nervouspika

Be the best cook in web3 security @CertiK

[nervouspika @nervouspika]

@thsottiaux em, cooked or cooking? 😂

[nervouspika @nervouspika]

@thsottiaux I hadn’t even used up the last reset yet 😭

[nervouspika @nervouspika]

@Aptos A few notes on how MonoMove compares with the existing VM:

https://t.co/SChfJ5cuEI

[nervouspika @nervouspika]

Aptos is rebuilding its Move execution engine with MonoMove.

An initial note about a few things worth comparing with the existing VM: how it executes bytecode, represents values, enforces checks, and charges gas. (According to Oct 6, 2026 source snapshot.)

https://t.co/MoHX7BC6VB

[nervouspika @nervouspika]

Tests span function-level comparisons (returns, events, errors), gas-disabled transaction replay (status, write sets, events), Aptos suites with MonoMove enabled, and a Lean differential harness.

A few notes from a first pass. More detailed analysis later.

https://t.co/uQp8r0W0FS

[nervouspika @nervouspika]

Aptos is rebuilding its Move execution engine with MonoMove.

An initial note about a few things worth comparing with the existing VM: how it executes bytecode, represents values, enforces checks, and charges gas. (According to Oct 6, 2026 source snapshot.)

https://t.co/MoHX7BC6VB

[Aptos @Aptos]

Introducing MonoMove, Aptos' new execution engine and the biggest scalability upgrade in network history.

Moving global markets onchain takes a new standard of speed and safety. MonoMove delivers both, executing the smart contracts behind every onchain market up to 55x faster.

Money is moving onchain. Aptos has the engine to run it.

[nervouspika @nervouspika]

Instruction gas is charged before each basic block runs, via function entry or a jump. Type-dependent costs become constants at instantiation. The numbers are placeholders; native execution and storage fees are still uncharged.

https://t.co/2TNhHM4brV

[nervouspika @nervouspika]

@subql/[email protected] has been reported as malicious by StepSecurity.

The SDK versions listed below are a non-exhaustive set with direct or transitive dependency ranges that include @subql/[email protected].

Direct dependencies on @subql/common:
@subql/[email protected]
@subql/[email protected]
@subql/[email protected]
@subql/[email protected]
@subql/[email protected]

Indirect dependencies:
@subql/[email protected] → @subql/[email protected]
@subql/[email protected] → @subql/[email protected]
@subql/[email protected] → @subql/[email protected]

A compatible range doesn't prove that 5.8.3 was installed. Check the resolved version of @subql/common in your lockfiles and build artifacts.

https://t.co/aZ0R9A5lnZ
https://t.co/jJJu8I4NUQ

[nervouspika @nervouspika]

@zkp123456 🫡

[nervouspika @nervouspika]

@solana_devs Heads up for anyone upgrading:

https://t.co/lZffkx1qNl

[nervouspika @nervouspika]

web3.js 3.0.0 keeps the familiar API, but two changes matter when upgrading from V1(like 1.98.4):

1. Default commitment. With none set, v3 sends confirmed where v1 omits it.

2. Response checks. Of six injected malformed replies, v1 rejected all six; v3 returned four.

Repro below.

[nervouspika @nervouspika]

Staying on v1? Pin major 1.

Moving to v3? Read the official migration guide: https://t.co/cIuiDCMexT

Samples in thread: https://t.co/Or8Xm7mpMd

[nervouspika @nervouspika]

web3.js 3.0.0 keeps the familiar API, but two changes matter when upgrading from V1(like 1.98.4):

1. Default commitment. With none set, v3 sends confirmed where v1 omits it.

2. Response checks. Of six injected malformed replies, v1 rejected all six; v3 returned four.

Repro below.

[Solana Developers @solana_devs]

npm install @solana/[email protected]

[nervouspika @nervouspika]

Two more Node behaviors: in v1, JSON.stringify(keypair) and console.log(keypair) expose private-key bytes; v3's output does not. The key remains readable via secretKey.

If a rent-exemption RPC call returns a JSON-RPC error, v1 warns and returns 0; v3 throws.

[nervouspika @nervouspika]

If you still have funds on Blast, including the PWA, check this announcement. Withdrawals will pause for roughly a week while Lido positions are unwound. The normal withdrawal UI stays available until Oct 26; after that, withdrawals will require direct L1 bridge interaction.

[Blast @blast]

Blast will be shutting down.

We launched Blast with the goal of building a self-sustaining chain for users and developers. Unfortunately, the economics of operating the chain no longer make sense: the ongoing costs of maintaining Blast exceed the revenue generated by the L2, and we do not see a credible path to making the chain economically sustainable.

As a result, we've made the difficult decision to wind Blast down.

We're sorry to the users and developers who believed in Blast, built on it, and supported the ecosystem. Our priority now is making the shutdown as smooth and safe as possible.

We're asking all users to withdraw their assets from Blast to Ethereum mainnet, including any balances held in the Blast PWA.

To make this easier, we will be reducing the withdrawal delay to 24 hours.

As part of the shutdown process, we'll first begin withdrawing Blast's Lido assets. This process is expected to take approximately one week. During this period, withdrawals will temporarily be unavailable, even after the withdrawal delay is reduced to 24 hours.

Once that process is complete, withdrawals will resume with the new 24-hour delay.

Users will have until October 26, 2026 to withdraw through the normal Blast interface.

After October 26, assets will remain withdrawable, but users will need to interact directly with the Blast bridge contracts on Ethereum L1. We'll publish detailed instructions before then.

We strongly encourage everyone to withdraw their assets to Ethereum mainnet before October 26.

[nervouspika @nervouspika]

Two recipient-initiated calls to HOT Bridge Treasury released 330k + 35k BSC-USD—not direct Treasury EOA transfers. Signing-key compromise remains unproven. Stay safe!
https://t.co/unH3e5RptM
https://t.co/7RL5ewfFNw

[NEAR Intents @near_intents]

Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.

The preliminary report indicates the total loss of approximately $3.8M. These funds will be compensated in full.

The contract-side vulnerability has been patched. The operations of the NEAR Intents and near(.)com are expected to resume within 1h.

Deposits and withdrawals on the following networks will remain unavailable for an additional ~12 hours while fixes to the Omni infrastructure are completed: BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma.

In case users hold any assets from these chains inside NEAR Intents (for example, in HOT wallet or on near(.)com), they will be able to swap them into other assets once NEAR Intents is back up (in ~1h).

The incident has been reported to law enforcement, and we are working with security and blockchain analytics partners to trace the funds and pursue recovery. A detailed report will be shared publicly in the following days.