Moody 💭

dev @EkuboProtocol

[Moody 💭 @sendmoodz]

@apoorveth @basedfk That's ERC-8255

https://t.co/lswwrGIekO

[Moody 💭 @sendmoodz]

IMO Disable separate approval transactions and do approve(0) after the swap. This adds pressure to the wallets to do the right thing. Permit creates signature fatigue.

On the other side, attack the problem with ERC-8255 for other wallets and apps that won't implement batching.

[Moody 💭 @sendmoodz]

@tayvano_ @banteg How about:
- Do you think the ERC is good?
- Do you think it should be funded?

If so, then the way I came off is irrelevant. The relevance to this thread is funds are being misallocated, for whatever reason.

[Moody 💭 @sendmoodz]

@tayvano_ @banteg Took no initiative = came up with a solution, wrote 2 implementations, pushed it to all my contacts

Special treatment = asking not to be excluded from next round

It's too easy to see the politics in this space, and it's exhausting

[Moody 💭 @sendmoodz]

@tayvano_ @banteg Excellent process, much decentralization https://t.co/ZY5VFmuQCn

[Moody 💭 @sendmoodz]

We reached out to @griffgreen from @thedaofund to seek funding for making token approvals safer with ERC-8255. We intended to direct 100% of any funding towards victims of the recent @EkuboProtocol exploit.

It looks like we will not be receiving any support--not even inclusion in current or future quantitative funding rounds. It appears @thedaofund is not focused on solving real security problems under leadership of @griffgreen. The entire conversation is attached.

We will still be pushing to get ERC-8255 as widely adopted as possible. However, I have no faith in @thedaofund's ability to distribute funds faithfully according to their mission. Token approvals are even mentioned specifically in Ethereum Foundation's Trillion Dollar Security initiative: https://t.co/epzPOFvEJ7

If you wish to donate to the development and adoption of this ERC, you can send any tokens or ETH to erc8255.eth. Any funds received will be directed towards reimbursing victims of the recent @EkuboProtocol exploit.

Read the ERC here: https://t.co/0ObJZQ5AKy
Check out our draft implementations:
• OZ: https://t.co/n467VX2nvC
• Solady: https://t.co/oaFs366t2i

[Moody 💭 @sendmoodz]

Need ERC-8255 but for NFTs

It's even easier to implement

[Quit @0xQuit]

In block 25081689, 0xD79b paid 28 eth to close out a loan and recover Punk 5032.

3 blocks later, the punk was stolen using an open approval.

How?

1/🧵

[Moody 💭 @sendmoodz]

I wrote ERC-8255 one week ago. If USDC immediately adopted it, it would've saved one user $456k already.

The victim did their approve(max) 51 days ago.

If you are writing a token, implement ERC-8255!

https://t.co/lswwrGIekO

[chrisdior @chrisdior777]

🚨 JUST IN:

@Aurellion_Labs was exploited on Arbitrum for ~$456K.

due to uninitialized Diamond proxy / unprotected initialize().

Attacker added a malicious facet, abused existing USDC approvals, and swept funds from users’ wallets.

Revoke approvals: https://t.co/8712or8PHr

[Moody 💭 @sendmoodz]

@0xj4an @griffgreen @EthPrague @base Nice, but also, fix approvals

https://t.co/lswwrGIekO

[Moody 💭 @sendmoodz]

@crypto_tuxedo @griffgreen @thedaofund @EkuboProtocol https://t.co/cFDlj41b0v

[Moody 💭 @sendmoodz]

For those saying I was trying to circumvent the process, I asked two times to be included in the next round and the second time I was blocked.

[Moody 💭 @sendmoodz]

We reached out to @griffgreen from @thedaofund to seek funding for making token approvals safer with ERC-8255. We intended to direct 100% of any funding towards victims of the recent @EkuboProtocol exploit.

It looks like we will not be receiving any support--not even inclusion in current or future quantitative funding rounds. It appears @thedaofund is not focused on solving real security problems under leadership of @griffgreen. The entire conversation is attached.

We will still be pushing to get ERC-8255 as widely adopted as possible. However, I have no faith in @thedaofund's ability to distribute funds faithfully according to their mission. Token approvals are even mentioned specifically in Ethereum Foundation's Trillion Dollar Security initiative: https://t.co/epzPOFvEJ7

If you wish to donate to the development and adoption of this ERC, you can send any tokens or ETH to erc8255.eth. Any funds received will be directed towards reimbursing victims of the recent @EkuboProtocol exploit.

Read the ERC here: https://t.co/0ObJZQ5AKy
Check out our draft implementations:
• OZ: https://t.co/n467VX2nvC
• Solady: https://t.co/oaFs366t2i

[Moody 💭 @sendmoodz]

@codephobic @griffgreen @thedaofund @EkuboProtocol https://t.co/cFDlj41b0v

[Moody 💭 @sendmoodz]

For those saying I was trying to circumvent the process, I asked two times to be included in the next round and the second time I was blocked.

[Moody 💭 @sendmoodz]

For those saying I was trying to circumvent the process, I asked two times to be included in the next round and the second time I was blocked.

[Moody 💭 @sendmoodz]

@trenchobserver @permaOx @griffgreen @thedaofund @EkuboProtocol What part of "regardless, next question" is not accepting his original response? Ever heard of disagree and commit?

[Moody 💭 @sendmoodz]

@griffgreen @thedaofund @EkuboProtocol 6 years of contribution to Ethereum => treated like a beggar

[Moody 💭 @sendmoodz]

@trenchobserver @permaOx @griffgreen @thedaofund @EkuboProtocol Last thing I asked is not to prevent us from being included in the next one, and he proceeded to block me.

[Moody 💭 @sendmoodz]

@trenchobserver @permaOx @griffgreen @thedaofund @EkuboProtocol The post he linked said funds are used for retroactive grants. I also asked to be included in the next round or at least for him not to prevent us from being included and that was apparently the final straw

[Moody 💭 @sendmoodz]

@plondon514 @shr_id Great minds think alike

[Moody 💭 @sendmoodz]

Agreed and difficulty of review/audit is one of the reasons this happened. We couldn't reuse code from our audited smart contracts to write the huff router.

If we had AI agents reviewing with the same rigor that attackers review we can use low level languages more safely, but it's an arms race and they are currently winning