Mhoc Yar

This hobbyist is deep into DAG consensus and horizontal scaling. Interest in Threshold crypto and ZK proofs. FHE dreamer

[patrickogrady.xyz @_patrickogrady]

Over the past ~2 years, @commonwarexyz has been building a new kind of blockchain stack from the ground up.

Today, we’re excited to share the culmination of that work with Constantinople:

https://t.co/CsLTXwhmxo

[elie @eliebakouch]

microsoft MAI tech report is a gold mine, one of the most transparent for a model at this scale.

this model uses zero synthetic data or distillation from previous models. this means reasoning, agentic behavior, tool use are all learned fully during post-training with no cold start. bold choice that makes it harder and requires more iterations to reach sota, but you get FULL control over your model series and it proves they are serious about being a frontier lab.

the tech report is insanely detailed and precise about numbers. to give an example, they give the exact MFU across all the iterations of the model, with the exact changes etc. they also share the full scaling ladder recipe, to my knowledge this is the first time i've seen this in a tech report at this scale

let's look at all of this in this likely very long thread 🧵

[holosko.eth @holosko_eth]

Benchmarked @commonwarexyz's four BFT consensus protocols (HotStuff, Simplex, Minimmit, Kudzu) on realistic AWS deployments, from a single region up to 30 validators across every continent.

20 deterministic simulations. all data + scripts shared.

read it on the blog ↓
https://t.co/FKwjXfK48s

[Charles Guillemet @P3b7_]

This morning, THORChain was drained of roughly $10.8m
Node operators have freezed the network for nearly 13 hours. The full analysis isn't out yet, but according to @jpthor, this could be a MPC exploit.

ECDSA and TSS is hard. THORChain's vaults rely on TSS, a flavor of MPC where a quorum of nodes jointly produces a signature without ever reconstructing the private key. Clean for Schnorr or EdDSA; painful for ECDSA, which Bitcoin and Ethereum require. That's why we saw plenty of protocol attempts (Lindell17, GG18, GG20, CMP, CGGMP21, DKLS, KU23...), each patching flaws in the previous one.

GG20 has a track record. THORChain's TSS uses GG20, on a fork of Binance's tss-lib. GG20 has shipped two well-publicized critical bugs: CVE-2023-33241 and TSSHOCK. CGGMP21, now cggmp24, are the latest protocols, but GG20 is still widely deployed.

I often hear a misconception when I hear about MPC setup: "The key is split across many nodes, so any single co-signer doesn't really matter".
In every published GG18/GG20 attack, one malicious or compromised co-signer is enough to extract everyone else's shard and reconstruct the full key.

AI changes the threat model. Compromising a full software node, complex Go stack, exposed P2P, custom signing daemons, a churn protocol that admits new participants on a schedule, has always been difficult and acted as a barrier. With LLM-driven vulnerability discovery and exploit synthesis, the bar to compromise one of N validators is dropping fast.

Here, it's a plausible TSSHOCK-style playbook:
- compromise one operator
- wait for it to churn into an active Asgard vault
- send malformed proofs during keygen or signing
- reconstruct the key offline
- sweep in a single transaction

It's unclear yet if the attacker used a known-unpatched GG20 weakness, or a fresh cryptographic flaw.

But, in all cases, MPC and TSS are not a substitute for hardening every co-signer. They sit on top of co-signers that must each be treated as critical infrastructure, hardware-isolated enclaves, minimally exposed, continuously audited, and running protocol with security proofs.

While the investigation progresses, be careful in your interactions onchain. These TSS setup are used in various protocols.

[Uri Klarman ⚔️ @uriklarman]

imo you're missing Censorship Resistance point

we're NOT trying to protect users from their Tx ignored by evil leader

we're protecting MMs from their stale quotes being taken advantage of
and we solved it with propAMMs, whose updates pay x100 more (per CU)

so ordering in-protocol by fee/CU solves it, except we have leaders who *intentionally* ignores these higher-paying updates

THAT is why CR is important - bc it takes away from validators the ability to order & exclude Tx - leading to predictable execution

https://t.co/XmGyolNrRX

[banteg @banteg]

track here and avoid installing anything until this is resolved
https://t.co/tokrq7Lhb2

[Albert Garreta | Nethermind @0xAlbertG]

Introducing Zinc+, where we tackle the problem of arithmetizing and proving computations unfriendly to finite fields.

Examples: classic hashes, hash + signature, lattice ops., etc.

We prove 7 SHA-256 compressions followed by the ECDSA MSM with:

[Mhoc Yar @FHEweb]

👇

[toly 🇺🇸 @toly]

Vote txs are pqc

[JP Aumasson @veorq]

Asked Opus 4.7 to check the proofs in 20 crypto papers (10 Eurocrypt, 10 recent ePrint): it reported gaps/errors in 19. I verified a few simple issues but couldn't investigate the rest, and some are likely false positives. Most results probably hold, one EC paper is shaky.

DM me for details and Opus reports.

[Minsun Kim @ah_p_uh]

I found a critical soundness bug from Jolt zkVM by @a16zcrypto , and successfully exploited it by proving 1333337 == 1333338, which is the highest impact for a zkVM.

Deatils and PoC at https://t.co/QWPNmOqq6v , please check it out!

It was resolved at https://t.co/2ZmI464xZP.

[Warp @warpdotdev]

Warp is now open-source.

[OtterSec @osec_io]

We found the same Fiat-Shamir bug in six independent zkVMs.

The result: an attacker can bypass the cryptography entirely and prove mathematically impossible statements (like minting $1M out of thin air).

Full breakdown ↓

[zkSecurity @zksecurityXYZ]

Both protocols used Circom + snarkjs, the most common stack for Groth16 deployments.

The bug? They skipped Phase 2 of the trusted setup: the circuit-specific contribution step.

Without it, the verification key's γ and δ parameters are both set to the same value: the G2 gens

[ZK Hack @__zkhack__]

- OOPS: One-time Oblivious Polynomial Signatures

- Argo MAC: Garbling With Elliptic Curve MACs

- The Billion Dollar Merkle Tree

- Aborting Random Oracles: How to Build Them, How to Use Them

- Private Proofs of When and Where

- Round-Optimal Pairing-Free Blind Signatures

- BABE: Verifying Proofs On Bitcoin Made 1000x Cheaper

- Jindo: Practical Lattice-Based Polynomial Commitment for Zero-Knowledge Arguments

- A SNARK for (Non-)Subsequences With Text-Sub-Linear Proving Time

- Policy-based Access Tokens: Privacy-Preserving Verification for Digital Identity

- zkRNN: Zero-Knowledge Proofs for Recurrent Neural Network Inference

- Formalizing Privacy In Decentralized Identity: A Provably Secure Framework With Minimal Disclosure

- Lether: Practical Post-Quantum Account-Based Private Blockchain Payments

- HYPERSHIELD: Protecting the Hypercube MPC-in-the-Head Framework Against Differential Probing Adversaries Without Masking

- Designated-Verifier Dynamic zk-SNARKs with Applications to Dynamic Proofs of Index

- Structured Matrix Constraint Systems for Architecture-Hiding Succinct Zero-Knowledge Proofs for Neural Networks

[patrickogrady.xyz @_patrickogrady]

Today, I’m excited to (finally) welcome Minimmit to the @commonwarexyz Library.

Implemented independently by both @GTE_XYZ and @vex_0x, Minimmit clobbers our benchmarks:

[USA]: 51ms blocks (-40%) | 87ms final p75 (-35%)
[Global]: 142ms blocks (-30%) | 269ms final p75 (-15%)

[Ziyi Guan @ziyiguan99]

We have identified a bug in the proof and currently do not know how to fix it. We leave the eprint as is with more info on what the bug is, because we think some ideas can still be useful.

[Giacomo Fenzi @GiacomoFenzi]

Super exciting work from Ziyi and Eylon! They construct the first SNARG for NP in the *plain* model (no random oracle) using *only* (subexponential) LWE!
Perhaps most surprisingly, the SNARG is one (very clever) instantiation of the classical Killian-Micali construction!

[Justin Thaler @SuccinctJT]

1/ Quantum computing predictions lately range from "public key cryptography will be broken in 2 years" to "it's a century away." Both are wrong.

My latest post explains what publicly known progress actually supports — and what blockchains should do about it.

Thread below 🧵

[Nico @nico_mnbl]

wrote a thing about the recent proximity things.

Let's see if we can explain proximity gaps without getting lost in moon math!

Find it on the @zksecurityXYZ blog, link below

[toly 🇺🇸 @toly]

The mcp batch frame, let’s say 20ms, would mean that everyone within a 10ms lightcone gets the same fair auction outcome. So the mcp region can be deployed near the signal source, like Binance or CB or CME, and the users can collocate in that region anywhere within 10ms.

So no one has a structured advantage because 10ms is fixable over a weekend.