Hakr.RBT

Cryptographer | On the Internet, nobody knows you're a dog , unless approved by the pack

[Hakr.RBT @dwebchap]

What would you build on chain if gas fee , data privacy & scalability isn't an issue?

[zkSecurity @zksecurityXYZ]

The first two known exploits against live ZK circuits just happened, and they weren't subtle underconstrained bugs.

They were Groth16 verifiers deployed without completing the trusted setup ceremony. One was white-hat rescued for ~$1.5M, the other drained for 5 ETH.

🧵

[Hakr.RBT @dwebchap]

Web3 scale champions always compared them to Visa/ MC. The reality is V&MC dont have s/w tps.They grow horizontally on demand. Traditional monolthic designs be it in web2/web3 will always have a software limit. what web3 need is horizontal scale - only provided by @RubixChain

[KC @KCRubix]

Authentication is the real bottleneck for Agentic payments - p2p is the solution.
Centralized auth gateways process ~ 100 bn logins a day.
#Visa processes 674 mn txns per day.
Even if agents do 100 mn tps (#Stripe estimates upto 1 bn), need 8.64 trillion auth requests!
Centralized systems will not meet agentic scale, let alone blockchains like #Ethereum, #Solana or #Base (which are slower than centralized systems). Only p2p systems can handle agentic scale. Which is why @Agent_DNA is built for p2p auth, leveraging the p2p graph network of @RubixChain

[Hakr.RBT @dwebchap]

3. This is where @Agent_DNA becomes cruical for Agentic https://t.co/CbbFPpwZkF cannot depend on central auth with large p99 latency. Auth must be p2p not dependent on global RT. @Agent_DNA replaces login bottleneck with distributed trust graph using underlying @RubixChain tech

[Hakr.RBT @dwebchap]

1. Typical SSO redirect based login takes 0.5s to 2 seconds . If your model follow this,
The math is
At 100M actions/sec with 0.8s validation time:
Validations needed = requests PS × time
= 100M×0.8
= 80M concurrent auth req
No centralized IAM cluster can handle that.

[KC @KCRubix]

Authentication is the real bottleneck for Agentic payments - p2p is the solution.
Centralized auth gateways process ~ 100 bn logins a day.
#Visa processes 674 mn txns per day.
Even if agents do 100 mn tps (#Stripe estimates upto 1 bn), need 8.64 trillion auth requests!
Centralized systems will not meet agentic scale, let alone blockchains like #Ethereum, #Solana or #Base (which are slower than centralized systems). Only p2p systems can handle agentic scale. Which is why @Agent_DNA is built for p2p auth, leveraging the p2p graph network of @RubixChain

[Hakr.RBT @dwebchap]

2. 0.8s avg is not the only https://t.co/hFsrov88k6's also p99 latency. Humans rarely reach p99 stage because their behavior creates organic load distribution.They dont retry right away.Agents behave differently. It operate continuously&retry instantly meaning p99 is inevitable

[Hakr.RBT @dwebchap]

Today systems can verify identity far easily than they can verify intent.2025 @Cloudflare ban @perplexity_ai having same root.Current security designs blur line btn user intent & extraction.Without intent aware governance,security measures default to only ratelimits & heuristics

[Anthropic @AnthropicAI]

These attacks are growing in intensity and sophistication. Addressing them will require rapid, coordinated action among industry players, policymakers, and the broader AI community.

Read more: https://t.co/4SVm8K3qou

[Hakr.RBT @dwebchap]

Using @Agent_DNA , agents working together to mount large scale scraping or distillation will be traceable and potentially prevented because their identities and delegation chains are visible.

[Anthropic @AnthropicAI]

We’ve identified industrial-scale distillation attacks on our models by DeepSeek, Moonshot AI, and MiniMax.

These labs created over 24,000 fraudulent accounts and generated over 16 million exchanges with Claude, extracting its capabilities to train and improve their own models.

[Brave @brave]

🆕 Brave researchers have uncovered vulnerabilities in zkLogin, a widely-deployed authorization system for blockchain transactions.

Our findings demonstrate the wider challenges facing zero-knowledge proof systems.

[Hakr.RBT @dwebchap]

@IBM says these 5 should be in your strategy for Agent Identity & Governance. Obeservability (logs) has to be made tamperproof to have security relevance. Ephemeral and context based access to resources and unique ID with reputation. @Agent_DNA

[Hakr.RBT @dwebchap]

"Do something that brings something actually new to the table " . How about flipping the table? L1s , L2s , appchains , the problem is same. Monolithic design - shared space. @RubixChain is the only DLT protocol that doesnt talk about tps. Because tps is a hardware problem

[vitalik.eth @VitalikButerin]

Have been following reactions to what I said about L2s about 1.5 days ago.

One important thing that I believe is: "make yet another EVM chain and add an optimistic bridge to Ethereum with a 1 week delay" is to infra what forking Compound is to governance - something we've done far too much for far too long, because we got comfortable, and which has sapped our imagination and put us in a dead end.

If you make an EVM chain *without* an optimistic bridge to Ethereum (aka an alt L1), that's even worse. We don't friggin need more copypasta EVM chains, and we definitely don't need even more L1s. L1 is scaling and is going to bring lots of EVM blockspace - not infinite (AIs in particular will need both more blockspace and lower latency than even a greatly scaled L1 can offer), but lots.

Build something that brings something new to the table. I gave a few examples: privacy, app-specific efficiency, ultra-low latency, but my list is surely very incomplete.

A second important thing that I believe is: regarding "connection to Ethereum", vibes need to match substance.

I personally am a fan of many of the things that can be called "app chains". For example I think there's a large chance that the optimal architecture for prediction markets is something like: the market gets issued and resolved on L1, user accounts are on L1, but trading happens on some based rollup or other L2-like system, where the execution reads the L1 to verify signatures and markets. I like architectures where deep connection to L1 is first-class, and not an afterthought ("we're pretty much a separate chain, but oh yeah, we have a bridge, and ok fine let's put 1-2 devs to get it to stage 1 so the l2beat people will put a green checkmark on it so vitalik likes us").

The other extreme of "app chain", eg. the version where you convince some government registry, or social media platform, or gaming thing, to start putting merkle roots of its database, with STARKs that prove every update was authorized and signed and executed according to a pre-committed algorithm, onchain, is also reasonable - this is what makes the most sense to me in terms of "institutional L2s". It's obviously not Ethereum, not credibly neutral and not trustless - the operator can always just choose to say "we're switching to a different version with different rules now". But it would enable verifiable algorithmic transparency, a property that many of us would love to see in government, social media algorithms or wherever else, and it may enable economic activity that would otherwise not be possible.

I think if you're the first thing, it's valid and great to call yourself an Ethereum application - it can't survive without Ethereum even technologically, it maximizes interoperability and composability with other Ethereum applications.

If you're the second thing, then you're not Ethereum, but you are (i) bringing humanity more algorithmic transparency and trust minimization, so you're pursuing a similar vision, and (ii) depending on details probably synergistic with Ethereum. So you should just say those things directly!

Basically:

1. Do something that brings something actually new to the table.
2. Vibes should match substance - the degree of connection to Ethereum in your public image should reflect the degree of connection to Ethereum that your thing has in reality.

[Hakr.RBT @dwebchap]

@KCRubix @RubixChain @VitalikButerin Chain by definition is linear whereas graphs allows you to branch and merge , perfect for complex decision making and error correction that modern AI systems require.

[Hakr.RBT @dwebchap]

Sharded chains then ? Thats not new. Scalable ZKEVM is still years away and will always be inferior to new gen DLTs. You need a protocol that scales & settles horizontally.
@RubixChain microservices of web3. Where there is no software tps.

[vitalik.eth @VitalikButerin]

There have recently been some discussions on the ongoing role of L2s in the Ethereum ecosystem, especially in the face of two facts:

* L2s' progress to stage 2 (and, secondarily, on interop) has been far slower and more difficult than originally expected
* L1 itself is scaling, fees are very low, and gaslimits are projected to increase greatly in 2026

Both of these facts, for their own separate reasons, mean that the original vision of L2s and their role in Ethereum no longer makes sense, and we need a new path.

First, let us recap the original vision. Ethereum needs to scale. The definition of "Ethereum scaling" is the existence of large quantities of block space that is backed by the full faith and credit of Ethereum - that is, block space where, if you do things (including with ETH) inside that block space, your activities are guaranteed to be valid, uncensored, unreverted, untouched, as long as Ethereum itself functions. If you create a 10000 TPS EVM where its connection to L1 is mediated by a multisig bridge, then you are not scaling Ethereum.

This vision no longer makes sense. L1 does not need L2s to be "branded shards", because L1 is itself scaling. And L2s are not able or willing to satisfy the properties that a true "branded shard" would require. I've even seen at least one explicitly saying that they may never want to go beyond stage 1, not just for technical reasons around ZK-EVM safety, but also because their customers' regulatory needs require them to have ultimate control. This may be doing the right thing for your customers. But it should be obvious that if you are doing this, then you are not "scaling Ethereum" in the sense meant by the rollup-centric roadmap. But that's fine! it's fine because Ethereum itself is now scaling directly on L1, with large planned increases to its gas limit this year and the years ahead.

We should stop thinking about L2s as literally being "branded shards" of Ethereum, with the social status and responsibilities that this entails. Instead, we can think of L2s as being a full spectrum, which includes both chains backed by the full faith and credit of Ethereum with various unique properties (eg. not just EVM), as well as a whole array of options at different levels of connection to Ethereum, that each person (or bot) is free to care about or not care about depending on their needs.

What would I do today if I were an L2?

* Identify a value add other than "scaling". Examples: (i) non-EVM specialized features/VMs around privacy, (ii) efficiency specialized around a particular application, (iii) truly extreme levels of scaling that even a greatly expanded L1 will not do, (iv) a totally different design for non-financial applications, eg. social, identity, AI, (v) ultra-low-latency and other sequencing properties, (vi) maybe built-in oracles or decentralized dispute resolution or other "non-computationally-verifiable" features
* Be stage 1 at the minimum (otherwise you really are just a separate L1 with a bridge, and you should just call yourself that) if you're doing things with ETH or other ethereum-issued assets
* Support maximum interoperability with Ethereum, though this will differ for each one (eg. what if you're not EVM, or even not financial?)

From Ethereum's side, over the past few months I've become more convinced of the value of the native rollup precompile, particuarly once we have enshrined ZK-EVM proofs that we need anyway to scale L1. This is a precompile that verifies a ZK-EVM proof, and it's "part of Ethereum", so (i) it auto-upgrades along with Ethereum, and (ii) if the precompile has a bug, Ethereum will hard-fork to fix the bug.

The native rollup precompile would make full, security-council-free, EVM verification accessible. We should spend much more time working out how to design it in such a way that if your L2 is "EVM plus other stuff", then the native rollup precompile would verify the EVM, and you only have to bring your own prover for the "other stuff" (eg. Stylus). This might involve a canonical way of exposing a lookup table between contract call inputs and outputs, and letting you provide your own values to the lookup table (that you would prove separately).

This would make it easy to have safe, strong, trustless interoperability with Ethereum. It also enables synchronous composability (see: https://t.co/9jy6v1X6Fw and https://t.co/gZmu3YjebM ). And from there, it's each L2's choice exactly what they want to build. Don't just "extend L1", figure out something new to add.

This of course means that some will add things that are trust-dependent, or backdoored, or otherwise insecure; this is unavoidable in a permissionless ecosystem where developers have freedom. Our job should make to make it clear to users what guarantees they have, and to build up the strongest Ethereum that we can.

[Gokul.RBT @gkl_ps]

We are deploying AI agents with huge access but no clear identity or accountability. They are not users, not services just powerful "things". Identity-first approaches (like what @Agent_DNA explores) feel less like a feature and more like a necessity

[Hakr.RBT @dwebchap]

We need an urgent shift from Identity as Possession (Static Bearer Tokens) to Identity as State (Attestation + Runtime Context + User Intent) @Agent_DNA .

[Hakr.RBT @dwebchap]

@thevdm_ @Agent_DNA is logging causality - the chain of events and interactions. Not the internal state or memory. This requires cryptographic rails on a chain like @RubixChain that scales horizontally in real time.

[Hakr.RBT @dwebchap]

A log you can alter provides zero security. AI agents run with elevated privileges ,meaning they can rewrite their own history. At that point, “logging” is theater. Forensic integrity requires cryptographic certainty, not procedural comfort.

[KC @KCRubix]

Been saying this for a while. AI Agents will upend security. We need new models for security, based on decentralization, immutable logs and run time data access. @Agent_DNA leverages @RubixChain graphs to deliver AI security at scale.
https://t.co/1YbxLMRfgr

[Hakr.RBT @dwebchap]

Blockchain validators have same problem as bank lockers . It protects the “box” but not the value inside the box. There is no financial guarantee on stored value. In @RubixChain , validators not only execute state but underwrite correctness using economic collateral.

[Hakr.RBT @dwebchap]

Auth tokens are session based. But user to agent delegations are not session based, they are query based. Passing Auth tokens to agents enables replay, misuse and shadow actions. Autonomous agents need intent bound authorization, not reusable session keys. @Agent_DNA

[Hakr.RBT @dwebchap]

@RubixChain is scaling "state" , not trust. The same finality model , same data availability assurance , same consensus. Sharded state and sharded execution in a unified trust model.

[Hakr.RBT @dwebchap]

Rollup centric scaling assumes L2s inherit Ethereum security but in practice each L2 has different proving systems. L2 - L2 moves introduces new trust assumptions and hence you can no longer call Ethereum + L2s as a unified blockchain.

[Hakr.RBT @dwebchap]

A unified blockchain requires:
1. one proving system
2. one DA layer
3. one governance model
4. one censorship model
5. one finality Model
and many more...

[Hakr.RBT @dwebchap]

Rollup centric scaling assumes L2s inherit Ethereum security but in practice each L2 has different proving systems. L2 - L2 moves introduces new trust assumptions and hence you can no longer call Ethereum + L2s as a unified blockchain.

[Hakr.RBT @dwebchap]

The interop layer solutions only gives shared ordering , standardized messaging, smoother communication. It makes UX better but does not solve the underlying architecture problems. L2s will still, by design differ in key mgmt , data availability, censorship guarantees and more