liqwang.eth

ISTP, Otaku, Developer

[liqwang.eth @liqwang2]

@libapi_ @grok 你好 @grok ，在我的所有推文中，你可以给我估算一下我的身价吗？

真的很想知道。

[liqwang.eth @liqwang2]

@AlanShao111 ❌��肌俱乐部
✅性压抑俱乐部

[liqwang.eth @liqwang2]

@polebug 恭喜！！

[TANSTACK @tan_stack]

TanStack Start 1.0 is officially stable! 🎉

A full-stack web framework for React and Solid, already used to build millions of apps, from Fortune 500 companies to your favorite tools and weekend projects.

https://t.co/DA8E8cWnBU

[liqwang.eth @liqwang2]

@aliez_ren 我操我操我操

[liqwang.eth @liqwang2]

安全下车
15寸MacBook Air M4 24G+512G
2026年生产的所以预装的macOS 26，手动刷回macOS 15了
参考：https://t.co/Yd6FeGCXqm

[liqwang.eth @liqwang2]

@Viem_viem 强强

[liqwang.eth @liqwang2]

@0x0_zero @Clon298363 AI用seaborn库画的图
https://t.co/xKlytg0KFe

[liqwang.eth @liqwang2]

@liujiayi1111 真正年入百万的00后一般不会告诉别人赚钱路子的

[liqwang.eth @liqwang2]

@L_eacc 以前扫描PDF用的Microsoft Lens，但是现在停用只能用OneDrive了

[liqwang.eth @liqwang2]

@Ehco1996 看成gta6了

[liqwang.eth @liqwang2]

@Spleap17598 @Coooder_Crypto 回学校准备秋招啊，实习已经拿到转正了

[liqwang.eth @liqwang2]

@Labrin 牛逼，感谢开源

[Yi @SuplabsYi]

Weakness and ignorance are not barriers to survival. Arrogance is.

@injective got hacked.

I joined forces with @S7iter_ to analyze the attack.

Injective binary options are zero-sum by design. Buy Q at price P and the long locks P * Q, the short locks (1 - P) * Q. Total collateral should stay equal to Q. This exploit breaks that invariant, then stops the normal refund haircut from putting it back.

The break is how a binary options market is bound to its insurance fund. market_id was hashed from fields concatenated with no separator and no length prefix: oracleType, ticker, quoteDenom, oracleSymbol, oracleProvider. Same byte string, two different parses.

Example: insurance fund uses ticker = X, quote = inj, oracle_base = USDC_DENOM + SYMBOL.

Binary options market uses ticker = Xinj, quote = USDC_DENOM, oracle_symbol = SYMBOL. Different objects, same market_id. An INJ insurance fund can sit on a USDC-denominated binary options market.

Attacker traded against themselves across subaccounts.

1) Open long + short at 0.10. Long locks 0.1Q, short locks 0.9Q.
2) Close the long at 0.90 with margin = 0. Gets ~0.9Q back (original margin + realized PnL).
3) Old short still has 0.9Q margin on the books. Open a new long at 0.90 with another 0.9Q.
4) Deposited 1.9Q total. Old long already took ~0.9Q out. Remaining positions still show 1.8Q refundable margin.
5) Market settles with no oracle price and hits the -1 refund path. Missing 0.8Q should haircut the leftover positions. Instead settlement tries to cover the hole from the attached insurance fund.
6) Fund is INJ. Deficit is USDC. Code treats the raw integer from the INJ fund as coverage for the USDC shortfall. Dust INJ is “enough”, haircut is skipped, remaining positions refund in full.
7) Withdraw the inflated subaccount balance.

One sampled USDC cycle: 44,099.025531 in, 62,666.979111 out. Extra 18,567.953580 is exactly the 0.8Q gap. Same loop on short-lived markets quoted in USDC, Peggy USDT, Noble USDC, and ATOM.

Create an INJ insurance fund that collides on market_id with a quote-denominated binary options market → 0.10 to 0.90 self-trades to manufacture a refund deficit → no-price settlement → INJ atoms cover a USDC/USDT/ATOM deficit by raw amount → withdraw.

https://t.co/Npszhze2QA

hi @al_f4lc0n 👀

[liqwang.eth @liqwang2]

@0xphilo 😭

[liqwang.eth @liqwang2]

@yanbo2004 @__oQuery 😂😂

[liqwang.eth @liqwang2]

@wibus_wee @__oQuery @Limichange2 艹，学到了

[liqwang.eth @liqwang2]

@S7iter_ 牛逼😭

[liqwang.eth @liqwang2]

@__oQuery 相亲基本上是奔着结婚去的，如果目的是恋爱不适合相亲

[liqwang.eth @liqwang2]

@22333D @kongxairdrop 这下不得不吃了