petar | Spectra

sc lead @spectra_finance 🚀simplicity is key! Prev @Ledger innovation lab. AI Msc @ScienceSorbonne

[petar | Spectra @petercalic99]

Buckle up
@spectra_finance

[petar | Spectra @petercalic99]

Just finished reading @Morpho midnight's whitepaper.
A recommended read for every engineer in defi:

A smart and simple design when possible, every complex component earned its place and is justified.

The code reflects those principles. Every component was well thought through.

[petar | Spectra @petercalic99]

Setting a min on the release date in the npm config and disabeling scripts should be the default setting today.

Still doesn't solve the security issue but raises the bar.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you.

The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads.

The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate.

Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.

[petar | Spectra @petercalic99]

I tried a few courses but they don't train the brain for auditing really as its more about practice and intuition than theoretical knowledge. For me the best way to progress is to try to audit real contracts and read reports later like previous contests etc. For beginners small contracts with simple logic. Often there are easy non critical bugs to be found.

[petar | Spectra @petercalic99]

There is no compromise with security, only highest standards are acceptable.🫡

[Spectra @spectra_finance]

Spectra is kicking off a security audit with @Certora

Scope covers core infrastructure ahead of upcoming releases.

Full details to be shared upon conclusion.

[Gaspard Peduzzi | Spectra @GaspardPeduzzi]

The Spectra team and I are at @EthCC Cannes, meeting with existing and new partners to discuss how Spectra, including the recently launched MetaVaults, can accelerate their business.

Find me today at the Poolside event hosted by @greenfield_cap @StakeCapital @lo_tech, Proof of liquidity, and Cinq à Sèpt by @StellarOrg @hypepartners and @WalletConnect

Tomorrow you'll find me at @Vault__Summit throughout the day.

DMs open!

[petar | Spectra @petercalic99]

@pashov @TimmyCwesi Could you elaborate why do you think it failed?

[eni 🍞 @eniwhere_]

https://t.co/wcrKW5wiA6

[Nicolas Bacca @BTChip]

Join me (02/04, Redford, 10h45) if you're curious about the different flavours of clear signing and if they make good CROPS, how 7730 sausages are made, or what happens when you pay Jean Claude to make a hardware signer but forget to ask for no mistakes https://t.co/5zWscqKApU

[petar | Spectra @petercalic99]

I thought i was leveraging skills well but turns out i there us much more we can do.
Here are my fav advices shared by Claude engineers:

- Skills can be much more complex structures than just md files. Make folders with examples, templates and boilerplate functions to help claude focus on the right tasks.

- Improve skills with Gotchas, on the fly add things Claude doesn't get right.

- This one takes experience but avoid suffocating Claude with information, he needs freedom to maneuver well but at the same time some guardrails help him
focus on the right stuff.

- The skill description is a trigger for the model, not a summary or context.

- Cool examples of skills like /freeze and /careful let you constrain Claude only when it matters

- Don't over complexify the skill to extend its reach. Better to have multiple specialized skills that interact than one swiss knife.

[Thariq @trq212]

https://t.co/45C3gKydTK

[petar | Spectra @petercalic99]

Great transparency by the CoW team and technical details.

Most important thing to improve now is the robustness of the solver competitions.
Some elements like the gas limit were obviously a mistake but as a whole the backbone of the protocol is the auction system and it didn't perform well.

Aave should also propose different provider routes for more competitiveness and decentralization.

[CoW DAO @CoWSwap]

https://t.co/1JJhoyi3Pd

[Absolute Unit @largeunit]

“vaults of vaults” are becoming the new DeFi primitive

Spectra MetaVaults have been live and growing:
+156% TVL in the last 7 days

automated rollover
curated strategies
continuous liquidity

new infrastructure takes time to propagate

over the next few weeks you'll see the integrations start to roll in

[Uly | Spectra @Ulydev]

https://t.co/jrrkkAPQsf

[petar | Spectra @petercalic99]

@JuliaEMcCoy On the contrary education is now important more than ever. Unless you want your kid to be completely at the mercy of probabilistic algorithms

[Theo - t3.gg @theo]

I appreciate how real this response feels, and I think I see the angle you're going for. Seems like the goal is to define a "safe" way for the DoW to work with leading AI labs?

My biggest issue is with the last part.

I try really hard to avoid bringing politics into discussions where it doesn't below. Sadly, the DoW does not do the same.

In the official "Artificial Intelligence Strategy for the Department of War" strategy doc, they try to credit Trump for the creation of ChatGPT. This is all political chess to them. There are additional call outs about "woke AI" throughout the document.

I wish this could be simpler. I wish the people appointed by our elected leaders would act more honestly. Their behavior is not reasonable, it's punitive, and I'm concerned that you're just a pawn on their board.

[petar | Spectra @petercalic99]

@GiulioRebuffo I am more surprised bythe bad timing/approach of oAi. After days of drama because Anthr imposed strict conditions, oAi jumps in with a more flexible arrangement the same day. Doesn't feel right, the subject is too delicate to be treated like simple trade deal.
What do you think?

[petar | Spectra @petercalic99]

@Fricoben @eniwhere_ Would be cool to have statistics per specific fields, as this gap becomes more precise. For example in our company in the last few months we went from 50% devs using agentic workflows to 100%. Would be curious if there is a gap in big corporate companies for example.

[petar | Spectra @petercalic99]

@eniwhere_ Code:)

[petar | Spectra @petercalic99]

We must not forget:
Llm's are probabilistic, you can't predict the outcome and explain the output.

Compilers on the other hand are deterministic.

AI as is will hardly replace critical tasks because of this before some big tech advancements.

[Uncle Bob Martin @unclebobmartin]

When the AIs start producing pure binary from our prompts, we will lose the ability to engage with the code. So it would be a good idea to get used to that now.

[petar | Spectra @petercalic99]

@pashov The oracle seemes to have had some averaging but liquidity was so low for long it didn't help. Still some sanity checks would have helped..