We found a vulnerability that puts millions of dollars of funds at risk.
Time is of the essence!!!!
Our team needs to speak to somebody @HackenProof immediately. We found a vulnerability that puts millions of dollars of funds at risk.
Time is of the essence!!!!
Start your 5.5 xhigh models!
For this bounty, thanks to @Copenhagen0xโs insight on the previous iteration, I have deployed a max risk percolator parameter market, and the goal is to get insurance balance to drop at all on mainnet, not just drain it.
Also welcome any other insights or ideas.
Show me what you got!
Finding 1: fee_debt_sweep recovery inflates the fee_paid metric in TradeCpi, bypassing the mark_min_fee gate on Hyperp markets.
An attacker can extend market liveness for free by letting their own recovered fee debt count as trade revenue.
https://t.co/78dzDadg8x
In order to build the future of AI on Solana, we must first fix the broken infrastructure we inherited from @Pumpfun
Stay tuned for our BEST release yet!
@traderpow Are you interested in helping shape the future of launchpads? We have one coming with features that stop bad KOLS, bad retail on bonding curves, and much more. https://t.co/TKXOuO7Whm
While @Pumpfun just burned all of their users airdrops be sure to check out PERK as we prepare to launch the first community governed launchpad.
Tired of KOLs destroying your launches?
Select which ones to blacklist from the click of a button.
Tired of small retail traders hitting sell after bond?
Choose the minimum amount of SOL required in a users balance for them to participate in the bonding curve.
Donโt like these rules?
Vote using $PERK how our launchpad will evolve.
COMING SOON
While @Pumpfun just burned all of their users airdrops be sure to check out PERK as we prepare to launch the first community governed launchpad.
Tired of KOLs destroying your launches?
Select which ones to blacklist from the click of a button.
Tired of small retail traders hitting sell after bond?
Choose the minimum amount of SOL required in a users balance for them to participate in the bonding curve.
Donโt like these rules?
Vote using $PERK how our launchpad will evolve.
COMING SOON
today is a turning point for $PUMP and pump fun
I want to give more context on the bigger picture and where we're actually going.
over the past ~9 months, 100% of revenue went into buybacks. basically no other platform in crypto has done that at this scale.
however, we received ongoing feedback specifically on the feeling of a lack of trust - in the certainty of buybacks, in what would happen to the bought-back tokens, even in whether the business itself would be here in a year.
today, weโre changing that.
it started with burning ~$370M worth of $PUMP purchases. ~36% of the circulating supply removed from circulation, forever.
but that isnโt enough. weโve also allocated 50% of our next year of revenue to programmatic buybacks & burns. no more uncertainty for those who believe in us & those weโre proud to call our community.
but why not 100%? the short answer is the business simply needs the other 50% to grow.
a large treasury gives us the flexibility to make big bets over the next 5-10 years, and 50% of ongoing revenue enables us to build better products, infrastructure & reinvest into the ecosystem. I am extremely confident that 50% of the business we're building toward will dwarf 100% of the business we have today.
We just mass audited @toly 's Percolator protocol across all three repos. 34 on chain instructions. 50+ attack vectors tested. 8 rounding paths traced to the lamport. 6 specialized audit agents running in parallel.
3 findings. All medium-high severity or lower.
Here's what we found and what we couldn't break ๐งต
Three findings across 15,000 lines of Rust. None critical. The insurance fund is provably trapped , we exhausted every extraction path and proved the math.
This is the most defensively engineered DeFi protocol we've audited. @toly built something that's genuinely hard to break.
All findings submitted with full code references, attack scenarios, and suggested fixes. Open source security done in public. ๐ซก
The code has assert_public_postconditions() at the exit of EVERY state mutating instruction. That's not normal. Most protocols check invariants in a few critical paths. Percolator checks them everywhere.
Validate then mutate with scratch variables. Reentrancy guard on CPI. Frozen h_num/h_den on resolution. This is paranoid engineering done right.