Harper

blockchain security/engineering @4d4m4n7 | @GoMaestroOrg @txpipe_tools @cr0wn @siginthq

[Harper @hrpr]

New post describing important security considerations for web-apps interacting with Cardano wallets, in particular projects utilising multi-sig transactions. Any feedback welcome!

[Adamant @4d4m4n7]

New write-up: Multi-Sig Concerns, Mangled Addresses, and the Dangers of Using Stake Keys in Your Cardano Project (Atomic Swap & TradingTent Bug)
https://t.co/OtUuidzGb7

[Maestro @GoMaestroOrg]

🚀 Maestro is leveling up!

We're thrilled to announce our $3M seed round, co-led by Wave Digital Assets and Draper Associates. This funding fuels our mission to revolutionize Bitcoin DeFi and bridge the gap between traditional and decentralized finance.

🟠 Why it matters

Empowering builders: Our state-of-the-art UTXO indexing and developer tools are designed to help onboard millions to Bitcoin.

Bridging finance worlds: We're breaking down barriers between traditional and decentralized finance with scalable, user-friendly solutions.

Ecosystem synergy: Our partnerships with innovators like Arch Network and Saturn are pushing the boundaries of what's possible on Bitcoin.

Trusted by industry leaders, Maestro is paving the way for a new era of innovation on Bitcoin. Join us as we unlock BTC's full potential.

Click the link below to find out more ⬇️

[Cardano Foundation @Cardano_CF]

🏆 Cardano Summit 2023 Awards

🎊 Congratulations to the winners in the category Developer or Developer Tools

👏 @txpipe_tools
👏 @StricaHQ

#CardanoSummit2023 #CardanoCommunity

[TxPipe @txpipe_tools]

👀 Early support for Conway primitives in Pallas:
https://t.co/rpjTDBIvDT

A big step in the path for #Rust tooling and libraries that integrate with #Cardano governance actions.

♥️ contributors: @hrpr, lisicky (github)

[Maestro @GoMaestroOrg]

Maestro placed 1st in the Battle of the Builders #cardanosummit2023

The competition was fierce. There were so many brilliant, innovative projects, and we were simply happy to take part.

We are truly humbled by this experience and want to thank our fellow competitors.

[Maestro @GoMaestroOrg]

Dear #Cardano community!

We've submitted several proposals for Project Catalyst Fund 10! 🥳

Our mission is to usher Cardano into the mainstream by offering the most advanced dApp developer platform and empower YOU the community to build better, faster, and easier.

#Fund10
🧵👇

[Harper @hrpr]

@dzcodes @nullHashPixel The Solana thing is just catching a bug (or they made it at least plausible that it was a bug). If the wallet creators wanted to be malicious/was compromised they wouldn't do something so obvious

[Harper @hrpr]

@dzcodes @nullHashPixel Backdoored key generation, replacing addresses in transactions/showing different information to the user in the UI to make them send all their funds to a different address, sending 1 bit of the private key per request hidden in normal calls to an API endpoint... etc

[Harper @hrpr]

@dzcodes @nullHashPixel Seems reckless to say that monitoring your traffic is a way to minimise most risks of using a closed-source wallet when you are only minimising the specific situation that the wallet is transferring your key phrase (while u happen to be monitoring it) in a way that is detectable

[Harper @hrpr]

@zygomeb @PhilippeVleLong So users trust auditors to point out security flaws, maybe we can also make it expected that the auditors will report any points of centralisation in the code (think auditors already do this in ETH) so users can choose to trust a reputable firms analysis of CS contract

[Harper @hrpr]

@zygomeb @PhilippeVleLong Thanks! But I think if you are getting an audit and if you think the attestation idea could be good then maybe discuss with the auditor who will already be looking over and understanding the code. Then users can have more confidence in the contract until it is OS - what u think?

[Harper @hrpr]

@zygomeb @PhilippeVleLong If it is to be closed-source contract to temporarily protect IP I think having documentation of how to build txs is a significant improvement while still protecting the source. Also a trusted auditor could attest to/describe any centralised points of the closed-source contract

[Harper @hrpr]

@zygomeb @PhilippeVleLong At least with the former you can read the code and know exactly what you are signing up for, opting in to have centralised jpg enforce royalties. If it’s closed source, you don’t know everything the contract can do and have to reveng txs in order to build your own. Sounds worse

[Harper @hrpr]

@zygomeb @PhilippeVleLong You just called jpg’s new smart contracts “moot” because it requires jpg to build some txs. Will anyone other than OptimFi be able to build OptimFi transactions for the closed-source contracts? Or is Tx building too arcane?

[Harper @hrpr]

@TheAvatarNick So the issue is the message is too general, and an attacker could have you sign this to use another dApp, without you realising its actually for Mercury Chat. Where as if it said "Please sign this to log into Mercury Chat:" it would be much more obvious

[Harper @hrpr]

@TheAvatarNick To be extra safe I would add something to the msg which indicates that the data is for a particular site, to avoid attacker trying to log into your account, getting this message then asking you to sign it when using another dApp. Then you would realise this sig is for smth else

[Harper @hrpr]

@amw7 @ADAOcommunity One note on this is that someone could make the tx cancel another signers MinSwap/MuesliSwap order and claim the funds, but the wallet won’t detect these funds belong to the user so won’t warn them of their funds being spent. The SC only checks the order owner has signed the tx.

[Harper @hrpr]

@zygomeb Agree, current batching model used by SS and MS is not satisfactory

[Harper @hrpr]

@zygomeb Or when the article describes SS and MS using batching it is just outlining the issues with batching, not that they should be using the pending utxos/chaining technique instead

[Harper @hrpr]

@zygomeb So do you think the AMMs should let people spend the pool UTXOs but the frontend should constantly update with the newest pending pool UTXO? It sounds like it would work until the traffic is high, then the contention issue kicks in