Mike Tiutin

Blockchain solution architect and CTO

[Mike Tiutin @mtiutin]

@DefuseSec @trondao for the record: this whole check was triggered by Taylor Hornby's zcash work (disclosure from @zooko). credit @DefuseSec and thanks for the detailed worklog. to others relying on the zcash codebase: "derived from zcash" isn't an audit. forks need their own. /end

[Mike Tiutin @mtiutin]

in may, Taylor Hornby (@DefuseSec) used claude opus 4.8 to find a counterfeiting bug in zcash's orchard pool: one missing constraint = unlimited undetectable ZEC.

TronZ (@trondao) shielded USDT is "based on zcash", ~$1.02M in the pool. cooked too?

spent a day checking. thread

[Mike Tiutin @mtiutin]

@DefuseSec @trondao the contract: global nullifier set + anchor checks kill cross-tx double spends, and the precompile rejects dup nullifiers inside one tx. fully collateralized, no admin key, no drain fn.

all 3 surfaces clean. nothing exploitable found. cc @trondao

[Mike Tiutin @mtiutin]

17 years of Android openness are at risk (just got it from my F-Droid). Google's plan to block unregistered apps is a direct hit on independent software (true). For me it's one more reason to migrate daily routines to Graphene and leave Google's just for its maps and parking app

[Mike Tiutin @mtiutin]

9 MCP bridges (npx mcp-remote) were eating ~855MB and OOM-killing my @NousResearch Hermes agent gateway. Rewrote it in Rust as a drop-in: same CLI, ~2MB each. it's yours:

https://t.co/fPOB4pcXhA

[Mike Tiutin @mtiutin]

@ClaudeDevs @claudeai Make sure you check `~/.config/anthropic/credentials/default.json` file. Thanks @frozenzeus for finding this and replying here in comments.

[Mike Tiutin @mtiutin]

To those going to Code w/ Claude workshops/events — spend 10 min creating separate macOS user for workshop/demo stuff. Seriously. Can save you days. CC @ClaudeDevs @claudeai My own story 👇

[Mike Tiutin @mtiutin]

12/ Then came restoring plugins/hooks/skills/memories/IDE integrations carefully filtering configs not to re-injecting broken creds back into system. Whole workday gone.

So yeah. If you’re attending workshops where you’ll experiment with API orgs, managed agents, temp keys, weird auth flows etc — isolate that stuff into separate macOS user from the beginning.

Future you will be extremely grateful.

[Mike Tiutin @mtiutin]

@ClaudeDevs @claudeai 11/ Only after removing literally everything Claude-related from system, rebooting macOS again, reinstalling Claude Code from scratch — finally:
claude auth status → unauthorized.
Fresh login. Subscription restored. Finally fixed.

[Mike Tiutin @mtiutin]

@ClaudeDevs @claudeai 10/ Important detail: even after logout, claude auth status still claimed authenticated. It never returned: “unauthorized”. That’s what made debugging especially confusing.

[Mike Tiutin @mtiutin]

9/ So now it’s obvious: some deeply buried user-level auth/cache state poisoning everything. Spent next ~3 hours deleting basically every Claude/Anthropic/Cowork-related thing from my user dir. Configs, caches, binaries, Application Support, keychain entries manually. Multiple restarts.