rokinot

Computer engineer, smart contract security researcher.

[rokinot @rokinot]

New blog post: an attack that could allow a vault operator to drain funds by manipulating liquidity w/ user funds and ping pong-ing the price up and down.

https://t.co/KG8TEhDSMx

[rokinot @rokinot]

nanohacks

[audit911 @audit_911]

PatienceStaking 被攻击，损失1.6 BNB。
漏洞原因:
deposit在用户首次存入后只增加 user.amount，却没有同步设置 user.rewardDebt，导致新资金不会从当前 accPacePerRoot 起算。随后攻击者可立刻调用claim 按 user.amount * accPacePerRoot - rewardDebt 把历史累计奖励一次性领走。再配合 forcewithdraw退出本金完成套利

[rokinot @rokinot]

@hrkrshnn but is it noticeably more proficient than opus?

[rokinot @rokinot]

@CL207 the universe bending itself so ct continues to be wrong

[rokinot @rokinot]

@rebcesp @lonelysloth_sec yes but only gemma/gwen tier, sub 100b models. memory is the constraint here

[rokinot @rokinot]

@lonelysloth_sec can't point to anything specific, but you should start searching on the local LLM subreddits

[rokinot @rokinot]

@lonelysloth_sec figure out how to setup all this before you buy it though its the most important part

[rokinot @rokinot]

@lonelysloth_sec to run models at home? your best bet is 2x 5090 at this price range I think, but you're just below the b200 price. then a good enough storage for the 1T+ models. keep in mind parameters are up only, sooner or later you'll have to run 5T+, maybe 10T+

[rokinot @rokinot]

does anyone have a good source for toxic liquidations on morpho/aave?

[rokinot @rokinot]

if Mythos comes out today and its >2x the current price of opus it may actually be the first -EV model to run on contests lol

[rokinot @rokinot]

@teortaxesTex a bit unrelated but there were rumors circulating months ago that mythos was a 10T model, seeing how it does vs 4.8 do you think they're legitimate

[rokinot @rokinot]

can't forget the basics

[SlowMist @SlowMist_Team]

🚨SlowMist TI Alert🚨

💸 Loss: 14.411518807585587 ETH

🔍 Root Cause: Storage slot collision between `ATOHook.rewards` mapping slot and Solady `ReentrancyGuard` fixed slot (`0x02215292eb9609279094554c6e223f800950648ddfa3da30329838d6c170928d`). The `nonReentrant` modifier in `getReward()` writes sentinel value `0xffffffffffffff` to the guard slot, which is simultaneously read as `rewards[attackContract]` due to the collision. This inflated reward is paid as ETH each call, allowing 200 repeated claims.

📌 Attacker (EOA): 0x2d2aafc193c24e59bd16139056ac9b4df4d37ad0
📌 Victim Contract: 0xa10de71ddb4e0d51938ef6e0118822e157a62888
📌 Attack Contract: 0x2441e480f62bf609a08da09143e4baf8a817d757

Storage collision between reward accounting and reentrancy guard enables unlimited reward drainage.

Powered by #SlowMist.AI

https://t.co/vzW3aa8pnH

[rokinot @rokinot]

1) what

[Michael Saylor @saylor]

32?

[rokinot @rokinot]

@grugcapital wtf is alexander smoking

[rokinot @rokinot]

"quantum resistance" brother we have an AI resistance problem TODAY, do something about it

[rokinot @rokinot]

oh my god

[Hunter Biden @HunterBiden]

@gmoneyNFT Hyperliquid

[Michael Egorov @newmichwill]

Remember the day when 184B bitcoins were minted due to a bug?

https://t.co/1mzPKR6BUi

[rokinot @rokinot]

we have several examples of hackers sitting on top of coins that can be frozen, sending coins to the wrong address, taking huge slippage losses and so on

[rokinot @rokinot]

my hunch says this was never exploited, hackers are not good traders and a black hat would've minted too many coins to get away unnoticed

[Aditya 🦀 @ItsAditya_xyz]

Are you kidding me? A Security researcher found an exploit in ZCash (a 10B$ protocol) using Claude Opus 4.8. An exploit where anyone could create infinite supply and sell to market. A bug that was there since 2022.

The worse part is there is no way to find out if someone didn't exploit the protocol in all these years.

[rokinot @rokinot]

helluva achievement by this researcher

[TylerD 🧙‍♂️ @Tyler_Did_It]

🚨Confirmation of a massive potential ZEC exploit

TLDR:
- ZCASH hired a security researcher to try to find exploit vectors
- The researcher (Taylor Hornby) found one that would let him create unlimited counterfeit ZEC in a shielded pool
- The exploit is now fixed as of June 1
- There is no way to know if the pool was exploited BUT the team feels that it is unlikely
- They're proposing a network upgrade with new accounting that would prove whether any counterfeit ZEC was created or not

Market clearly spooked with ZEC down 25%

[rokinot @rokinot]

i like how even previous patterns can imply this will go further on for several months possibly a year, what signal do you possibly get from this

[CoinDesk @CoinDesk]

LATEST: More than half of all $BTC in circulation is now held at an unrealized loss, a signal that has coincided with every major bear market bottom in history.