lin4o

📙on-chain research & DeFi analyst. protocol deep dives. data over narratives 🧵

[lin4o @l1nnno]

100%+ APR on an ETH-USDC LP — real or not? The story of Fluid DEX v1 meeting reality, and the road to v2

If you found this useful, a repost would mean a lot — this one took a while to put together https://t.co/Hx7yZbtc3O

[lin4o @l1nnno]

The post appeared after I saw an answer to a question from the Meridian (Ethereal) team in the CIS project chat:

"Why this attitude toward points?"
"we want users who want to use the product for the product. points are just a project's way of recognizing its most appreciated users. users whose primary objective is to earn points are not our ideal demographic"

Any project wants people to use it for the product. But a points program is created to give a “boost” to a project—when the project has just launched: it has no order books, liquidity, or its own distinctive features—how will it attract people? At this moment points come into play—because people understand that this measures their participation in the project, and they exchange inconvenient high fees, labor, and capital committed to this project for points. Through Pendle we can understand how users currently value a project—via the YT price.

Even looking at history—all projects that rewarded well through a points program and spent time on it—received user love and recognition; people used the projects. But it’s also worth asking—why did they reward well? They were making profit; their product truly became indispensable.

What conclusion can be drawn?
1. Pendle YT allows us not only to see the “price” of our points, but also to lock it in via PT, turning points into fixed profit
2. We need to calculate how our points-based APY is being valued—understand how far the project can go in terms of expected FDV
3. The project needs to have established revenue and an earnings strategy—then points can be valued достойно, and the project will be able to exist and grow

Has the total volume of points been published? Has the share of supply been named? Does the team have money besides your deposit? Is the position traded on Pendle? Do the points have a fixed base that works even if the points are reset to zero?

If out of five points, three are not met—you’re not farming, you’re lending to the project with no interest rate.

[lin4o @l1nnno]

"Points are worth nothing..." Cap, Ethereal, etc 1/2

I decided to discuss this topic because recently we’ve started running into cases where point programs are being ignored in every possible way as the product develops, or they simply “reward” you with 0 in your pocket for it.

It feels like we’re now at a final stage that shows projects are taking point programs less and less seriously, and also the people who provide the project with TVL, i.e. capital for the project to use. We end up with a real asymmetry: the project’s capital is “real”, while points are an obligation that sits on us.

The capital that people bring at an early stage of a project’s development gives the project the ability to place it in Tier 1 venues to get “risk-free” yields, thereby making profit that allows them to pay the team and cover development expenses. For example, projects without investment rounds in particular — Terminal Finance, Ethereal — we deposit in pre-seasons to get points in exchange for giving the team the ability to earn money to develop the product.

Many projects think “you didn’t lose anything” — but in a world with high inflation we do lose: the risk-free rate (let’s take ~4–5% from AAVE as a baseline), the smart-contract risk premium that we took on for free, and months of locked capital during a season when there were other opportunities to deploy capital.

The practical takeaway: the point system hasn’t “died”, but a new rule is emerging — farm projects and bring TVL only to those that have a “price”. And dilute that with fixed yield — something you can definitely “touch”, rather than just farming points.

[lin4o @l1nnno]

Rules to remember when we loop a strategy:

1. APY history in looping. How long this APY lasts — how it behaved during market volatility, whether it was always in positive territory
2. Find out the slippage you will get when entering a position via a DEX. How much you will lose on entry/exit, how long it will take to recoup the position — if the strategy is short-term, you may simply not reach break-even
3. Utilization history — what the average was and whether there was enough liquidity for the pool so the borrow rate wouldn’t spike upward. Needed to understand the pool’s stability and that you can sit there calmly
4. Oracle. One of the most important. I mostly try to work with fixed oracles or capped ones that don’t depend on market prices. Study who the feed provider is, whether there is a backup oracle or not. Understand the pros and cons of each oracle
5. HF buffer before liquidation. Don’t crank leverage to the maximum—even if the oracle is fixed and you won’t get liquidated due to a sharp depeg, you need a buffer to maintain health if borrow rates rise

These rules are enough to start with—to be confident in your position and sit more calmly. Here we do not touch contract risk and the risk of the protocol itself, which we can’t influence, but we can influence the safety of our position

[lin4o @l1nnno]

🔑 What exactly was wrong
Expected: only an allowed strategy → emergencyWithdraw → funds
In reality: any address → emergencyWithdraw → funds

- This is not a USDC hack.
- This is not a LayerZero failure.
- This is not a stolen team key.
- This is specifically an access control configuration error: a critical function was publicly open

The function was called “emergency withdrawal” and could withdraw almost all available strategy capital. Limits existed, but were configured above $673k, so they did not stop the attack

What the team did after: аfter the attack, RISEx replaced the open permission system with another authority

[lin4o @l1nnno]

How was RISEx hacked for $673,000? Full breakdown

I decided to run the publicly available information about the hack through my AI agent, and afterward the withdrawal details and how it happened were uncovered — decided to share.

The attacker exploited a publicly exposed emergencyWithdraw in RISExAdapter from the XPL RWA strategy vault. Root cause — PermissiveAuthority, which allowed calls from any address.

----Withdrawal details----
Time: 2026-08-03 07:21:58 UTC
Chain: RISE Mainnet
Asset: USDC.e
Withdrawn: 673,011.565895 USDC.e
Source: 0x2C03C7d7e2974C6599b6B108879109281ef3F818
Executor: 0x04a7934245c9B804082e391Ee077c130d31B10a5
Initiator: 0xAAb85f96FeB6DaAc1E171e7e4B0118B16f1BB66d
Main tx: 0xc52560bec154a3d5533a321bd9805305a5076194573ddb2fbb059059ace3e987

----Where the funds went from and to----
xlp_rwa proxy pool
→ executor: 0x04a7…10a5: 673,011.565895 USDC.e
├→ Ethereum: 349,999.000000 USDC
└→ Base: 323,010.565895 USDC
Bridge fees: 2 USDC
Total: 673,009.565895 USDC to one EOA
Recipient: 0x8E7F31665213D38d0C74291197523cbdf811B33a

https://t.co/UKrH5r2nO8

[RISEx @risextrade]

Today at 07:21 UTC an unauthorized withdrawal occurred from the RWA strategy associated with the XLP vault. The issue has been patched and XLP depositors have been made whole, with the full amount covered by a portion of the fees generated in July on RISEx.

XLP depositors’ funds are not affected by this event. RISEx is entirely independent and is operating as normal. More below:

The withdrawal of 673,011.56 USDC was caused by a misconfiguration in the RWA strategy, present since its deployment on July 13. We detected the issue within minutes of the withdrawal, patched it by 08:09 UTC, and covered the full amount. This was not a novel attack or a dependency failure.

Transaction in question: https://t.co/GFW0JzeYLT

We have reviewed every transaction and deployment and this is the only unauthorized withdrawal in that period. We have also reviewed the configuration of every other strategy in the vault and found no equivalent issue. A postmortem will be published.

The RISE bridge, RISEx and the XLP vault each have withdrawal throttles to reduce the impact in an exploit event. However, in this circumstance the amount was below the throttling thresholds.

We are engaging SEAL 911 and tracing is underway. We are attempting to make contact with the address involved regarding a return of funds.

@risextrade is the only official source of information. We will never DM you first. There is no recovery form and no claim process. Do not connect your wallet to any link about this incident.

[lin4o @l1nnno]

🔑 Why the contract allowed this:
In the pre-state of block 18,135,958, the adapter had a normal strategy, not the attacker’s helper. But its authority was: 0xdC5993739589cba4cD99d26999238d88f6D9fDa2
PermissiveAuthority

Verified authority code:

function canCall(address, address, bytes4)
external pure returns (bool, uint32) {
return (true, 0);
}

The Trace literally confirms:
helper → adapter.emergencyWithdraw(...)
adapter → authority.canCall(helper, adapter, 0x551512de)
authority → (true, 0)

This is not a hypothesis: the ACL on the critical withdrawal function was effectively absent. The team replaced the authority only at 08:09:13 UTC, already after the theft.

[lin4o @l1nnno]

Where am I farming right now 15-20% APY? / Current farming portfolio

1. Saturn (Morpho PT-USDat loop + YT srUSDat + sUSDat)
I initially entered Saturn with a PT-sUSDat + YT srUSDat "block" during Season 1. After the STRC price drop, I exited the PT position and increased my sUSDat holding, buying more sUSDat at $0.85; this allows me to break even now and lock in a solid profit if STRC returns to $100. I also managed to accumulate YT srUSDat at attractive prices during the pool launch. My bet for Season 2 focuses on the "risk-free" PT-USDat strategy (8–9% APY)—provided I can accumulate enough—and waiting for the Morpho pool launch to enter a small loop with 3–5x leverage, boosting the yield to 12–15% APY. I’m not banking on Season 2 points for now.

2. USDai (sUSDai/USDC multiply + sUSDai-USDC/USDC multiply on Fluid)
I’ve liked this project since Season 1 and am continuing to farm in Season 2. The strategy remains the same: maximizing farming returns via looping on Fluid. Currently, I’m prioritizing the fixed yield in the sUSDai/USDC pool (15% APR + ~60x points). I analyzed this strategy previously. I’m waiting for the Aave launch to move my position there.

3. Re (reUSD/GHO multiply on Fluid)
I’ve wanted to get into this for a while but haven't gotten around to it yet. The focus here is more on points than yield (5–10% APR + 35–40x points). Fluid could also be swapped for Morpho. I like the project; I plan to get involved soon to farm Season 2 before it ends.

4. AAVE (Monad USDT / PT-AUSD) + Tydro (USDT/USDC)
I use these primarily for "buffer" capital; they yield ~6% APR while allowing for quick withdrawals when needed. I also keep my spot ETH on Tydro.

5. Uniswap v3 WETH/USDC LP (0.3% fee tier) on Arbitrum – a small allocation of ETH earning 25–30% APR within a ±30% price range.

6. Figure Markets (PRIME/PYUSD) and Kamino (USDE/PYUSD)
I want some portfolio exposure to these loops on Kamino. I haven't entered yet, but it looks promising for medium-term farming.

7. Variational / Extended Delta-neutral strategy
I’ve finished with Extended, having farmed roughly 15% APR on capital plus points on top. Currently, a small portion of the portfolio is in Variational for point farming.

8. xStocks + TradeXYZ + Kamino
The strategy involves buying xStocks assets with stable positive funding rates on TradeXYZ and lending them out on Kamino, where they earn 2–3% APR in USDC. The total return comes to about 10–12%, accounting for the capital allocated to the hedge margin.

If you have any interesting farming opportunities worth considering or analyzing, please let me know in the comments.

[lin4o @l1nnno]

📝Finalized and updated the Dune dashboard for the Saturn project / v2.

https://t.co/1BETFffD4t

Changes made:
+ Added information about liquidity pools on Curve / Pancakeswap across Ethereum / BNB / Monad. Also, included the migration to a new pool, I temporarily combined the liquidity of both pools
+ Also added the promised Strata tranches: senior srUSDat and junior jrUSDat, their prices, number of holders
+ Updated the display of sUSDat APY yield. Added yield display taking into account the STRC peg, relative to the current NAV, and for comparing APY with the Saturn website
+ Fixed the display of the sUSDat rate: it is now calculated directly from the vault contract, using NAV = USDat balance + vested_STRC x price (previously it was taken from the assets/shares ratio from sUSDat deposit events)
+ Broke down protocol losses: mint dilution (minting at an outdated NAV with the market closed) and deployment delay (buying STRC later and at a different price than at the time of deposit). In total, about $988,333 was lost; the cumulative loss effect for existing sUSDat holders is 1.37% — a sUSDat rate line without dilution was added
+ Improved query efficiency to speed up data refresh

Edits are welcome — if you noticed mistakes, leave a comment and I’ll fix them if needed

[lin4o @l1nnno]

👀 Saturn Credit | My Dune dashboard with all the key metrics

https://t.co/1BETFffD4t

First off — this is my first attempt at something like this with Claude, and I focused on understanding current yield and sUSDat growth, as well as yield relative to STRC at the $100 peg price.

As an active participant in the points farming program and an sUSDat/USDat holder, I think this info will definitely be useful for analysis and for building out your strategy in Saturn Credit.

[lin4o @l1nnno]

@USDai_Official @get_hydrahost @QumulusAI This is one of the few projects that brings me satisfaction. Attention to detail, structured updates, and monthly improvements. The team behind it is patiently working toward the upcoming goal of $1 billion in loans.

[lin4o @l1nnno]

📮This evening my friends and I were discussing which hardware wallets are best. Which cold wallet do you think is the best?

If you have a different opinion, please let me know in the comments!

[lin4o @l1nnno]

🧮Guideline for the result: 80+ bits is good, 100+ is excellent. Below 60—move without hesitation. And remember that the calculator is honest only for a randomly generated passphrase: if you came up with it in your head, the real strength is lower than the number shown, because the brute force search isn’t over all combinations, but over words and typical mutations.

[lin4o @l1nnno]

Using the 25th word — a "passphrase" — is exactly what could have saved you in the ColdCard firmware bug situation.

The point of a passphrase is that it’s a separate secret that lives only in your head and is never stored on the device. The seed and passphrase are run together through PBKDF2 (2048 iterations of HMAC-SHA512), producing a different wallet.

What this means in this attack: even if an attacker computes your seed, they only gain access to a “dummy” — a wallet without the passphrase. To reach the real funds, they additionally need to brute-force the passphrase itself.

A strong passphrase at 80+ bits withstands even the upper bound with room to spare for decades: a full brute-force takes longer than the Universe has existed.

And now the unpleasant part. A strong and unique passphrase would have saved you. Not just any passphrase.

A weak passphrase — a dictionary word, “name+year,” “Bitcoin2024!” — an offline cracker chews through in minutes. It formally “exists,” but it has few bits of entropy, and a farm will finish those wallets next. This isn’t my wording: researchers at Block explicitly warned that wallets with weak passphrases will be reached in turn, and Coinkite recommends migrating to a new seed even with a strong passphrase.

So the simple question is: how do you assess your passphrase?

You can check your passphrase superficially by the password FORMAT (never share your passphrase anywhere; we’re talking about the FORMAT of the password).

You give Claude a prompt like this, and it builds a calculator that estimates strength based on the password format (how many characters, what types), while the actual password stays in your head. It works fully offline, the code is open — you can read it and run it without the internet:

[lin4o @l1nnno]

Create an interactive passphrase entropy calculator (BIP39 25th word) as a
single local HTML page. The user describes the password FORMAT, never types the actual password.

Requirements:
1. Checkboxes for character sets: lowercase (26), uppercase (26), digits (10),
symbols (~33)
2. Slider for length (4–64)
3. Separate "diceware / word phrase" mode: number of words × log2(dictionary size),
with presets (7776, 2048)
4. Entropy in bits = length × log2(alphabet size), updates instantly
5. Strength scale: weak / medium / strong / paranoid
6. Crack-time estimates at realistic attacker speeds: 10^6/s (single GPU),
10^9/s (rented GPU farm), 10^14/s (future hardware), shown in readable
units up to "age of the universe"
7. Short note: 80+ bits good, 100+ excellent; length beats complexity
8. Dark theme, minimalist, works fully offline — no network requests
Highlight that the secret never leaves the user's head — the tool only
works with the format.

[lin4o @l1nnno]

The $CHIP price will reach ... in 2026? I read every contract and every USDai loan.

Inside: how USDai actually works, the future $CHIP price and contract security

@USDai_Official @0xZergs @_conormoore @smykjain https://t.co/ML8MGL6KFO

[lin4o @l1nnno]

@KoreanDegen I agree. But as if the logic in risk distribution is being followed, sUSDx suffers the first losses; if CEX is hacked, all liquidity will be lost, and USDx will be in trouble.

[lin4o @l1nnno]

USDx and sUSDx are Axis senior and junior tranches, right?

Just thinking out loud here...

Deciding today to dive deeper into the Axis documentation, I explored possible ways to allocate into the upcoming points program, which will undoubtedly happen (it’s a logical stage of a protocol’s development where there are points = "Coordinates") and where there will be more opportunities thanks to Pendle

USDx has no yield; it’s a synthetic stable token. In essence, it will need to earn more points compared to sUSDx for it to make sense to hold it — so a good option would look like PT-USDx and looping it

But I thought USDx carried no risks, and sUSDx absorbs risks, including CEX — but I was wrong.

The sUSDx buffer, its price relative to NAV, will be the first to absorb losses from the trading strategy, adjusting its price. But there are also risks directly to USDx — CEX custody risks, smart-contract bugs. Essentially, if an exchange freezes funds, or one of the 16 does, then USDx will suffer as well

From the documentation updates, I noticed that now you can view the 2018-2025 track record results of the strategy, the documents, how the team controls CEX selection risk, and the structure for selecting assets for trading.

The question remains: the minimum asset volume >$1m over 24 hours for inclusion in the strategy — is there some limit where it won’t be possible to use too illiquid tokens? And will the yield decline over time?

@AxisFDN

P.S.: Currently filled 60 million out of 100 / https://t.co/XxPGuKXFBL

[lin4o @l1nnno]

🔒Risk Review / Position Safety

Pros:
- Established net income; a project with no competitors (GAIB is abandoned), using GPU/AI computing equipment as collateral.
- Revenue (annualized) - $6.87m. Full transparency of reports
- Approved by three independent risk curators: AAVE Labs, LlamaRisk, Chaos Labs. A listing on AAVE v3 Arbitrum soon
- Most of the deployed supply is sUSDai - meaning the hack risk already relates to offchain architecture + timelock on contracts
- USDai is backed by PayPal & Paxos Trust Company + through the end of the year 4.5% is locked in a customer incentive program
- Barkr provides collateral reinsurance, which is what enabled approval from AAVE risk curators
- The oracle on Fluid is capped, which allows us to maximize leverage and track only the borrow rate

Cons:
- Hard to exit the position - easiest via Fluid’s own swap in parts, gradually unwinding the leverage
- Possible temporary sUSDai depeg on DEXs during market volatility
- No verification of issued financial loans yet (coming soon) and no public access to Aravolta (monitors the equipment)
- Accumulation of bad debt on Fluid (example: Resolv)
- Don’t forget smart contract / counterparty / legal risks

@USDai_Official @0xZergs @permianlabs

[lin4o @l1nnno]

🧶 7,7% APR -> 25%+ APR. | USDai. What I’m betting on!

I’m starting to disclose positions in my portfolio that I already have and that I’m betting on over the next 6–12 months.

USDai launched confidently at TGE, has taken a unique role in its niche, is profitable, has an experienced team, and I’m continuing to farm Season 2.

🪒Let’s go through the Season 2 points math:

- season ends in 76 days
- on average, ~4b points/day are added
- there are 709b points total now; to be safe, let’s assume ~1200b by the end (they’ll soon add sUSDai/USDai on AAVE v3 — I think this will increase its TVL)
- they will allocate up to 10% of supply; I’m using the base case of 5%
- current FDV is $245m; I’m factoring in a drop to $150m FDV, and then
- tokens will be distributed with no vesting (info from the team)
= $6,25 / 1m points

📙My current position is a mix of looping strategies on Fluid:

1. sUSDai/USDT 7x multiply
- 8x points. With leverage: 56x points ~12.7% APR (in points)
- fixed APY: based on the average rate I’m seeing — 12–13% APR
Total: ~24.7% APR
https://t.co/4PEe9Y5smR

2. sUSDai-USDT/USDT 7x multiply
- 16x points. With leverage: 112x points ~25.4% APR (in points)
- fixed APY: based on the average rate I’m seeing — 2–3% APR
Total: ~27.4% APR
https://t.co/EHMJE11YuF

I allocated up to 10% of my portfolio to this position.

What to choose? I think the first option is better: we already get a fixed portion of the yield, we’re less dependent on points-related circumstances and possible plan changes -> read on