Luis Soares

DeFi Architect & Senior Protocol Engineer. Bridging SVM/EVM infrastructure, MEV capture, & ZK Proofs. Author of 5 books on Rust & Zig. Advisory Open.

[Luis Soares @luishsoares]

https://t.co/Ruyd8zNDIg

[Luis Soares @luishsoares]

FHE/encrypted state doesn't remove invariants — it hides them from your tests. OpenZeppelin's Confidential Contracts v0.5 audit is a good reminder: when balances are ciphertexts, every "require(a >= b)" becomes a handle-comparison and ACL check you can't eyeball.

[Luis Soares @luishsoares]

https://t.co/oChcqmSFKo

[Luis Soares @luishsoares]

Source: https://t.co/qUSFxNlOQB

[Luis Soares @luishsoares]

FHE/encrypted state doesn't remove invariants — it hides them from your tests. OpenZeppelin's Confidential Contracts v0.5 audit is a good reminder: when balances are ciphertexts, every "require(a >= b)" becomes a handle-comparison and ACL check you can't eyeball.

[Luis Soares @luishsoares]

If you're integrating fhEVM-style primitives, threat-model the ACL graph first, not the math. Diff audits like this are where the real lessons live.

[Luis Soares @luishsoares]

https://t.co/bDojEGRhMr

[Luis Soares @luishsoares]

Old Raydium pool drained for ~$1.34M. The interesting question isn't "which AMM bug" — it's why deprecated pools still hold live liquidity with no migration enforcement. Legacy program IDs are the soft underbelly of every long-lived DEX.

[Luis Soares @luishsoares]

Source: https://t.co/5rC1CYarFE

[Luis Soares @luishsoares]

Old Raydium pool drained for ~$1.34M. The interesting question isn't "which AMM bug" — it's why deprecated pools still hold live liquidity with no migration enforcement. Legacy program IDs are the soft underbelly of every long-lived DEX.

[Luis Soares @luishsoares]

Lesson for protocol teams: deprecation is a security action, not a UX one. Either freeze swaps on legacy pools or socialize forced migration. Leaving them swappable is leaving a permanent attack surface funded by stale TVL.

[Luis Soares @luishsoares]

Source: https://t.co/91aM6Uim5j

[Luis Soares @luishsoares]

Humanity Protocol's $36M loss wasn't a smart contract bug — it was a single laptop holding signing material. The interesting question isn't "why a laptop," it's why a token contract had a unilateral mint/transfer path reachable from one machine at all.

[Luis Soares @luishsoares]

Treating the mint authority as a hot key with no threshold, no timelock, and no rate limit turns endpoint security into the entire trust model. Audits stop at the contract boundary; the actual attack surface is the ops topology around the privileged keys.

[Luis Soares @luishsoares]

https://t.co/1IQhv5hX7M

[Luis Soares @luishsoares]

https://t.co/M0YenNDMB7

[Luis Soares @luishsoares]

That's the shift in the data: as HIP-3 volume grows, Hyperliquid's fees come increasingly from non-crypto instruments.

Mechanically, it's becoming a general on-chain venue for any asset with a price feed — not only a crypto exchange.

[Luis Soares @luishsoares]

There's also a delisting path: the validator set can vote to delist a market and force-settle open positions at a set price.

It was exercised on the JELLY market in March 2025, after a fast move left HLP with a large unrealized loss; positions were settled and affected users reimbursed.

[Luis Soares @luishsoares]

HIP-3 opened perp listing to anyone: stake HYPE, deploy a market against an oracle feed.

The effect shows in the mix: 7 of the top 10 markets by volume are now tokenized equities and commodities. RWA perps reached ~47% of volume; tokenized oil scaled $20M → $2B/day.