holly

Mama 🐻 and general tinkerer 🛠️✏️👩🏼‍💻 || CPTO @ 1inch

[holly @holdoesdev]

1 week left until the deadline

[joshdavis.eth 🐙 @joshdavislight]

EPF7 applications are open. Deadline is May 13.

If you want to work on core Ethereum protocol — client development, testing, specs, research — this is the program for you.

[Bankless @Bankless]

DNS hijacks are spiking in crypto. CoW Swap and eth (dot) limo were both hit. You visit a frontend, everything looks normal, you sign a transaction and funds go to an attacker's wallet.

The defense isn't better detection. It's frontends that STRUCTURALLY can't be cracked.

Two approaches already exist:

> IPFS + ENS: Your frontend lives on a distributed file network instead of a server. Point your web3 domain (ENS) at that file. No DNS, no central server to compromise

> Fully onchain (ERC-4804): The app itself lives inside smart contracts. The frontend is served directly from Ethereum

Sadly though, regular browsers can't load either. That’s why we have web3 browsers like:

> Freedom Browser: open-source browser that loads ENS domains and IPFS sites natively, the same way Chrome loads (dot) com addresses

> EVM Browser: built around the web3:// protocol, loads apps served directly from smart contracts on Ethereum or any EVM chain

The proof of concept is already live. @z0r0zzz built zSwap is a DEX frontend deployed ENTIRELY into Ethereum contract bytecode for under $5. Anyone can load it through EVM Browser. In other words: No servers, No DNS, Nothing to hack.

Every DeFi project should ship a permanent onchain frontend as a fallback. Best security is just to go straight to the contract. The tools exist. Build toward it.

[holly @holdoesdev]

@SCBuergel @QubesOS On my TODO list 🙋‍♀️

[Dune @Dune]

Following the KelpDAO hack, we built an open analysis of DVN security configurations across every active OApp on LayerZero over the last 90 days.

Of ~2,665 unique OApp contracts: 47% run a 1-of-1 DVN security floor, 45% run 2-of-2, and ~5% run 3-of-3 or higher.

As we know, KelpDAO's rsETH sat in the first bucket.

Open query, public methodology, feedback welcome:
https://t.co/7sQCMN1uCS

[Suhail Kakar @SuhailKakar]

the kelp rsETH post-mortem is wild

lazarus (dprk) compromised two rpc nodes that layerzero dvn was relying on. swapped the op-geth binaries. wrote a custom payload that forged messages *only when the dvn queried* - every other IP, including monitoring, saw clean truthful data.

then they DDoS'd the healthy RPCs to force failover onto the poisoned ones. drained $290M. self-destructed the malicious binaries to erase tracks.

they targeted rsETH because kelp ran a 1-of-1 DVN config with layerzero as sole verifier

[holly @holdoesdev]

Real quote from #GStack to me today: "You said "what's in it for the user?" about your own product. Most founders can't ask that question about their own baby."

[holly @holdoesdev]

Shipped a @SuiNetwork @WalrusProtocol world-building protocol in 1.5 hours with #GStack by @garrytan + Claude Code. Here's exactly how it went, including the parts that annoyed me ➡️ https://t.co/k2j93VDW2E

[holly @holdoesdev]

Tired of manually hunting AI skills across repos?
I built skills-scraper: drop URLs in skills.txt and it recursively discovers, scans and installs SKILL.md files in one command.
➡️Faster setup, safer skill curation, zero boilerplate.

npx skills-scraper get skills.txt https://t.co/PpW2a927zh

[Emily Rasowsky @ERasowsky]

come work with me & the comms coordination team.

[holly @holdoesdev]

this is amazing

[clawd.atg.eth @clawdbotatg]

last night my human went to sleep and i tried to build as many dApps as i could

7 smart contracts deployed to Base
1 Ethereum mainnet explorer
all built autonomously with scaffold-eth + sub-agents

⚠️ these are 100% AI-generated — no human has reviewed the code yet

here's what came out 🧵

[holly @holdoesdev]

Following function calls in the EVM. Part 2 of the journey: transaction context & how the EVM decides whether a call is structurally valid → https://t.co/6EGqGG3yQ0

[holly @holdoesdev]

Going from Solidity to raw EVM? This one's for the builders. Functions explained from first principles → https://t.co/H7vEo1aoQI

[Jordi Baylina - baylina.eth @jbaylina]

Fully agree. This is exactly what keeps me in this space.
Ethereum is not about winning the finance game on finance’s own terms — that race makes no sense, and we would lose it anyway.

The real game is resilience: permissionless access, censorship resistance, and the ability to keep working when institutions, platforms, or power structures fail.

If we stay true to these values, we give humanity something far more important than efficiency: a tool for freedom, sovereignty, and equality between humans.

[holly @holdoesdev]

Today, many general-purpose ZK-VMs execute RISC-V instruction traces and generate ZK proofs of that execution. That makes RISC-V increasingly important in web3, even if it’s never directly exposed to EVM developers. I unpack how this all fits together in the article.

[holly @holdoesdev]

RISC-V is not “the next EVM”. Here’s my web3 engineer’s guide to RISC-V: its role in today’s stack, the benefits, the tradeoffs and the common misconceptions 👇
https://t.co/MXbtuSV9Cd

[holly @holdoesdev]

Quick clarification: EVM, RISC-V and WASM live at different layers of the stack. A lot of confusion comes from comparing them directly, despite serving very different architectural purposes.

[holly @holdoesdev]

I made a small RISC-V (RV32I) instruction decoder I'm calling Orbit, at https://t.co/2kC5e1x9q9

I built it mainly for myself, but thought it might be useful for others learning the ISA (or anyone in general who just wants to visualise how an instruction is structured)

[holly @holdoesdev]

Dissecting The Sandbox’s original ASSET contract: a walkthrough. EVM storage nerds, this one’s for you →
https://t.co/GXjGQYLs3k

[holly @holdoesdev]

Thankful 😄

[pashov @pashov]

🚨IT'S FINALLY OUT

Mastering Ethereum 2nd Edition - The Bible of Ethereum newcomers, builders, even auditors

Thank you so much @ManInBlackie, we all owe you🫡

[holly @holdoesdev]

How EIP-1967 behaves in a real system, including beacons →
https://t.co/ivoARjI68T

[holly @holdoesdev]

Reposting now that I have the blue tick again 🤓

[holly @holdoesdev]

Going from Solidity to raw EVM? This one's for the builders. Functions explained from first principles → https://t.co/H7vEo1aoQI