malcolm

ZK padawan @Rareskills_io

[Etherealize @Etherealize_io]

Justin Drake: Quantum is an opportunity for Ethereum

Ethereum Researcher Justin Drake, who co-authored Google's recent quantum paper explains:

"I've stopped thinking about post-quantum as a hurdle that we have to overcome, and I think of it more as an opportunity. It's an opportunity for Ethereum to stand out as the very first global financial system that is post-quantum secure — not just relative to its competitors, but also relative to fiat and tradfi."

Justin also believes quantum presents an opportunity for Ethereum to become the best version of itself: “The move to post-quantum is essentially a rewrite, and that’s a massive opportunity to start with a clean slate and wipe our technical debt.”

The rewrite bundles post-quantum security with a new ZK virtual machine (LeanVM) that can snarkify the entire consensus layer in real time. The result is that the Ethereum L1 can scale to 10,000 TPS at 1 gigagas/second — while simultaneously becoming quantum-secure.

Source: @Bankless (Mar 2026)

[zkSecurity @zksecurityXYZ]

The first two known exploits against live ZK circuits just happened, and they weren't subtle underconstrained bugs.

They were Groth16 verifiers deployed without completing the trusted setup ceremony. One was white-hat rescued for ~$1.5M, the other drained for 5 ETH.

🧵

[RareSkills @RareSkills_io]

New Bootcamp Announcement:

Invariant Testing with @getreconxyz

@aviggiano will teach this 5 Week course. You'll learn some advanced smart contract fuzzing techniques and apply them to DeFi protocols.

Prerequisites:
- You should already know how ERC-4626 vaults work
- General knowledge of common smart contract vulnerabilities in Solidity

Cost: $1,500
Start Date: Jan 26
Commitment: 6 Hours per week, including live video calls

[RareSkills @RareSkills_io]

Ultimate Security Games was one of the most exciting developer and auditor-focused events in 2025.

The games will return even bigger in 2026.

[Defi Security Summit @summit_defi]

How do you actually audit ZK circuits?

At DSS 101, @Jeyffre, founder of @rareskills_io, breaks down the core building blocks of ZK auditing:

✅ What ZK proofs really verify
✅ How constraints encode real-world logic
✅ Common pitfalls (missing constraints, compilers, memory models)
✅ The math, Rust, and VM fundamentals needed to ramp up
✅ A realistic roadmap for becoming a ZK auditor

A super valuable session for researchers, devs & anyone entering the ZK ecosystem.

Watch the full talk 👇

[RareSkills @RareSkills_io]

The full recording of Ultimate Security Games Season 1 has been published.

Here are some of the highlights.

The full recording is linked in the reply.

Congrats again to team Europe!

[RareSkills @RareSkills_io]

Team Europe won!

Congratulations @zigtur @Montyly @GalloDaSballo and @AliceAndB0b!

Again, big thanks to the sponsors who made it possible:

@monad on whose blockchain the competition ran

as well as
@coinbase
@immunefi
@sigp_io
@PashovAuditGrp

[nisedo @nisedo_]

EUROPE CHAMPION 🏆

[Jeffrey Scholz @Jeyffre]

You’ll have a much easier time understanding ZK-STARKs if you already know how the Number Theoretic Transform works (Fast Fourier Transform for Polynomial evaluation in finite fields).

The core subroutine in ZK-STARKs, FRI, is a close variant of the NTT.

Now you can learn NTT in 13 chapters, for a total of around 25,000 words, which isn’t terribly long.

And not only learn it — learn it well enough to do it by hand.

Each chapter is rather basic algebra and just makes sure you can apply the algebra to roots of unity.

The NTT algorithm is very simple if you know the right framework to put it in, and I think we discovered the best framework.

Honestly, this is some of our best work yet.

[RareSkills @RareSkills_io]

Imagine understanding an algorithm so well that you can carry it out

- by hand
- off the top of your head
- and without memorizing any unnatural tricks

The ZK Book has expanded again, this time to teach the Fast Fourier Transform -- specifically the Number Theoretic Transform (NTT).

The NTT algorithm evaluates a polynomial on n points in O(n log n) time. Normally, such an evaluation would take O(n²) time.

Although the Fast Fourier Transform already has numerous learning resources, we found them unsatisfying.

For example, a very common explanation relies on "splitting the polynomial into even and odd terms," using "twiddle factors," and "butterflies." However, these methods come off as fortuitous random discoveries that describe the algorithm rather than explain it.

We consider such features listed above to be incidental to deeper -- and much easier to understand -- underlying concepts. We even go so far as to avoid analogies to complex numbers.

We took great care to ensure that every step of the learning journey is motivated and that every step is a trivial extension of the previous. Therefore, there are no conceptual leaps or surprise discoveries.

Don't let the chapter names scare you; the underlying principles are just basic algebra.

By the end of the 13 chapters, you will be able to compute the Number Theoretic Transform by hand!

Link next.

[RareSkills @RareSkills_io]

Mark your calendars, November 20th is Season 1 of Ultimate Security Games, live in Argentina.

Watch smart contracts get hacked in real time as three teams race to be first to steal the funds.

We're grateful to the sponsors who made this happen:
@monad
@coinbase
@immunefi
@sigp_io
@PashovAuditGrp

Get your tickets for the in-person event -- link in the reply.

[m4rio @m4rio_eth]

Discussing with my fellow security researchers in the last days after balancer.

The conclusion is:
- few of us looking at old codebases.
- bad guys are actively looking at old codebases

[alin.apt @alinush]

I think Pedersen commitments are a gentle starting point for teaching cryptography to anyone!

A **commitment** is a sealed envelope with a message m in it such that:
1. no one can tell what m is in it (hiding)
2. no one can open it to a different m (binding)

Pedersen below 👇

[Jeffrey Scholz @Jeyffre]

Sometimes I get asked

“what area of web3 should I study to advance my career?”

The best thing for you to do is to shake the

“how can I make the most money in the shortest time?”

attitude.

Number one rule of Web3: Nobody - I don't care if you're Vitalik Buterin or Anatoly Yakovenko - Nobody knows if the a web3 meta is going to go up, down, sideways, or in freaking circles, least of all people who yap on X.

So pick what you are genuinely passionate about and stick with it for two years — that puts you miles ahead of everyone who can’t stay committed to something for more than two weeks. Even if your subfield isn’t “hot” you’ll be that much more competitive than the other people.

For example — technical content creation is literally the most trash subfield you could pick. People don’t see the value in it and/or aren’t willing to pay for it. Everyone expects it to be free, so that’s already a massive uphill battle.

But that’s my specialization and I’m still in business.

So all you have to do is pick some random thing that people pay for and do a really good job at it for 2 years.

A sad thing I see is people who haven’t experienced being cracked at anything because they don’t stick to things long enough.

They keep switching to whatever is hot and become an advanced beginner in a lot of things.

They never learn how to break out of the intermediate plateau because they’ve never done it before in any subject whatsoever.

It’s far better to be cracked at something that isn’t meta than to never have experienced being cracked at anything at all.

If that strategy is distasteful to you, then become so absurdly cracked at core math and core CS that you can pick up on any meta rapidly (that’s still a 2yr+ investment to get to that point though).

[Jeffrey Scholz @Jeyffre]

The hidden economics of University vs EdTech.

TL;DR — edtech as an industry sucks and always will suck.

If you try to self-study fairly advanced topic (type theory, topology, computational complexity, etc) you will find there is an abundance of free (as in legally free, no need to pirate) — high quality material.

Even though there are maybe less than 100,000 people in the world who would read it, there isn’t a meaningful shortage of education material.

Even though these subjects “don’t make money” — there is still a lot of incentive to create education materials for them — as I will get to in a second.

On the other hand, if you try to self-study something that “pays money” (how alt-VMs work, advanced DeFi math, etc), suddenly there is a dearth of materials.

The discrepancy is in how traditional universities compensate writers vs how “edtech” compensates writers.

Traditional universities compensate writers with “clout” — and “clout” eventually leads to tenure — (basically guaranteed pay, sometimes in the very high six figures for the rest of your life).

To a certain extent, although “clout” is scarce and has to be earned, it can still be created without any real economic activity — i.e. creating education materials for topics that don’t make money (very advanced and theoretical math).

Effectively, the university ecosystem can print clout out of thin air and pay it to educators to make great free textbooks.

Although the exchange rate between clout and tenure is unclear, there is a market for it, so extremely brilliant professors with a deep understanding of hard subjects willingly farm clout by writing textbooks which then get distributed for free.

So how does the university system prop up the value of clout? (Which they have to — because tenure costs real money). Two things:

1. Taxpayer money
2. Selling prestige at a gigantic premium

Private universities farm grants very aggressively from the government (I’m not making a political judgement on this, just stating it is a fact nobody disputes). So clout gets propped up by taxpayer money.

Second, universities sell prestige. You can literally get an MIT education for free on Opencourseware, but people pay hundreds of thousands of dollars for an MIT degree because it earns you a level of prestige a Rolex cannot.

Even if the degree is not from MIT, saying “I don’t have a degree” carries stigma in some circles, so some people will still pay high rates for a 4-tier university.

Edtech can neither sell prestige (at least not at MIT levels), nor can it farm public grants (only non-profits can do that). Sure, web3 edtech makes money from foundation grants, but those are puny compared to federal grants.

To a certain extent, edtech’s biggest competitor is a luxury seller bigger than LVMH who also has access to taxpayer money.

As long as this is the case, edtech cannot make long-term bets on education materials that universities can afford to make, which means edtech will always be lacking except in subjects that require very low capital to produce (like how to code, high school math, etc).

Edtech can always compete in certain niches, but it will structurally be fighting for the scraps.

Challenge accepted.

[RareSkills @RareSkills_io]

New blog post is up:

Roots of Unity in a Finite Field

Roots of Unity are an important prerequisite for understanding the NTT algorithm (Fast Fourier Transforms in a Finite Field), ZK-STARKs, and PLONK.

You'll want to understand them like the back of your hand before diving into those algorithms.

This article builds off of our previous article about the Fundamental Theorem of Cyclic groups. It's much easier to understand Roots of Unity in the context of multiplicative subgroups than in isolation.

Link in the reply.

[RareSkills @RareSkills_io]

On the evening of November 20th, RareSkills will launch...

Ultimate Security Games

Live in Argentina.

Smart contract hacking + esports = Ultimate Security Games

The hackers will share their screens live, so you'll see their thought process and strategy as they break the contracts. If the terminal looks a little scary, no worries, @Jeyffre will explain what is happening in understandable terms.

The contracts will be hosted on @monad (which-net? can't say yet!).

We'd also like to thank @sigp_io and @immunefi for making the event possible.

Over the next few days we'll more details about the rules, teams and more. Watch this space...

Sign up in the Luma next!

[RareSkills @RareSkills_io]

Something is happening.

[RareSkills @RareSkills_io]

We just published another batch of tutorials on Solana development.

It's over 40,000 words spread across 12 new tutorials.

As usual, we go into extreme depth. Where it aids teaching, we visualize the layout of serialized data in accounts and walk through the core Rust source code.

Topics include:

- A deep dive into the SPL-Token and Token-2022 program and the accounts they use

- How to implement metadata with Metaplex and Token-2022 (and how they work under the hood)

- Time-travel testing with LiteSVM

- The math behind the interest-bearing extension in Token-2022

- Signatures and instruction introspection

And others!

Check the Solana Tutorial page for the latest.

We would like to thank the Solana Foundation for supporting this work.

Link next.

[RareSkills @RareSkills_io]

Today, it literally pays to be part of RareSkills.

If you completed a RareSkills bootcamp, you are eligible for a @monad airdrop.

We are beyond grateful to Monad for inviting our community to be part of this.

We're also cooking something very exciting with Monad that will be revealed in Argentina, so stay tuned!

💜💜