I owe everyone a proper technical breakdown of the exploit of PaymentProcessorV2 and the rescue that followed. The short version: Payment Processor trusted an ERC-2771 style “original sender” supplied through a trusted forwarder. That sender could be forged. 1/🧵

how times change

Indeed about 2500 eth across 4 Swell proxies at risk here, however no indication that it can be taken. Both ProxyAdmins are owned by the Swell Timelock. The Timelock delay is set to seven days, and its administrator is a 4/7 multisig. None of the 7 signers have transacted since the attack started. On the one hand, would expect the attacker to start the timelock period ASAP if they could acquire the necessary 4 signatures. On the other hand, would not expect them to deploy 4 targeted upgrade contracts if they couldn't. However even without the upgrade, they can slowly drain the protocol. The attacker inflates swETH and rswETH’s reported backing by 1% hourly, buys tokens below the fake rate, then process their own redemptions at the inflated rate. Meanwhile they can block other holders' redemptions so only they benefit.

Railway is compromised and reports are that attackers are actively draining keys. Rotate any API keys stored in railway immediately. Deployments are down so unfortunately this means many deployments will wind up broken, but it is better than the alternative. Internet D-Day

Do you know these penguins? All 4 of them are still in the safu wallet. If you know them, let them know to come claim at nftsaresafu.xyz

very cool meme card, the best one if you ask me

eMudhra's private keys were unoronically less secure than President Skroob's luggage

thank you much @richclasdecor this is awesome 🙏🏽

Do you know these apes? All 20 of them are still in the safu wallet. If you know them, let them know to come claim!

y'all better come claim your apes back from the rescue wallet before my intrusive thoughts take over

I know it sounds cliche but IRL really is the alpha. Mudwater was stressful ngl. There was a lot to get into place right up until the last minute but we fucking did it and I'm so proud of the team and the work we put in. clubhouse and anime are still coming btw, I know people wanted announcements or a keynote or whatever but sometimes the timing doesn't line up with apefest. That doesn't mean Yuga forgot or abandoned those plans. Sometimes it's just about getting everybody together and having a good time. I love that shit. Every year, seeing old friends and making new ones. Finally putting faces to names. This club is special. I say it every year but we are in such a unique position to have connections all over the world that share this common interest. If you're an ape, you have a friend in every city on earth. One in every hobby and every industry. It's hard to describe how unique and special our weird little group of internet jpeg collectors is. I don't really know what the point of this post is other than to say I'm so thankful for the club and for everybody I met and didn't get to meet this weekend. So many people I wish I could've spent some time with, or more time with. Just know you're all always welcome in my part of the world. If you need a couch, or dinner recs, or a good cup of coffee, let's fucking do it. we don't need to wait for apefest every year. I give my everything to this space because it's given everything to me. Y'all will always be family. Bored Apes Forever.