Simon

Verifying market data, dabbling in DID, fun @BlockchainIEEE

[Hari @hrkrshnn]

If you’ve “formally verified” a codebase in the last year, drop a link in the comments.

We will find bugs in it.

Do not believe the lies of the formal verification industrial complex.

[Balaji @balajis]

Western civilization has collapsed before.

But a few scholars preserved the ideas that once made Rome great. They made a backup, and it did eventually come all the way back.

It just took one thousand years.

[Aave @aave]

Aave LLC has filed an emergency motion to vacate a restraining notice served on Arbitrum DAO on May 1, 2026 that attempts to seize approximately $71 million in ETH belonging to victims of the April 18 exploit.

A thief does not gain lawful ownership of stolen property simply by taking it, and the law is clear on this. Those assets were recovered to be returned to users victimized in the April 18, 2026 exploit. Freezing them harms the very people this recovery effort is designed to protect.

We’ve asked the court for an expedited hearing and a temporary vacatur, and we are continuing to work alongside the Arbitrum community and DeFi United to make affected users whole.

[Joe Hill @jo3hill]

Bizzare that we have judges trying to set ‘market rates’ for pay, in the same way it’s bizarre that we have tribunals deciding ‘market rates’ for rent.

[Kyle McDonald @kcimc]

i made an app for tracking whether the oligarchs are actually fleeing city centers https://t.co/Fog0lIQhrA

[Simon @barducci]

Last two years in short

[sudo rm -rf --no-preserve-root / @pcaversaccio]

we've been digging our own grave with all this shit protocols and products. fun fact is that if we really built more in a true cypherpunk style, DPRK and any web2-focused threat actor would have way less attack vectors and we would have very likely way less losses.

[banteg @banteg]

went through layerzero gasolina aws deployment repo + extracted app source.

tl;dr concerning

the reference deployment is public by design. and the sample providers.json ships with rpc quorum: 1 on every mainnet chain.

1. the recommended cdk stack puts a public api gateway in front of a private alb in front of fargate in private subnets. publicLoadBalancer: false, taskSubnets: PRIVATE_WITH_NAT, and an HttpApi with HttpAlbIntegration. the readme literally tells operators to send the resulting ApiGatewayUrl to layerzero labs.

2. no authorizer, no iam auth mode, no ip allowlist, no waf, no route-level policy anywhere in the repo. the app itself (bootstrap.ts) registers /provider-health, which leaks configured rpcs. server.listen(port) without host arg binds to public ip.

3. cdk/gasolina/config/providers/mainnet/providers.json sets quorum: 1 for ethereum, bsc, polygon, arbitrum, optimism, fantom, and the rest. multiple rpc urls are configured as failover, not consensus. the multiprovider code only enforces quorum when quorum > 1 and explicitly bypasses the wrapper when it's 1. rpcs are mostly public endpoints (llamarpc, publicnode, ankr).

4. provider config lives in an s3 bucket that the cdk stack creates, uploads to, and passes via env vars (PROVIDER_CONFIG_TYPE, CONFIG_BUCKET_NAME). so the trust boundary is the app + the mutable config plane + the upstream rpc tier + whatever's in front of api gateway.

5. operators are told to validate by curling the public url for /available-chains, /signer-info?chainName=ethereum, /provider-health (again, leaks rpc). external reachability is an encouraged documented requirement.

caveats: this is the public repo and extracted non-public source. it doesn't prove the config they had for kelp bridge. but the public info and the defaults the operators are pointed at look concerning.

read more here: https://t.co/ZR5bwLzCEn

[0xngmi @0xngmi]

The attack was
1. North Korea figured out which RPC providers LZ was using
2. They compromised two of the providers to make them return fake data
3. DDoSed other providers to shut them down, forcing LZ to use the bad ones

AFAIK I was the only one who actually called it

[Nick Almond @DrNickA]

So.. LayerZero blames the project in totality for using a quorum of 1 on their DVN.

Their defaults in their code are for a quorum of 1.

Loads of projects use a quorum of 1 in prod and not only do they know about it, they run it for them.

And.. it’s them that got hacked.

[banteg @banteg]

it's really crazy that layerzero doesn't have some redundant sanity check and allows to bridge 116,500 rseth from a chain with a supply of 49

anyway here is my investigation https://t.co/4J0f7fscck

[Paul Moore - Security Consultant  @Paul_Reviews]

Bypassing #EU #AgeVerification using their own infrastructure.

I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly.

Step 1: Install the extension
Step 2: Register an identity (just once)
Step 3: Continue using the web as normal

The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts".

This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring.

Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.

[sudo rm -rf --no-preserve-root / @pcaversaccio]

cow[.]fi (CoW Swap) UI (and probably DNS) is compromised. do NOT interact!

[greg @greg16676935420]

This is not an airport you don’t have to announce your departure

[BitMEX Research @BitMEXResearch]

https://t.co/SBWHP7Ceth

[Zynx @ZynxBTC]

The UK has a far flatter income distribution than the Communist Soviet Union.

The UK take home minimum wage for working a full time job (40-hours) is now £22,555.

At £100k salary, the take home is £68,558.

That is a net income ratio of 3.04:1

We are now at the point where the wage compression and taxes in the UK means that the difference between minimum wage and a top 5% salary is a net income difference of only ~3x.

In the USSR using the same comparison, this figure never fell below 5:1

It's actually even worse in reality because the person earning £100k in the UK often has student loans.

Britain is nominally capitalist but functionally communist. China is nominally communist but functionally capitalist.

Funny how that works.

[buffalu @buffalu__]

https://t.co/pefCw7xG7I

[Klara @klara_sjo]

There will be no WW3.

They've abandoned numbered releases and switched to a live service model with seasonal events.

[mert @mert]

Boris' argument for why Bitcoin is a ponzi:

i) one of his friends once invested in it and the price went down

ii) Satoshi is Japanese (?)

iii) there's no one to talk to if, and I quote: "they decrypt the crypto"

iv) Pokemon cards are better because kids notice them

$200,000

[Dan Neidle @DanNeidle]

I see some weird things but this takes the biscuit. A vulnerability in the Companies House website, that let anyone view the private dashboard of any one of the five million registered companies, see directors' personal details.

And modify them.

[dan ushman @danushman]

I built this as a side for personal use. But, it turned out to be so much more and so much better than I ever hoped, I am releasing it as a product for everyone.

It's called Situation Deck (SitDeck) and it's a free OSINT dashboard with 180+ live data sources. It puts the entire world and almost everything happening in it on one screen.

Here's what it is, why it exists, and why/how I'm giving it away for free.