Matt Weatherilt

Cardano, Governance, upgrades: what’s actually happening. Florida. Dogs and Cats too.

[Matt Weatherilt @nftmatt]

Ledger’s (@Ledger) signature reporting only hits wallets built on its Ethereum or Solana kit.

Lace, Yoroi, and Eternl sign Cardano with a separate library, so your ADA signatures there aren’t reported this way.

Keeps your metadata yours and not someone else’s.

[superKalo.eth @0xSuperKalo]

Follow up: I found something even more absurd ⚠️

Since context-module 2.7.0, Ledger's SDK sends a SECOND report on every signature, to /v2/blind-signing-events, now with the function selector too.

It's on by default, and unlike v1, the SDK gives no option to replace or disable it. So any wallet that turned off the v1 report starts sending again after a routine update.

Their signer kit changelog says it plainly: "Require context-module 2.7.0 (sign reporter enabled)"
https://t.co/qGGBH5umaF
https://t.co/JxO0AUt0hx

Alongside @ambire, @Rabby_io also caught the v1 report from my post below 👏 They replaced Ledger's v1 reporter with a local callback that sends nothing:
https://t.co/hNMwpgVfPN

But they're still on 2.1.0, which has no v2 reporter yet. The day they update, v2 goes out anyway unless they catch it. So heads up, fellow wallet devs: the builder has no setter for the v2 reporter, so you need to gate `signReport` on the built module yourself.

Ambire is safe because we're not on 2.7.0. Since Ledger gives no setting for the v2 reporter, our next SDK update overrides it in code, so it follows the same opt-in privacy toggle we already use for v1 (off by default).

@Ledger, is this a test to see if we're paying attention?

I guess at this point we should review every SDK update line by line.

[Matt Weatherilt @nftmatt]

Across (@AcrossProtocol) lost control of its domain.

Its registrar believed a stranger's story, and that person could disrupt your life. If you have a product or service that runs through a company that has a support desk, you can also be affected by this.

[Across @AcrossProtocol]

The Across domain is currently down while we secure it against an attack from earlier today.

At ~18:45 UTC, a social engineering attack on @Namecheap (our domain registrar) gave a bad actor control of the Across domain.

Within 15 minutes of this attack, we were alerted and immediately worked to shut the site down. SEAL911 marked across.(to) as a phishing site with major wallets, and Cloudflare worked with us to mark the domain as at risk, and later pulled the site’s DNS records.

At the time of this post, Across.(to) is fully down, and the phishing site is no longer available.

In the brief period before Cloudflare fully blocked the malware site, some users who visited across.(to) may have been affected. No third-party integrations or API users were affected. Users who believe they were affected should DM us with transaction details and revoke attacker permissions (see next tweet for details).

Despite our best efforts, @Namecheap has been unresponsive, and we have not been able to properly secure the domain to bring Across’s services back up. Across’s frontend and API will remain down until we can properly secure them. We will always put user safety first.

Across’s domain was fully locked down with best-in-class security practices; this unauthorized takeover should not have been possible. We will be investigating this deeply and will provide a post-mortem on how this domain takeover was possible once we have more information.

[Matt Weatherilt @nftmatt]

@ItsDave_ADA In plain words, you prove you know something without giving it away.

[Matt Weatherilt @nftmatt]

@ItsDave_ADA 75% of the way to mainnet. Good to see Peras moving ⚡

[Matt Weatherilt @nftmatt]

@ingcripto @Cardano Paying fees in the token you already hold makes that first transaction a lot simpler 🙌

[Matt Weatherilt @nftmatt]

@Dave__Dionisio Backing this. Monitors collect and present, and DReps make every spending call.

[Matt Weatherilt @nftmatt]

@kenerik @Cardano_CF @Laura_Mattiucci @NicolasC3rny What should they measure so DReps can tell later if it worked?

[Matt Weatherilt @nftmatt]

@Lucasdb86 Backing IBC’s new home is a good start 🙌 If Cardano’s own bridge is still in pre-production, shipping it will make that count.

[Matt Weatherilt @nftmatt]

Logging in with Google isn’t holding your keys.

A flaw at Web3Auth (@Web3Auth) exposed keys behind some Keplr (@keplrwallet) social login wallets. Seed phrases and hardware wallets were fine.

Ada holders: no seed means someone else’s setup may hold part of your key.

[Pete @astroboysoup]

🚨 Social login wallets exposed

A flaw at @Web3Auth exposed the private keys behind some @keplrwallet Google and Apple login wallets.

How the login works, the rescue, the numbers, and what it means for Cardano 👇

https://t.co/jEKiJfTdpg

Not financial advice.

[Matt Weatherilt @nftmatt]

@adaplusplus If Midnight brings in new users, Cardano gets a shot at them too 🤝

[Matt Weatherilt @nftmatt]

@hix_coffeepool The Docker detail is easy to miss. An override in the old format can silently do nothing with the new settings files.

[Matt Weatherilt @nftmatt]

Paraguay’s Ueno Bank shut overnight.
About 2.9 million customers’ savings frozen.

When your money sits on someone else’s books, they control access.

That’s why Ada holders keep their own keys.

[Charles Hoskinson @IOHK_Charles]

If only we had a technology where you could access your money 24/7 and you don't have to trust anyone https://t.co/sMKZaYM8TI

[Matt Weatherilt @nftmatt]

@BKINDSPO The disclosure proposal is a start. The map still needs to specify what each body can decide and how people get those seats.

[Matt Weatherilt @nftmatt]

@RausiFi Quiet for years is real. Respect to the few still showing up 🫶

[Matt Weatherilt @nftmatt]

@Lucasdb86 Core engineering used to sit in one house. Now it’s spread across seven firms.

[Matt Weatherilt @nftmatt]

@cauu_128 What’s the one thing you wish delegators did beyond staking?

[Matt Weatherilt @nftmatt]

@CryptoRichBlog First block on day nine. Congrats on CRICH 🎉

[Matt Weatherilt @nftmatt]

@CSWAP_Destroy Put a salary on it, and you get career politicians. The DReps worth trusting already have skin in the game: their ADA 🗳️

[Matt Weatherilt @nftmatt]

@planetmaaz If you had to pick the one bet that unlocks the others, is it the new token standard or more liquidity?

[Matt Weatherilt @nftmatt]

@Lucasdb86 What would you want to see from the first few events before funding all 12?