Burning tokens proves scarcity. zpad makes that proof permanent.
Launch on Solana, burn supply, and publish a Zcash receipt that records exactly what happened—publicly verifiable, non-custodial, and built for anyone to check.
@AndaOnDaTrack@coretanjalan@Luke_On_X I'm currently waiting on my cofounder to get on as he has access to the dev wallet and will do buybacks + burns then
What happens after a token burn?
zpad turns it into a permanent, verifiable record: burn supply on Solana and create a public Zcash receipt tied to the exact amount, source transaction, and destination all without handing over custody.
Attackers can launch successful phishing campaigns. Attackers have the means to abuse this vulnerability and create a scam token or offsite phishing site by hosting content in a way that is attributed to https://t.co/UOYU1DDMGJ via the official domain.
This opens a path for victims to be sent to malicious sites, or to commit malicious wallet transactions or seed phrase exposure, simply because of the illegitimate borrowed credibility.
Data controlled by attackers looked legitimate. The server created metadata (under the path https://t.co/NUrHjIPLo0), and a createdOn attribute with the official website’s domain.
This creates a means for attackers to gain credibility with the data provided users will see that the data is hosted under the legitimate project’s infrastructure. Victims may view hosted data under the correct url as a legitimate promotion.
Here’s a first look at our upcoming UI overhaul:
• A new hero section that explains the product with a simple visual
• Refined typography and spacing
• New icons for Solana, ZEC, Phantom, and MetaMask
Cleaner, clearer, and dropping (very) soon.
Verifying this technology.
Your Zcash receipt from a Solana burn verifies one on-chain event and lets you independently audit all transactions. It does not vet your creators or guarantee any level of price performance.
The purpose of this launch and receipt system on zpad is to make access to the receipt more accessible to all users while leaving all receipts open to independent audits.
The upload endpoint accepted non-image files. https://t.co/UOYU1DDMGJ’s public metadata endpoint accepted invalid base64 and plain text that was mislabeled as PNGs, creating public files containing the invalid data.
Requests did not require any authentication, wallet signature, or cookie. The server accepted and served data based on its file type without verifying actual contents.