blockful.eth

Risk analysis and mechanism design to secure governance | @anticapture

[blockful.eth @blockful_io]

We have prevented a governance attack in Shutter DAO (0x36): ~$100K of SHU tokens could capture a treasury of +$3M

We are committed to securing the @ethereum ecosystem, its protocols, team and investors.

Here are the details 👇

[blockful.eth @blockful_io]

This is the kind of problem we are researching closely at blockful: how roles, permissions, execution validation, Limits, and Delays can reduce damage when trusted paths fail.

We’ll keep sharing what we learn as we go deeper into Access Control. If you are working on this problem, our DMs are open.

[blockful.eth @blockful_io]

Access Control is becoming one of DeFi’s most critical risk layers.

Between May and June, 70+ exploits took place, with around $650M stolen in May and $81M in June.

Many of them shared a common pattern: weak permissions, unsafe execution paths, or failures in Access Control.

Why does that matter?
🧵

[blockful.eth @blockful_io]

Giddy, the case we analyzed in our Space, shows another side of the same problem.

A compromised keeper key was used in the `compound()` flow, but the deeper issue was that execution could be redirected through a malicious `aggregator` because that field was not included in the EIP-712 signed data. The system recognized authority, but did not fully constrain intent.

Space:

[blockful.eth @blockful_io]

This Wednesday, blockful Research goes live to break down the @giddydefi exploit.

$1.25M was stolen, but the compromised key was only part of the story.

Set a reminder and join us live. https://t.co/KvqL7aUlwB

[blockful.eth @blockful_io]

Market cycles come and go, but the deeper work stays the same: making crypto useful beyond speculation and resilient enough for real adoption.

Ethereum was never only about market cycles. Its strength comes from people still working on the harder questions.

[Ethereum Hub @EthereumHubFLN]

Last week, Crypto Beyond Market Cycles brought us back to first principles.

With @0xkkonrad from @joinpeanut and @theZeugh from @blockful_io, we talked about crypto origins, p2p cash, UX, regulation, monetary systems, and why people keep building.

[Giveth @Giveth]

🛡️ The results for the @thedaofund’s Ethereum Security QF Round are LIVE!

This historic round is closing with a HUGE last minute contribution:

@wintermute_t has added $200K to the matching pool 🔥

Wintermute is a well known liquidity provider, and one of the leading supporters of Ethereum security, in fact exactly a year ago today they donated $1M to @_SEAL_Org.

This year they teamed up with TheDAO, @Quantstamp & several other community partners to allocate over $1.6M worth of funding to Ethereum Security Public Goods 👇

[zeugh.eth @theZeugh]

Yesterday we talked about why are we still here, why it matters, and what's next, sponsored by @joinpeanut on the @EthereumHubFLN!

Thank you @0xkkonrad for the great co-yapping, and everyone who showed up, and also shared their views!

[Ethereum Hub @EthereumHubFLN]

Fireside Chat: TODAY

Why are we still here?
Not as a slogan, but as a real conversation about why crypto started, what it tried to change, and what still feels unfinished.

A discussion on p2p cash, crypto origins, UX, and why people are still building.

https://t.co/KECvVr664x

[anticapture @anticapture]

The Ethereum Security QF results are live.

To the 100+ people who supported Anticapture: thank you 🫡

And thank you to everyone who donated across the round. So many strong projects showed up.

Funding security is an ecosystem effort.

Thank you @Giveth and @thedaofund.

[blockful.eth @blockful_io]

@giddydefi One of the key points from today’s Space: the Giddy incident was not only a technical failure, but a trust model failure.

If one keeper key can redirect user funds, the real product risk is not only whether the code was audited, but who controls the execution path.

[blockful.eth @blockful_io]

@giddydefi One of the key points from today’s Space: the Giddy incident was not only a technical failure, but a trust model failure.

If one keeper key can redirect user funds, the real product risk is not only whether the code was audited, but who controls the execution path.

[blockful.eth @blockful_io]

This Wednesday, blockful Research goes live to break down the @giddydefi exploit.

$1.25M was stolen, but the compromised key was only part of the story.

Set a reminder and join us live. https://t.co/KvqL7aUlwB

[blockful.eth @blockful_io]

We’re going live in 10 minutes.

[blockful.eth @blockful_io]

This Wednesday, blockful Research goes live to break down the @giddydefi exploit.

$1.25M was stolen, but the compromised key was only part of the story.

Set a reminder and join us live. https://t.co/KvqL7aUlwB

[blockful.eth @blockful_io]

The SquidRouterModule incident shows how security risk can sit outside the core protocol while still affecting users through trusted execution paths.

According to public reports, around $3.2M was drained from Safe wallets across Ethereum and Base through a third-party module carrying the Squid name. Squid stated that its core protocol and router contract were not affected, and that the exploited module was not built, deployed, or operated by its team.

That distinction matters because modular systems often depend on components that sit close to trusted infrastructure without being part of the core protocol itself. Wallet modules, permissions, integrations, and deployment history can all become part of the actual risk path.

For DAOs and DeFi teams, this points to a security review problem that goes beyond the core protocol: the full permission and execution path needs to be understood before a module is treated as safe to use.

Read more via @TheBlockCo

[zeugh.eth @theZeugh]

Little spoiler of something cooking at @blockful_io