Olam

Shiller //Web3 🕸️ //Crypto 🪙//LVZMH598
@inventmoneyapp

[Olam @olamt8]

https://t.co/WvfIpcyQOx

[Olam @olamt8]

@DeepSafe_AI C. Atomic prevents race, not stale truth. Checked fact's age depends on origin.

[DeepSafe @DeepSafe_AI]

Weekend puzzle.

A contract checks a condition, then acts on it. Both in the same transaction, atomically.

How old can the thing it checked be?

A. Zero. It's atomic.
B. One block at most.
C. Depends on where the fact came from.

[Olam @olamt8]

AI is getting more autonomous, which makes blind trust a bigger risk.

@DeepSafe_AI is interesting because it focuses on making AI security something that can be verified, not simply assumed.

#DeepSafe

[Olam @olamt8]

AI security is not just about stopping attacks. It is also about proving that AI systems can be trusted.

That focus on verifiable security is what makes @DeepSafe_AI worth watching.

#DeepSafe

[DeepSafe @DeepSafe_AI]

On 16 September, Lombard deprecated native minting and redemption of LBTC and BTC.b on five chains — TAC, Sonic, Katana, Berachain and Starknet. Holders on the first four are required to bridge balances to Ethereum by December 10. Starknet keeps its bridge, and its balances have no deadline.

Underneath that sits a second change, and it is the more interesting one.

Bridging moves to a hub and spoke model. From the docs: "every supported chain has a bridge lane to and from Ethereum, and a transfer between two other chains routes through Ethereum rather than directly." Minting from native BTC is unaffected. What changed is how already-minted assets move between chains.

The reason is stated plainly: "Fewer bridge contracts and message paths mean a smaller surface to secure and monitor, and security budget and engineering resources concentrate on the lanes that carry the most value."

Worth being precise about what actually shrank. Not the number of chains — every other chain continues, and you can still mint from native BTC on any of them. What shrank is the number of routes between them.

Those are different quantities. In a mesh, routes exist between pairs, so each chain added arrives with a new lane for every chain already there. In a hub and spoke, a chain arrives with one.

The count that goes in the announcement is chains supported. The count that has to be secured and monitored is lanes. A topology decides which of the two grows faster, and that is the decision this update actually makes.

https://t.co/99C3WipeAW

#DeepSafe #Web3Security

[Olam @olamt8]

@DeepSafe_AI Interesting how route complexity scales differently than chains.

[Olam @olamt8]

Hub and spoke cuts the security surface by reducing routes, not chains. That distinction matters more than the headline.

[DeepSafe @DeepSafe_AI]

On 16 September, Lombard deprecated native minting and redemption of LBTC and BTC.b on five chains — TAC, Sonic, Katana, Berachain and Starknet. Holders on the first four are required to bridge balances to Ethereum by December 10. Starknet keeps its bridge, and its balances have no deadline.

Underneath that sits a second change, and it is the more interesting one.

Bridging moves to a hub and spoke model. From the docs: "every supported chain has a bridge lane to and from Ethereum, and a transfer between two other chains routes through Ethereum rather than directly." Minting from native BTC is unaffected. What changed is how already-minted assets move between chains.

The reason is stated plainly: "Fewer bridge contracts and message paths mean a smaller surface to secure and monitor, and security budget and engineering resources concentrate on the lanes that carry the most value."

Worth being precise about what actually shrank. Not the number of chains — every other chain continues, and you can still mint from native BTC on any of them. What shrank is the number of routes between them.

Those are different quantities. In a mesh, routes exist between pairs, so each chain added arrives with a new lane for every chain already there. In a hub and spoke, a chain arrives with one.

The count that goes in the announcement is chains supported. The count that has to be secured and monitored is lanes. A topology decides which of the two grows faster, and that is the decision this update actually makes.

https://t.co/99C3WipeAW

#DeepSafe #Web3Security

[DeepSafe @DeepSafe_AI]

A system that checks something ends up with an answer to what happens when the check cannot run.

Not when the check fails — when it is unavailable. The service is down, the endpoint times out, the attestation cannot be retrieved, the quorum cannot be assembled. The request is still there, and the system still has to decide what happens to it.

The two simplest answers are to let it through or to hold it. Real systems have more room than that — retry, queue, fall back to a weaker check, cap the amount, route it to a person — but each of those still resolves into proceeding or not, and each has its own behaviour when the fallback is unavailable too.

Both directions are defensible. A payments system that holds every transaction whenever a fraud check is unreachable has converted an availability problem into an outage. A vault that releases funds whenever its verifier is unreachable risks turning an availability problem into a withdrawal. Which cost is worse depends on what is being protected, and reasonable teams land in different places.

What is worth noticing is that the answer can exist without ever having been an explicit design decision.

The behaviour ends up wherever the error path happens to go. A timeout can return a permissive default. A general exception handler can let execution continue. A check added late can be wrapped in a conditional that skips it when a dependency is missing. The code may never contain a line reading "if verification is unavailable, proceed" — but that can still be exactly what it does, and it will do it just as readily when someone is making the checker unavailable on purpose.

This is why the choice is worth writing down before it is discovered. A system that fails open by decision has weighed the trade. A system that fails open by accident has the same behaviour and none of the reasoning, and it learns which one it is from an incident rather than from a design review.

For a verification layer the question is sharper, because an attacker may target its availability rather than defeat the check itself. If no result means no check, then the verifier does not have to be broken. It only has to be kept from answering.

CRVA changes the dependency rather than removing the question. The Agents that sign are selected at random from a larger population and rotate on a fixed cycle, and under threshold MPC a valid signature requires enough participants to contribute, so no single participant can produce one alone. That reduces reliance on any one verifier. It does not guarantee that a result always arrives, and it does not settle what the surrounding system does when one does not. That stays with whoever integrates the check — which is the same decision this whole piece is about.

Every system has an answer to this. The question is whether anyone chose it.

#DeepSafe #CRVA #Web3Security

[Olam @olamt8]

@DeepSafe_AI Security gets interesting when the verifier goes silent and the system must choose.

[Olam @olamt8]

DeepSafe keeps the Web3 journey safer, spotting threats before they become expensive lessons. #DeepSafe @DeepSafe_AI

[Olam @olamt8]

DeepSafe keeps the Web3 journey safer, spotting threats before they become expensive lessons. #DeeepSafe @DeepSafe_AI

[Olam @olamt8]

The interesting part is that nothing was stolen, but timing still broke accounting. Fixing it required proving what each balance should have been.

[DeepSafe @DeepSafe_AI]

On September 5, Core DAO published its post-mortem on the reward-accounting exploit that ran from August 28 to 31. Roughly 255M CORE of rewards were issued ahead of schedule.

The cap held. In Core's words, the exploit "did not create any CORE beyond the protocol's limits; the 2.1B maximum supply was never violated." What it did was accelerate rewards the emission schedule would otherwise have released later. What broke was when.

That makes the damage an unusual shape. No user or staking account was drained — Core states that no user or staker funds were lost and that delegated stake was never at risk. What existed instead was surplus, sitting in balances, and it arrived through the ordinary path: the extra rewards "appeared both in attacker-controlled addresses and, unintentionally, in the reward addresses of honest validators who simply received an inflated payout they did not cause."

That made the on-chain reconciliation an arithmetic problem before it was a balance-editing problem. Before any affected balance could be corrected, Core needed a rule for what that balance should have been at the upgrade block.

It used two. Attacker-controlled reward pools were set to zero. For affected honest validators, it defined a fair-earnings floor — the pre-incident balance plus three rounds of that validator's own normal reward — left balances at or below it untouched, and removed only the excess above. Together the reconciliation took 186,153,491 CORE out of supply by direct state reduction. A further ~69M had been moved before the upgrade and sits outside what an on-chain reconciliation can reach; Core says it is pursuing that with law enforcement.

Core says the reconciliation can be checked independently against chain state at the upgrade block, and that the reward paths were subsequently reviewed by Halborn. That part matters as much as the fix. A correction that affected users and independent observers cannot verify is only a second assertion about the balances.

A supply cap is a promise about how much will ever exist. It says nothing about how much should exist yet. Restoring the second one requires knowing a number the cap never had to track.

Sources:
https://t.co/TMhZdwRHaQ
#DeepSafe #CRVA #Web3Security

[Olam @olamt8]

@DeepSafe_AI The key issue is rollback’s blast radius, fixing one exploit can erase legitimate user activity alongside the attacker’s transactions.

[DeepSafe @DeepSafe_AI]

Cronos halted on Sunday after an exploit on Tectonic. On Monday it said block production had resumed and that the chain state had been restored to before the exploit. It called that a validator-consensus emergency action. Tectonic said it would reopen in phases once its own checks clear, beginning with withdrawals and repayments while deposits and borrowing stay paused. Neither team has confirmed a loss figure, and both say a full post-mortem is coming.

Cronos resumed from block 90,896,189. The Defiant puts that 10,961 blocks behind the branch users had already watched confirm, roughly one hour and 54 minutes of chain history. On the new canonical chain, the attacker's Cronos-side gains no longer exist. The portion that had already crossed to Ethereum does. PeckShield and Lookonchain both tracked about 2,592 ETH, worth roughly $6.29M at the time, that reached Ethereum before block production stopped.

One exploit, three outcomes. What reached Ethereum stayed beyond the rollback's reach. The attacker's Cronos-side gains were removed from the canonical state. And so were the trades, transfers and liquidations of people with no connection to the exploit — confirmations they had already watched land inside that window.

The rollback did not separate exploit transactions from ordinary ones. It separated only what Cronos validators could rewind from what they could not. As of September 1, neither team has published an accounting of how those unrelated transactions will be handled, or whether any of them can be replayed.

This is not an argument that the rollback was right or wrong, and it is not a claim about decentralisation. The narrower point is what this remedy requires and how far it reaches. It requires validator consensus. It reaches only the chain those validators run. And it invalidates every prior confirmation inside the history it replaces, no matter whose transaction it was.

CRVA does not remove the need for emergency controls, and it would not have prevented the flaw inside Tectonic. The narrower distinction is the unit of refusal. Where an applicable check already sits in the execution path and its result is enforced, one request can be refused without an ad hoc validator intervention that replaces unrelated chain history.

The chain is back. The exploit's Cronos transactions are out of the canonical state. What is still open is everything the rollback could not reach, and everything else it reached on the way.

Sources:

https://t.co/fgxVSZif8s

#DeepSafe #CRVA #Web3Security

[Olam @olamt8]

@CosmicSignature Solid math,but factor in ETH gas fees too.

[𝒞𝑜𝓈𝓂𝒾𝒸 𝒮𝒾𝑔𝓃𝒶𝓉𝓊𝓇𝑒🦇🔊 @CosmicSignature]

Should I bid with ETH or CSTs right now?

Current Price to Gesture with ETH: 0.092 ETH (or $221)

This is equal to ~225-230 CSTs (since CST price is dynamic).

So every time, CST price gets under 225 CSTs, its cheaper to bid with CST instead of ETH.

When CST price is above 225, its better to bid with ETH.

Before making a move, always calculate the $$ cost of your gesture in CSTs and ETH.

Then go for the cheaper option.

[𝒞𝑜𝓈𝓂𝒾𝒸 𝒮𝒾𝑔𝓃𝒶𝓉𝓊𝓇𝑒🦇🔊 @CosmicSignature]

To elaborate:

Every time you make a bid in the game with your CSTs, our game contract burns them.

So the more the game is played, the lesser the CST supply.

This is our way of controlling CST inflation.

This is why CST tokenomics are "absolutely incredible"

[Olam @olamt8]

@CosmicSignature The idea is pretty straightforward: more gameplay means more CST gets burned, helping keep the supply from growing too much.

[Olam @olamt8]

@JoshptD8 @ajascoke Good morning

[Olam @olamt8]

@Candlequeen8875 @tipmotion @motiontip 286