PERK

Building the future of markets on Solana! $PERK

[PERK @PERK_FUND]

We just mass audited @toly 's Percolator protocol across all three repos. 34 on chain instructions. 50+ attack vectors tested. 8 rounding paths traced to the lamport. 6 specialized audit agents running in parallel.

3 findings. All medium-high severity or lower.

Here's what we found and what we couldn't break 🧵

[PERK @PERK_FUND]

@EricBeansH33ai @mert Yeah seriously. This is not okay.

[KOLDONE @KOLDONE678]

Hold those $Perk bags folks I see a bright future ahead.

I think this team could specialize in security 🤔 or maybe they already are a big name group @PERK_FUND with a small front. Thinking there is more to this team than anyone realizes.

[PERK @PERK_FUND]

From my experience the last 24 hours, it is way too difficult to report a finding.

[Andy @andyyy]

WHAT IS HAPPENING ONCHAIN MAN THIS IS ABSOLUTELY INSANE

[PERK @PERK_FUND]

@blockchainearp @HackenProof Thank God you do not invest anymore! We cannot get a single user from their team to respond to even report the finding!

[PERK @PERK_FUND]

Our team needs to speak to somebody @HackenProof immediately. We found a vulnerability that puts millions of dollars of funds at risk.

Time is of the essence!!!!

[PERK @PERK_FUND]

It has now been over 5 hours and both the project team and @HackenProof have failed to respond.

Our team is now watching as multiple users are beginning to attempt the exploit ONCHAIN!

The incompetence of both parties is disturbing!!!

[PERK @PERK_FUND]

Our team needs to speak to somebody @HackenProof immediately. We found a vulnerability that puts millions of dollars of funds at risk.

Time is of the essence!!!!

[PERK @PERK_FUND]

@HackenProof Please check your DMs immediately. https://t.co/l0SsQSc7Ls

[PERK @PERK_FUND]

Our team needs to speak to somebody @HackenProof immediately. We found a vulnerability that puts millions of dollars of funds at risk.

Time is of the essence!!!!

[PERK @PERK_FUND]

For protocols with admin permissions or just the simple fact that teams will cut corners, maybe this is a potential solution?

https://t.co/4ppWW5xFr2

[mert @mert]

it seems the main PMF of AI is mass hacking defi protocols

this is like, what, the 10th one this month?

[PERK @PERK_FUND]

@hundredbandclip ❤️🛠️

[PERK @PERK_FUND]

I guess it is time to begin round 2!! 🔧

[toly 🇺🇸 @toly]

Start your 5.5 xhigh models!

For this bounty, thanks to @Copenhagen0x’s insight on the previous iteration, I have deployed a max risk percolator parameter market, and the goal is to get insurance balance to drop at all on mainnet, not just drain it.

Also welcome any other insights or ideas.

Show me what you got!

[PERK @PERK_FUND]

Congrats to all $PERK contributors. This was the second finding found by our team and resolved by @toly 🛠️

[PERK @PERK_FUND]

Finding 1: fee_debt_sweep recovery inflates the fee_paid metric in TradeCpi, bypassing the mark_min_fee gate on Hyperp markets.

An attacker can extend market liveness for free by letting their own recovered fee debt count as trade revenue.

https://t.co/78dzDadg8x

[PERK @PERK_FUND]

In order to build the future of AI on Solana, we must first fix the broken infrastructure we inherited from @Pumpfun

Stay tuned for our BEST release yet!

[PERK @PERK_FUND]

@traderpow Are you interested in helping shape the future of launchpads? We have one coming with features that stop bad KOLS, bad retail on bonding curves, and much more. https://t.co/TKXOuO7Whm

[PERK @PERK_FUND]

While @Pumpfun just burned all of their users airdrops be sure to check out PERK as we prepare to launch the first community governed launchpad.

Tired of KOLs destroying your launches?

Select which ones to blacklist from the click of a button.

Tired of small retail traders hitting sell after bond?

Choose the minimum amount of SOL required in a users balance for them to participate in the bonding curve.

Don’t like these rules?

Vote using $PERK how our launchpad will evolve.

COMING SOON

[PERK @PERK_FUND]

While @Pumpfun just burned all of their users airdrops be sure to check out PERK as we prepare to launch the first community governed launchpad.

Tired of KOLs destroying your launches?

Select which ones to blacklist from the click of a button.

Tired of small retail traders hitting sell after bond?

Choose the minimum amount of SOL required in a users balance for them to participate in the bonding curve.

Don’t like these rules?

Vote using $PERK how our launchpad will evolve.

COMING SOON

[alon @a1lon9]

today is a turning point for $PUMP and pump fun

I want to give more context on the bigger picture and where we're actually going.

over the past ~9 months, 100% of revenue went into buybacks. basically no other platform in crypto has done that at this scale.

however, we received ongoing feedback specifically on the feeling of a lack of trust - in the certainty of buybacks, in what would happen to the bought-back tokens, even in whether the business itself would be here in a year.

today, we’re changing that.

it started with burning ~$370M worth of $PUMP purchases. ~36% of the circulating supply removed from circulation, forever.

but that isn’t enough. we’ve also allocated 50% of our next year of revenue to programmatic buybacks & burns. no more uncertainty for those who believe in us & those we’re proud to call our community.

but why not 100%? the short answer is the business simply needs the other 50% to grow.

a large treasury gives us the flexibility to make big bets over the next 5-10 years, and 50% of ongoing revenue enables us to build better products, infrastructure & reinvest into the ecosystem. I am extremely confident that 50% of the business we're building toward will dwarf 100% of the business we have today.

[PERK @PERK_FUND]

@cryptojazper @toly Spent 72+ hours looking for a solution. It does not exist @toly

[PERK @PERK_FUND]

We just mass audited @toly 's Percolator protocol across all three repos. 34 on chain instructions. 50+ attack vectors tested. 8 rounding paths traced to the lamport. 6 specialized audit agents running in parallel.

3 findings. All medium-high severity or lower.

Here's what we found and what we couldn't break 🧵

[PERK @PERK_FUND]

Three findings across 15,000 lines of Rust. None critical. The insurance fund is provably trapped , we exhausted every extraction path and proved the math.

This is the most defensively engineered DeFi protocol we've audited. @toly built something that's genuinely hard to break.

All findings submitted with full code references, attack scenarios, and suggested fixes. Open source security done in public. 🫡

[PERK @PERK_FUND]

The code has assert_public_postconditions() at the exit of EVERY state mutating instruction. That's not normal. Most protocols check invariants in a few critical paths. Percolator checks them everywhere.

Validate then mutate with scratch variables. Reentrancy guard on CPI. Frozen h_num/h_den on resolution. This is paranoid engineering done right.