no pyo yet. still somehow carrying the whole office.
officially clocking in at pyo street this friday (。•̀��-)✧
get your worker card: https://t.co/BAnxdLAOLl
@pyopyopyo410
The signing math
When you sign a message with Ed25519, two values get published on-chain as your signature: R and s.
They're computed like this:
- R = k · G (k = the secret nonce, G = a fixed public point)
- s = k + H(R, A, M) · a
Where:
- k = the nonce (must be secret)
- a = your private key (the thing that must never leak)
- A = your public key
- M = the message (transaction)
- H(...) = a hash anyone can compute from public data
(Simplified, the real scheme works modulo the curve order and the nonce is derived from a secret value inside the seed, not the raw seed. But the shape below is exactly what matters.)
Both R and s are public. They're literally in the signature on the blockchain.
Now solve for the private key
Look at the second equation and rearrange it:
a = (s − k) / H(R, A, M)
Everything on the right side is public except k, the nonce. So the only thing protecting your private key a is that nobody knows k.
That's the whole game. Secrecy of k = secrecy of your key.
What SecondFi broke
Correct Ed25519 derives the nonce from a secret:
k = H(secret_seed, M) ← depends on something private
You can't recompute k, because you don't have secret_seed.
SecondFi instead did something equivalent to:
k = H(M) ← depends ONLY on the public message
Now anyone reading the chain can:
1. Read the transaction M → compute k = H(M)
2. Read s and R from the signature
3. Compute H(R, A, M)
4. Plug into a = (s − k) / H(R, A, M) → recover the private key
A toy numeric walkthrough
Forget elliptic curves; use plain arithmetic to see the shape.
Say:
- Private key a = 7 (secret)
- Message hash H(R, A, M) = 3 (public)
- Nonce k = 5
Then the published signature value is:
s = k + H·a = 5 + 3·7 = 26
Good system: an attacker sees s = 26 and H = 3, but not k. Two unknowns (k and a), one equation unsolvable.
SecondFi's system:
the attacker recomputes k = 5 from public data.
Now:
26 = 5 + 3·a → a = (26 − 5) / 3 = 7
The private key falls right out. One signature, no guessing.
Why this beats classic "nonce reuse"
The famous bug, the one that broke the Sony PlayStation 3 and some early Bitcoin wallets, was reusing the same k across two different messages. That took two signatures to cancel the unknowns and solve.
Here you need only one, because k isn't unknown at all. It's computable from data already on chain. Every single transaction a user ever signed is a standalone leak of their key.
The fix was never "understand the curve math." It was "don't be the one writing it."
Libsodium and noble/ed25519 are good examples: both open, both audited, and both give sign() no parameter to supply the nonce.
🧵/1
There are already multiple free AI auditors for smart contracts
But there are almost none focused on blockchain / DLT systems themselves: clients, consensus, execution, bridges, mempools, state sync, resource accounting, and protocol logic.
I spent 7 weeks worth of ChatGPT Pro 20x tokens building DLT Auditor v1
Now I’m sharing it for free: https://t.co/905WCfCBvc
The v3.0.0 Alkanes release runs in metashrew v10.0.0 and optimizes down the stack, approaching a theoretical limit of performance.
The debate today among core contributors to Alkanes resulted in [8:dead] making it into v3.0.0. Activation block still TBD, but soon!