
Building @Verdict_Finance The Rating, Risk, and Coverage Protocol for onchain finance.
London
Joined May 2019
- Tweets3.5K
- Following859
- Followers970
- Likes7.7K
1/
The house always wins because the house controls the dice.
A patent published this week pulls the dice out of the operator’s code and seeds them with @chainlink VRF.
Slot machines. Fish-hunting cabinets. Loot drops.
Casino randomness just got an oracle. $LINK 🧵
Charles Holmes retweeted
The Power and Signature of the Topological Monopole
In 29 languages
PREMIERE Sun 25th October 2026 at 22:00 CET - BEWARE of clock changes!
remoteview.substack.com/p/th…
@AshtonForbes
Charles Holmes retweeted
considering how much crypto twitter seems to be stuck in the fantasy that A blockchain could replace the global financial SYSTEM - i asked grok to create a simple hub and spoke diagram of how the Global Hub and Spoke with Swift and DTCC sitting at the center actually looks like.
Everything. $LINK'ed.
Crypto talks endlessly about onboarding the next billion users, and the ones after that.
Exchanges publish research about payments, yield, and tokenized assets bringing in the masses. Founders pitch “financial infrastructure for everyone.”
Then you actually try to find or understand most projects as a normal person and the gap is glaring.
The SEO is often terrible.
A lot of sites are one-page marketing landings or JavaScript-heavy dApps that render as empty shells to crawlers. Content that should rank for “how does this work,” “is this safe,” or “what problem does this solve” sits behind wallet connects or doesn’t exist as proper pages at all. Google treats crypto as YMYL (Your Money or Your Life), so it already demands high trust signals—anonymous teams and thin, jargon-filled pages make that harder. Paid ads are heavily restricted, which makes organic search one of the few scalable channels… and yet a huge number of projects treat it as an afterthought.
The result: the people searching “how to earn yield safely” or “best way to send money abroad cheaply” mostly find exchanges, scams, or outdated explainers instead of the actual protocols claiming to serve them.
The explanations are even worse.
Insiders suffer from the classic curse of knowledge. What feels obvious (“it’s just a shared ledger + smart contracts”) is opaque to almost everyone else. Surveys consistently show large numbers of people can’t name a single clear benefit or risk. Landing pages and docs default to tokenomics, L2s, intents, restaking, and liquidity pools without translating any of it into something a regular person cares about: lower fees, faster settlement, ownership of their own money, or access they didn’t have before.
There is a huge storytelling problem. Features and charts instead of clear “here’s why this matters to you and how it works in plain English.” The industry wants retail and the next billion. The websites and messaging are still mostly built for people who already live on Crypto Twitter.
Until that changes, a lot of the “onboarding” talk stays aspirational. The technical rails can scale; the discoverability and clarity haven’t caught up.
Let’s not even talk about the constant stream of hacks and security incidents.
The kind that wipe out funds, erode trust overnight, and make the average person wonder why they’d ever risk putting real money into something that still feels this fragile.
We are never going to get there if everytime someone onboards to crypto their funds disappear in less than a month.
Charles Holmes retweeted
And with this announcement we enter Bradbury Phase 2, the last milestone before Clarke, the Mainnet release candidate.
I can feel how close we are 🚀
Charles Holmes retweeted
Important updates in new version of coldclone - if you are a dev or auditor, use it to scan & optionally sanitize foreign code repos before doing anything else!
Works stand-alone via scripts or as a plugin for claude/codex.
github.com/devdacian/coldclo…
Replying to @TheBlockChainer
@Verdict_Finance is also going to be solving this problem. I gotta say I trust a crypto first company more than the S&P on this one :-)
Charles Holmes retweeted
Replying to @DefiLlama
Hi @DefiLlama, @Trueo_ , let me know if you would like more of that, because I'm building it @Verdict_Finance
Charles Holmes retweeted
Quantum now has its own token map: post-quantum L1s, chains adding upgrades, quantum-branded coins.
A narrative is easy to list. Resilience is harder to prove.
Which of these can actually migrate their cryptography?
That’s what we rate at Verdict.
Charles Holmes retweeted
We are the cows of the future.
Cows don’t know money exists, yet the bond market runs their lives. When AI agents build a financial system more sophisticated than we can follow, that’s us.
We need to see what agents are exposed to, in real time.
That’s Verdict.
1) 54% of Uniswap V4 hooks are malicious
but the scariest bugs are not the obvious scams they are the subtle accounting errors in legitimate hooks that pass every audit checklist
Here are the 7 failure patterns every V4 builder needs to know
1) Anyone can call your hook
Hook callbacks are external functions. If you don’t check the caller, an attacker calls them directly with malicious parameters.
Fix: use BaseHook + onlyPoolManager modifier
The Cork exploit (~$12M) happened because an untrusted path reached hook logic
2) Pool creation is permissionless
Anyone can deploy a pool with your hook address. If you trust a user-supplied PoolKey without validation, the attacker controls the currencies
Fix: allowlist pools by PoolId. Never trust a PoolKey you didn’t create.
3) Custom accounting leaks value silently
The PoolManager only checks that deltas settle to zero at the end of a session. Your internal accounting can still be wrong
Bunni exploit ($8.4M): rounding bug in idle-balance accounting. 44 tiny withdrawals drained the pool. Settlement invariant passed every time.
4) beforeSwap sees pre-swap state. afterSwap sees post-swap state
Code that is correct in one hook is unsafe in the other
putting logic that needs the final swap result in beforeSwap is one of the most common bugs in V4 hook audits
6) The hook address IS the API
Permission bits are encoded in the deployed address itself.
If afterSwapReturnDelta bit is missing: Your hook records a fee PoolManager ignores the delta Every swap reverts with CurrencyNotSettled()
Keep getHookPermissions() in sync with what your hook actually does.
6) Optional code can block exits
If reward distribution or oracle reads revert inside afterRemoveLiquidity: Users cannot exit their positions Funds are locked
Wrap optional code in try/catch. Never let cleanup logic block a safe exit.
7) State changes between callbacks
beforeSwap and afterSwap run in the same tx. If your hook calls external contracts in between, shared storage can change mid-sequence
Key temporary state by PoolId + caller clear it after use Test nested swaps across pools that share the same hook.
8) The PoolManager guarantees settlement. It does not guarantee your hook is correct
Security responsibility for:
Authorization → you Pool validation → you Value accounting → you External integrations → you
Full breakdown by @nisedo_ at Trail of Bits: blog.trailofbits.com/2026/07…
Charles Holmes retweeted
Replying to @cholmes
Some of what's live:
- A set of content sites that an AI agent maintains on its own. It fixes problems, redeploys and reports to me daily
- Crypto trading tools: an order-flow dashboard, a rug scanner, a market data recorder and a paper-trading bot
- Optimization algorithms in Rust, competing on $TIG.
- A YouTube channel that makes and schedules its own videos
- An Android TV app
- A live dashboard for my meat-curing chamber, built by reverse-engineering the controller
- A browser game, a recipe site and a booking site
Create the deal: 0.01 $LINK
Deposit $10M: 0.01 $LINK
Borrow $5M: 0.01 $LINK
Repay: 0.01 $LINK
Same fee every time in Chainlink's Fulcrum demo. It doesn't scale with the size of the deal. It scales with the number of actions.
Real price or placeholder? Chainlink hasn't said.
Charles Holmes retweeted
ethereum:0x514910771af9ca656af840dff83e8264ecf986ca
Was indeed a fakeout on the last push, and we've seen price drift lower since.
Primary count (First two charts):
Tracking this as an ending diagonal to complete the larger wave 2 correction before continuing higher.
Alternate count (Third chart):
Last high was an ugly fifth wave instead of an expanded B wave. Don't like counting the fifth like that on peaking volume, but it's a valid option.
Would likely lead to corrective PA through November.
How price bounces out of this move down will help with further expectation:
Primary - Strong bounce towards new high.
Alternate - Gradually slowed down PA towards the previous high.
Charles Holmes retweeted
how about all the private chains
I shared this privately in a $LINK chat but since its both Sibos month and #Samtember - what the heck.
Stinky.
1/
Why is @LoganPaul's former agent patenting Powerball?
The CAA agent who sold brands on Logan Paul in 2017 is now the applicant on a blockchain lottery: tokenized tickets, smart-contract payouts, an oracle feeding the winning numbers.
One oracle network is named. $LINK 🧵

































