SARAFAT

Building AI agents . Exploring machine learning and prompt engineering.

Follow me I'll follow back 💯💯💯💯💯💯💯💯

[SARAFAT @sarafat_01]

Still posting on X without getting rewarded? 👀

With @solanafunded's Creator Program, your content can do more than just earn likes—it can earn real rewards in USDC and SOL. 🚀

✅ Join the program
✅ Pick an active campaign
✅ Create and share content on X
✅ Get rewarded for eligible posts

There's currently a $10,000 campaign running, and new creators can still participate.

If you're already active in the crypto space, this could be an easy way to monetize your content. 💰

⏳ Reward distribution is scheduled for June 28.

Join with my link:

https://t.co/c9xeGEIdE0

#CryptoTwitter #Solana #Web3 #ContentCreator #EarnOnline 🚀🔥

[SARAFAT @sarafat_01]

@deadstock_app "30 years of Pokémon and a brand-new Deadstock chapter on the same day? September 16 is looking stacked! Can't wait to see what you guys have been cooking "

[Deadstock @deadstock_app]

Public Beta goes live September 16, the same day the Pokémon 30th Celebration Set drops worldwide.

We're marking the anniversary with a launch of our own.

[SARAFAT @sarafat_01]

@DeepSafe_AI A powerful reminder that security risks can travel far beyond

[DeepSafe @DeepSafe_AI]

On September 1, Full Sail said it is sunsetting on Sui. Its account of why is unusually specific about the dependency behind that decision.

On August 29 an attacker removed approximately $91,000 from three of its vaults. Full Sail says its own admin keys were not compromised. It says its investigation points to production code at Switchboard controlling who could sign oracle price updates, and that the attacker added a key it controlled to a live oracle. Once accepted, that key could publish prices the downstream contracts treated as valid.

Switchboard has not confirmed that account. It halted its Move deployments on Aptos, Sui, IOTA and Movement on August 29, describing a potential compromise, and as of September 2 had not published a technical post-mortem or a confirmed root cause. Virtue, a separate protocol on IOTA, froze its CDP protocol on August 29 and said 47 liquidation events had affected 45 users.

Full Sail was a small protocol. The loss was enough to end the deployment. That is the uncomfortable asymmetry: an upstream dependency does not scale its failure to what a downstream integrator can afford to lose.

What followed is the part worth reading twice. Full Sail says that as of September 1 it had received no technical account of how the upstream code failed, no statement of the affected scope, and no commitment toward compensation. It says it will absorb the shortfall and compensate community depositors first.

An integration moves a trust boundary. Full Sail chose which oracle its vaults would read. It did not control the code and authority rules deciding which keys that oracle would accept. Those rules were inspectable in principle. What no integration does on its own is keep checking that the package actually deployed, its configuration and its authorised signers still match what was reviewed when the integration went live.

The root cause is not settled. MoveBit has described a possible bypass in key-rotation authorisation. It says that account still needs to be checked against the package actually deployed at the time.

CRVA is not exempt from this. A defect in code we deploy would reach integrators too. Its narrower distinction is that verifiers are drawn per request rather than fixed across requests. That removes one attack surface, not software defects that could compromise eligibility or selection itself.

You choose what to integrate. You inherit what it trusts. The first is a decision you make. The second keeps being made somewhere else.

Source:

https://t.co/KpcmyshhXK

#DeepSafe #CRVA #Web3Security

[SARAFAT @sarafat_01]

@DeepSafe_AI @kolverses @WayneL_ Important discussion on growth risk and building

[DeepSafe @DeepSafe_AI]

The market goes up.

So does the blast radius.

When capital and activity surge, a single failure can become a billion-dollar disaster.

Coincidence—or a structural feature of every bull market?

🎙 Host: Kolverses🪽 @kolverses

🎤 Guest Speaker：

WayneL @WayneL_

Can 24 @0xCan24

Tiger_Aspect @Tiger_aspect06

Join DeepSafe and leading crypto voices live on X Spaces.

📅 September 4 · 21:00 UTC+8

Stay tuned.

[SARAFAT @sarafat_01]

@ChainersGame @sundormia8142
@SUNLESS_404
@surujahmed69691

[Chainers @ChainersGame]

📈REWARD POOLS ARE 50% BIGGER!📈

Join the pool right now! 🏊‍♂️

Expected? Nah-ah!
Excited? Ye-ah!

💰 Reward Pools just got way juicier! 🍓 Check out these BIG numbers, make your farming MORE valuable, and put a SMILE on your face!

Because Chainers was made for YOU! ❤️

Drop LFGGGGG to hype it up!

[SARAFAT @sarafat_01]

@DeepSafe_AI Strong reminder that monitoring should cover unexpected behavior, even from supposedly inactive accounts

[DeepSafe @DeepSafe_AI]

The account debited most heavily in this incident was the one designed never to authorise a spend.

MANTRA's post-mortem is unusually direct about why. The burn address had no associated public key, a sequence number of zero, and had never signed a transaction. Under the normal account-authorisation model, a debit from it should be impossible. It was therefore not monitored like an active treasury or operational wallet — in MANTRA's words, "our monitoring systems did not cover transfers from it."

The exploit transaction was signed, but not by the account that was debited. An unsigned-integer underflow in the balance-accounting layer of the shared cosmos/evm dependency reduced the burn address's balance without its signature or authorisation. The attack did not require a compromised key. The property that made monitoring look unnecessary was never contradicted. It was bypassed.

The burn address was debited by 600,000,035.56 MANTRA, the first and larger of the two unauthorised debits. No automated alert fired on the first transaction, and it went undetected for nearly four hours. MANTRA's own summary of the gap: "The response after detection was fast. Detection itself was not."

The missing rule is the part worth keeping: alert whenever value leaves an account that cannot have authorised the transaction. MANTRA expects it to produce effectively zero false positives and has made it the highest-priority monitoring change. It would not have prevented the debit; it would have made a supposedly impossible event visible immediately. It reads as redundant right up until the moment it isn't.

CRVA does not make this class of defect impossible; shared dependencies and accounting paths exist for us too. Our premise is narrower and older than any of our machinery: a system's belief about what its own accounts cannot do is a claim, and claims are for checking.

Every assumption about what cannot happen is also a decision about where not to look.

Source:

https://t.co/7jIfXb52eR

#DeepSafe #CRVA #Web3Security

[SARAFAT @sarafat_01]

XIIID’s approach is definitely worth keeping an eye on. Bringing AI education, verifiable learning credentials, and Web3 infrastructure together is an interesting concept. I’m especially curious to see how the Paraguay implementation translates this vision into real-world impact. 🚀

#XIIID #Web3 #AI

[XIIID @xiiid_official]

XIIID Q4 2026 Roadmap: Scaling AI Education from Paraguay to the World

🎓 Education & AI Tutor
· School Principal Meetings in Paraguay → Identify local education needs, align with curriculum
· AI Tutor Beta Preparation → School selection & teacher training
· AI Tutor Beta Launch → Deployment & expansion to additional schools
· AI Tutor Official Launch → On-chain verification & verifiable learning records

🌐 XCLASS Evolution
· Phase 2 Open → System improvements for growing users
· Phase 3 Open → Improved onboarding, retention, and learning history

🏢 Infrastructure & Data Center
· Paraguay Data Center Discussions → Collaboration with PTI
· Initial Infra Testing → Rack installation & system testing
· Development Progress → Sharing updates on infrastructure expansion

🤝 Partnerships & Ecosystem
· Expanding XIIID Ecosystem → AI Tutor + XCLASS + Web3 integration
· Consortium & PTI collaboration → Institutional foundation for adoption

🌎 Global Expansion
· Latin America expansion
· Initial discussions in Asia & the Middle East

📖 Read the full roadmap
👉https://t.co/ALH0ES95h1

Building the future of AI-powered education, step by step.

#XIIID #XCLASS #AITutor #AIEducation #AI #Roadmap

[SARAFAT @sarafat_01]

@xiiid_official Big milestone for XIIID! 🚀
Congrats on the CoinGecko listing! The XIIID Hunt Airdrop is a great opportunity to discover the project, get involved with the community, and grab some rewards along the way.

Best of luck to everyone taking part! 🔥

#XIIID #CoinGecko

[XIIID @xiiid_official]

🦎 XIIID Is Now on CoinGecko! 🎉

We’re celebrating our CoinGecko listing with a special XIIID Hunt Airdrop! 🚀

🔎 Find XIIID. Complete the mission. Earn XIIID!

🎁 Rewards
• FCFS 1,000 eligible participants × 300 XIIID
• 50 Lucky Winners × 1,000 XIIID
• Bonus Mission: Complete the Q4 Roadmap post engagement (Like + Comment) → Extra 100 XIIID

📋 How to Join
✅ Search XIIID on CoinGecko
https://t.co/b2ZpbYq4tD
✅ Follow @xiiid_official on X
✅ Like, Repost & Comment on this post
✅ Complete the “XIIID CoinGecko Listing Celebration” Class on XCLASS
✅ Bonus: Like & Comment on XIIID Q4 Roadmap post
👉 https://t.co/OcuOJZl0Fb
✅ Submit the participation form
👉 https://t.co/aEZqX18BQX

⚡ FCFS is determined by the completion time of the “XIIID CoinGecko Listing Celebration” Class.

⚠️ Bots, duplicate accounts, and suspicious activity are excluded.

📅 Event Period
September 2 – September 10, 2026 (UTC)

📢 Results Announcement
September 11, 2026 (UTC)

🦎 Find XIIID. Learn. Earn. Celebrate! 🚀

#XIIID #CoinGecko #XCLASS #Airdrop #Web3 #Solana

[SARAFAT @sarafat_01]

@shsabbir001 @HoodlersXYZ Manifesting that GTD/FCFS spot 🤞🔥
Much love to Sh🌊 & Hoodlers! 👑

0xfe77a678277C1767A80F7b9D1648Fe4327a82C74

[SH 🌊 @shsabbir001]

🎁 SH🌊 × Hoodlers Giveaway 🎁

Big shoutout to Hoodlers for this collab! 🫶
Some exclusive spots are up for grabs:

🔥 1 GTD Spot
⚡ 2 FCFS Spots
🎟️ Free Mint

📅 September 4

⏰ GTD — 2 PM UTC
⚡ FCFS — 3 PM UTC
🌐 Public — 4–5 PM UTC

How to join:
• Follow @HoodlersXYZ & @shsabbir001
• Like + Repost ❤️
• Drop your wallet address in the comments 👇

Good luck everyone! 🍀🔥
#Giveaway #NFT #FreeMint

[SARAFAT @sarafat_01]

@DeepSafe_AI The useful distinction here is the unit of refusal. Rolling back ~11k blocks undid the exploit and every unrelated confirmation in that window

[DeepSafe @DeepSafe_AI]

Cronos halted on Sunday after an exploit on Tectonic. On Monday it said block production had resumed and that the chain state had been restored to before the exploit. It called that a validator-consensus emergency action. Tectonic said it would reopen in phases once its own checks clear, beginning with withdrawals and repayments while deposits and borrowing stay paused. Neither team has confirmed a loss figure, and both say a full post-mortem is coming.

Cronos resumed from block 90,896,189. The Defiant puts that 10,961 blocks behind the branch users had already watched confirm, roughly one hour and 54 minutes of chain history. On the new canonical chain, the attacker's Cronos-side gains no longer exist. The portion that had already crossed to Ethereum does. PeckShield and Lookonchain both tracked about 2,592 ETH, worth roughly $6.29M at the time, that reached Ethereum before block production stopped.

One exploit, three outcomes. What reached Ethereum stayed beyond the rollback's reach. The attacker's Cronos-side gains were removed from the canonical state. And so were the trades, transfers and liquidations of people with no connection to the exploit — confirmations they had already watched land inside that window.

The rollback did not separate exploit transactions from ordinary ones. It separated only what Cronos validators could rewind from what they could not. As of September 1, neither team has published an accounting of how those unrelated transactions will be handled, or whether any of them can be replayed.

This is not an argument that the rollback was right or wrong, and it is not a claim about decentralisation. The narrower point is what this remedy requires and how far it reaches. It requires validator consensus. It reaches only the chain those validators run. And it invalidates every prior confirmation inside the history it replaces, no matter whose transaction it was.

CRVA does not remove the need for emergency controls, and it would not have prevented the flaw inside Tectonic. The narrower distinction is the unit of refusal. Where an applicable check already sits in the execution path and its result is enforced, one request can be refused without an ad hoc validator intervention that replaces unrelated chain history.

The chain is back. The exploit's Cronos transactions are out of the canonical state. What is still open is everything the rollback could not reach, and everything else it reached on the way.

Sources:

https://t.co/fgxVSZif8s

#DeepSafe #CRVA #Web3Security

[SARAFAT @sarafat_01]

@kucoincom @diamante_io Trade $DIAM on #KuCoin!
It's an honor to be able to join this great project. I have completed all the tasks, and hope to be one of the winners.
@sundormia8142
@SUNLESS_404
@surujahmed69691
@SarafatSyed
@SarafatEth

[KuCoin @kucoincom]

🎙️ KuCoin x diam:native: Your Crypto Isn’t Safe Yet — Diamante’s Quantum Solution

🎁 392,124 diam:native to win!

How to enter:
1. Follow @kucoincom and @Diamante_io
2. Like, RT & Quote: "Trade diam:native on #KuCoin!" + Tag 3 friends
3. Join the space: https://t.co/OndS8jJllG
4. Refer your friends!
5. Submit Your KuCoin UID.
6. Complete the Gleam form: https://t.co/9rdKfbwst0

⏰ Join us on Sep 02, 2026, at 10:00 AM (UTC) for the live Space!