Minebuu.eth (theo/acc)

Web3 Security Researcher at @chainlight_io @theori_io

[Minebuu.eth (theo/acc) @minebuu_]

@caplabslimited This does not even properly compensate for the YT losses. I incurred more than $20,000 in losses (-$24,384.8), but the Stabledrop page shows compensation of only 4,893.7 cUSD.

Address: 0x4fbEde53b59D1a2Ab85F785ad76E1dcD66A1546A

[Minebuu.eth (theo/acc) @minebuu_]

Primus는 web2 데이터를 web3에 쉽게 연결할 수 있기 때문에 다양한 앱이 가능

> Primus의 zkTLS는 HTTPS(TLS)로 받은 Web2 데이터를, 서버의 도움 없이도 진짜임을 증명할 수 있는 기술
> 은행 사이트에서의 내 잔고 내역, 민원 24에서의 내 신원 정보, 신용 평가 기관에서의 내 신용 점수들을 블록체인에서 인증할 수 있음
> 가령 해당 유저의 신용 점수가 900점 이상인가?를 zkTLS를 통해 개인정보 노출 없이 인증이 가능함
> 블록체인에서는 900점 이상의 신용 정보를 가진 유저에 대해 무담보 대출을 수행해주거나, 특정 나라의 유저만 에어드랍 클레임이
가능하게 하는 등 다양한 시나리오가 가능함
> 여기서 주목하는건 web2 신용을 web3에 가져오는 것. 최근 무담보 web3 대출앱들이 보이는데, web2의 신용정보를 기반으로 web3 앱들이 더 정확한 이자 모델, 리스크 모델을 구축할 수 있음
> 즉 web2 신용을 이용한 web3 무담보 대출도 가능

[Wecryptotogether (Theo/acc) @Edward__Park]

🍊 Rewind Primus AMA for seeking WEB3 new phase

Xiang Xie (@xxiang_xie) said

Primus is a solution that enables real-world data, which is necessary for building various applications in Web3, to be brought on-chain and verified without exposing sensitive information.

Through this, Primus enables use cases such as proof of deposits in DeFi, and in the AI agents sector, it allows agents to prove the information they need and the actions they have completed in a trustless way, without relying on third parties. This expands the scope of what these sectors can do and makes broader product development possible.

This kind of solution is an essential component for Web3 to move beyond degen culture or crypto-native use cases and enter a much larger arena. Beyond mainnet, Primus acts as an enabler that helps diverse dApps adopt and apply this technology stack.

Discover what kind of ecosystem they are building and what plans they have through our recent podcast.

[Minebuu.eth (theo/acc) @minebuu_]

Let’s check a few facts about this market:

1. According to both the API results and what users saw in the mobile app, the end date was set to July 1 (https://t.co/joDxlLHtku)

2. The rules did not specify a concrete final source-data cutoff date.

3. In practice, determining a company’s sales activity through May 31 requires some reporting delay. Traders were generally waiting for Strategy’s 8-K filing to confirm whether any sales had occurred.

The fundamental issue is that the rules set by Polymarket were not sufficiently clear. To determine whether sales occurred by May 31, it is reasonable to rely on the company’s official disclosures. If that was not the intended approach, the rules should have explicitly defined a final cutoff date for acceptable data sources.

What makes this even more surprising is that similar controversies have occurred before (https://t.co/mSAp24JdJr ), yet the rules were still written in such an ambiguous manner.

It is even more unfortunate because the market’s open interest has now grown beyond $100 million, making it practically impossible to resolve the situation in a way that satisfies everyone, whether through a refund or some form of universal settlement.

[willo2 @willo2_Poly]

I was just scammed for $500K by Polymarket.

I am "willo2", the top holder of YES on "MicroStrategy sells Bitcoin by May 31st".

Here's what happened:

[Minebuu.eth (theo/acc) @minebuu_]

@Edward__Park Goat

[Minebuu.eth (theo/acc) @minebuu_]

@RailgunIntern Notes

[Minebuu.eth (theo/acc) @minebuu_]

@RailgunIntern

How about building the following toy project to celebrate the launch of Kohaku?

>Tentative name: https://t.co/o3loP6YhcO
> When launching a memecoin, fundraising can only be done with RAILGUN private notes
> Once liquidity reaches $50K and the pool is launched, a memecoin-ETH pool is created on Uniswap v4
> Through a Uniswap v4 hook, swaps are restricted so that they can only be executed via RAILGUN Relay Adapt
> In other words, traders are encouraged to use RAILGUN’s privacy engine (However, third parties may still create separate pools and trade the token non-privately)
> As memecoins on the anon platform become more popular, this would naturally increase RAILGUN adoption, grow the number of wallet installs/users, and drive higher RAILGUN fees

[Minebuu.eth (theo/acc) @minebuu_]

@FuzzingLabs @Ectari0 The way the article unfolds is quite impressive. I really enjoyed reading it from beginning to end

[Minebuu.eth (theo/acc) @minebuu_]

@CryptoChunhyang 레전드 정성글 ㄷㄷ

[Brian Pak @brian_pak]

Time to talk about this one.

CopyFail (CVE-2026-31431) — a 732-byte Python script that roots every Linux distro shipped since 2017. 🧵

[Minebuu.eth (theo/acc) @minebuu_]

https://t.co/uBevfdxqYC

[Minebuu.eth (theo/acc) @minebuu_]

@rsquare @SafeLabs_ Check this out

https://t.co/QQ19UABtpV

[Theori @theori_io]

Xint vs. Anthropic Mythos: Who wins in the real world? 🥊

Finding a bug is easy; finding the right bug in 9 million lines of code is the hard part.

Check out our latest whitepaper on how #Xint found every single bug in the #Mythos report plus 12 additional mid- to high-severity vulnerabilities.

[Xint @xint_official]

Big news: Samsung Electronics selected Xint as a strategic tool to overcome the limitations of traditional manual security audits and to eliminate security blind spots. Leveraging AI on top of Theori's expertise as world class hackers, Xint autonomously analyzes the structure and context of services within complex infrastructures. This allows it to identify potential penetration paths from an actual attacker's perspective, even within frequently updated hybrid cloud environments.

https://t.co/gXqERYZezp

[Xint @xint_official]

Anthropic is (rightfully) generating a lot of attention for Mythos’s ability to find 0days, BUT the hard problem is not whether an LLM can recognize a bug when pointed at it; it is whether a system can find the right code to examine across a 9-million-line codebase, distinguish the one real vulnerability from the hundreds of theoretical weaknesses the model will flag along the way, and deliver output a developer can act on without wasting a week on false positives.

This is something Xint has been doing since our wins at AIxCC and #ZeroDayCloud last year. We wanted to see if using publicly available models with the right scaffolding would reach the same performance as the latest limited-release frontier model under **real world conditions**

In this research paper not only did we find all the same bugs highlighted in Anthropic’s report, but found an additional 12 mid- to high-severity vulnerabilities not included in their public disclosures.
Check out the full report here:

https://t.co/N0SfoyvMpk

[Minebuu.eth (theo/acc) @minebuu_]

@say_yes_say_yes @dyli_io @AbstractChain Big foot

[Minebuu.eth (theo/acc) @minebuu_]

@felixprotocol 👀

[Minebuu.eth (theo/acc) @minebuu_]

@0xCygaar @privy_io Nice work!

[Minebuu.eth (theo/acc) @minebuu_]

I left Dubai yesterday on a flight to Taiwan and have now returned home to Korea.

It is possible to make new bookings. However, the key is to secure a flight that will actually operate. Therefore, it helps to book as many flights as possible and take the one that actually departs.

In my case, I booked a flight to Taiwan that appeared as on-time in the FlightRadar24 app but was marked as canceled on the Dubai Airports website. Later, the status on the Dubai Airports site changed from canceled to on-time, and the flight ended up operating. This is just my personal experience, but it might be helpful to also refer to FlightRadar24 data.

[Minebuu.eth (theo/acc) @minebuu_]

The @AbstractChain team has just released an MCP server for AI Agents. For now, it seems to only support reading AGW and chain values, but it looks like it may soon be able to generate transactions through AGW as well.

What I find especially interesting is the combination of AI and Smart Wallets. AGW, as a Smart Wallet, supports session functionality, which means I can delegate my AGW to an AI Agent on a per-session basis.

The code below is AGW’s SessionLib contract. If you look at 'SessionSpec', you’ll see things like 'feeLimit' and 'callPolicies'.

What does that mean? Unlike a typical EOA, it means you can configure detailed permissions for an AI Agent, such as allowing it to call only specific contracts, use only certain tokens, or spend only up to a certain amount. So even if I entrust my wallet to an AI Agent, I would not be handing over all of my assets. Instead, I can set much safer and more fine-grained permissions. I’m excited about the future!

[cygaar @0xCygaar]

🦞 Introducing the Abstract MCP Server 🦞

Agents can now manage Abstract global wallets, read Portal data, and interact with the chain.

This server works with any MCP-compatible client including OpenClaw and Claude.

[Minebuu.eth (theo/acc) @minebuu_]

@WakeFramework @Google 👍

[Minebuu.eth (theo/acc) @minebuu_]

Gemini 3.1 Pro-Powered Detector for the Solidity “Transient Storage Clearing Helper Collision” Bug

https://t.co/ItHKO8BJG0
https://t.co/UpDKvZT9Ne

Using @Google's newly released Gemini 3.1 Pro model today, I built a tool that detects the Solidity Compiler high-severity vulnerability disclosed two days ago: the Transient Storage Clearing Helper Collision Bug.

You can visit the site and either drop your project folder, or clone the repo and run an easy check from the CLI. No internet connection is required, and the scan runs locally. Your source code is never uploaded to a server. If you’re worried your project might be affected, give it a try!

The core logic took under an hour to build, and after adding several exception and edge cases, the static tool now covers most scenarios. One caveat: if you import libraries like OpenZeppelin or Solady but they aren’t present in the same local folder, the verification may not work correctly.

FYI: The video below is also a virtual demo generated with Gemini.