Abhinabphy

Web3 Security Researcher | 3x Hackathon Winner | Studying at IIT Guwahati | Passionate about DeFi, audits & protocol exploits

[Abhinabphy @blockphy]

@alokbishoyi97 Interested sir

[Abhinabphy @blockphy]

only if I could afford substack man , too much to learn from degencode

[Abhinabphy @blockphy]

@paradigm love you for making an article on this , so goated !! can be used in liquidations for fungible tokens (there is a discrete version for NFTs too)
here's the article link
https://t.co/JtWq9BcBJO

[Abhinabphy @blockphy]

Extremely important , specifically you must stay up to date with the best security practices tbh

[Shieldify Security @ShieldifySec]

20+ GitHub repos to master smart contract security in 2026 🫡

Bookmark this before you scroll past 👇

EVM
→ Smart Contract Vulnerabilities – https://t.co/0en6xXlnus
→ DeFiHackLabs (real exploit replays) – https://t.co/U4uxWZiWuf
→ Building Secure Contracts – https://t.co/8onXkHuK20
→ Awesome Ethereum Security – https://t.co/pjb9DoZIRn
→ Blockchain Attack Vectors – https://t.co/QeXj3hhcrW

Solana
→ Awesome Solana Security – https://t.co/TVKkrnhUpn

Move (Aptos/Sui)
→ Awesome Move Security – https://t.co/s3JUHVnqYt
→ Move Vulnerability Database – https://t.co/edSEqQrVqZ

General / Aggregators
→ Web3 Bounties & Exploits – https://t.co/r2x42cmJbt
→ Awesome Web3 Security – https://t.co/ijQPYRaqWi
→ Web3 Security Resources – https://t.co/3FYVjfcZuT
→ Awesome Wallet Security – https://t.co/k6ODGXIDHS
→ Awesome Smart Contract Security – https://t.co/8Yljo7KyJW

Which one did you not know about?

[Abhinabphy @blockphy]

Great work tbh

[tervelix @tervelix]

I don't want hyperliquid people to lose in the long term, so I'm going to explain what @Lighter_xyz actually enables.

"Ok it uses ZK proofs so what?"

When we hear "ZK proofs" we should question: What is actually being proved?

Please bear with me. 👇

Standard ZK-Rollups/Validiums usually prove only the settlement. EG:

>> Alice had 10 ETH, Bob had 0. Alice sent 1 ETH to Bob. Now Alice has 9, Bob has 1. The signatures are valid. <<

That's it. They DON'T prove what happened during the exchange.
--> How the trade happened?
--> Did the exchange match Alice with the best price?
--> Did they let a bot jump in front of her?
--> Did protocol counter traded her?

You have to trust the exchange's matching engine for this, which almost always runs off-chain like a black box.

However Lighter's ZK Circuit is designed to prove entire execution logic.

Circuit proves that the matching engine followed the exact rules of the order book. Proof says:
--> Alice's buy order arrived at xx:xx.
--> The best sell order was Bob's at $000.
-->The engine matched them correctly.
--> No other order existed that could have given Alice a better price.

If the Lighter sequencer tries to skip your order or give you a bad price, it becomes mathematically impossible to generate the proof.

On the other side:

- Hyperliquid's 24 validators have absolute power over the protocol. EG:
>> They literally forced a market rollback on the JELLY pair to save the insurance fund (I find it as a wise move btw). That is how "trusted setup" works.

- Because Hyperliquid is on its own chain, there is no "higher court" to appeal. If the Hyperliquid validators agree to censor a user or halt the chain, the user cannot escape to Ethereum because the assets are locked on the Hyperliquid chain itself, or the bridge which operated by same stack.

Lighter's "single sequencer" cannot steal funds or fake trades because Ethereum L1 verifies the ZK proof.

I liked this court explanation so i am gonna stick with it.

Ethereum doesn't run the exchange nor exchange is running on the Ethereum. It just acts as the Supreme Court Judge.

- Lighter executes thousands of trades (or cancelletion) off-chain, on their own fast servers, to give you instant speed. This is similar to other exchanges.

- Lighter's servers run this ZK math - circuit that basically summarizes all those trades into a tiny cryptographic receipt, the ZK proof. Let's call it just proof.

- Lighter sends this proof to a smart contract on Ethereum.
- This contract has a specific function which runs a mathematical check.
- It just can passes or fails. It's bianary, no abstain outcome or other outcome can come. Pure math. 2+2=4, yes or no?

- If the proof is valid, which is the happy scenario, Ethereum updates the balances which are written on the smart contract. EG:
>> Tervelix has 1234 $ABC

- If the proof is invalid (e.g., the sequencer tried to cheat you), which is the sad scenario, Ethereum rejects the transaction entirely.
- The Ethereum smart contract calculates 2+2=5 -> FALSE. The transaction is rejected entirely. The state of the exchange on Ethereum does not update. The hacker/sequencer cannot move the funds because the judge refused to sign off on the new balance. The chain effectively halts rather than accepting a lie.

What if the sequencer just stops processing your withdrawal or shuts down the website?

- Since the Lighter smart contracts live on Ethereum L1, you don't need the Lighter website.ü

- You can call a function directly on the Ethereum contract (Force Withdrawal).

- If the sequencer ignores this request for a set time (e.g., 24 hours), the contract enters "Exodus Mode."

- This allows users to withdraw their funds directly from the Ethereum bridge contract using the proof, which you can generate yourself because the data is public, directly on Ethereum, not any other DA layer.

You don't trust the Lighter team to be honest. You trust the code, which you can read, and Ethereum, which is the worlds most secure network.

Feel free to verify on @l2beat

[pashov @pashov]

please don’t make fun of children today on christmas for believing in santa

i know fully-grown adults who believe autonomous AI agents will takeover the web3 security industry

[Abhinabphy @blockphy]

@fuelxmeta Hi

[Abhinabphy @blockphy]

@bbl4de_xyz we got the memory layout as below
0x80(free memory ptr)=&gt;orderData("0")
0x80+0x20(160)=&gt;offset relative to free memory ptr where fees struct encoded in memory("192")
0x80+0x40(0xc0)(192)=&gt;100(token0fee)
and in next bucket toekn1 fee =200 ,so 192 is basically the offset of fees

[Abhinabphy @blockphy]

@_pawurb hey read about your blogpost on "How to Extract long-tail MEV Profit from Uniswap" , would like to connect to talk about it

[Abhinabphy @blockphy]

https://t.co/YO5Luzt3LW
great article to study the OG stablecoin $DAI by @dankrad .Currently studying these to deploy my own stablecoin pegged to $INR on @SeiNetwork

[Abhinabphy @blockphy]

@Om_Codes_ Hello

[Abhinabphy @blockphy]

@shafu0x No assembly is always preferred ? Like what if the usecase in uniswap routers (high frequency)
(Still a learner btw)

[Abhinabphy @blockphy]

@cometwtf Hackathon winnings

[Abhinabphy @blockphy]

@wavey0x Hey I got this error for now

[Abhinabphy @blockphy]

@passandscore @Fast_Protocol hello , been fan of your work from the channel devwithjs , would love to connect !

[storm @notnotstorm]

found a pretty major data bug

it turns out almost every major dashboard has been double-counting Polymarket volume (not related to wash trading)

this is because Polymarket's onchain data contains redundant representations of each trade. receipts ⬇️⬇️

[Abhinabphy @blockphy]

@kshitijandquant Hey can we connect ?

[Abhinabphy @blockphy]

If you know the context , I will follow you !!

[Abhinabphy @blockphy]

You know what? I love MEV extraction

[Abhinabphy @blockphy]

@abrilzucchi @AbstractChain Are you leaving the web3 ecosystem?