ISTP, Otaku, Developer
localhost
Joined July 2022
- Tweets253
- Following553
- Followers60
- Likes2.5K
liqwang.eth retweeted
TanStack Start 1.0 is officially stable! 🎉
A full-stack web framework for React and Solid, already used to build millions of apps, from Fortune 500 companies to your favorite tools and weekend projects.
tanstack.com/start
liqwang.eth retweeted
Weakness and ignorance are not barriers to survival. Arrogance is.
@injective got hacked.
I joined forces with @S7iter_ to analyze the attack.
Injective binary options are zero-sum by design. Buy Q at price P and the long locks P * Q, the short locks (1 - P) * Q. Total collateral should stay equal to Q. This exploit breaks that invariant, then stops the normal refund haircut from putting it back.
The break is how a binary options market is bound to its insurance fund. market_id was hashed from fields concatenated with no separator and no length prefix: oracleType, ticker, quoteDenom, oracleSymbol, oracleProvider. Same byte string, two different parses.
Example: insurance fund uses ticker = X, quote = inj, oracle_base = USDC_DENOM + SYMBOL.
Binary options market uses ticker = Xinj, quote = USDC_DENOM, oracle_symbol = SYMBOL. Different objects, same market_id. An INJ insurance fund can sit on a USDC-denominated binary options market.
Attacker traded against themselves across subaccounts.
1) Open long + short at 0.10. Long locks 0.1Q, short locks 0.9Q.
2) Close the long at 0.90 with margin = 0. Gets ~0.9Q back (original margin + realized PnL).
3) Old short still has 0.9Q margin on the books. Open a new long at 0.90 with another 0.9Q.
4) Deposited 1.9Q total. Old long already took ~0.9Q out. Remaining positions still show 1.8Q refundable margin.
5) Market settles with no oracle price and hits the -1 refund path. Missing 0.8Q should haircut the leftover positions. Instead settlement tries to cover the hole from the attached insurance fund.
6) Fund is INJ. Deficit is USDC. Code treats the raw integer from the INJ fund as coverage for the USDC shortfall. Dust INJ is “enough”, haircut is skipped, remaining positions refund in full.
7) Withdraw the inflated subaccount balance.
One sampled USDC cycle: 44,099.025531 in, 62,666.979111 out. Extra 18,567.953580 is exactly the 0.8Q gap. Same loop on short-lived markets quoted in USDC, Peggy USDT, Noble USDC, and ATOM.
Create an INJ insurance fund that collides on market_id with a quote-denominated binary options market → 0.10 to 0.90 self-trades to manufacture a refund deficit → no-price settlement → INJ atoms cover a USDC/USDT/ATOM deficit by raw amount → withdraw.
github.com/InjectiveFoundati…
hi @al_f4lc0n 👀
I Saved Injective's $500M. They Pay Me $50K.
I like hunting bugs on @immunefi . I'm decent at it.
- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)
Life was good. Then I found a Critical vulnerability in @injective .
This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.
I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.
Then — silence. For 3 months. No follow up. No technical discussion. Nothing.
A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.
I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.
I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.
Full Technical Report: github.com/injective-wall-of…
liqwang.eth retweeted
现在 @Gate 的棋已经不好下了：
不赔，用户看到的是：出了事，平台第一反应是切割、质疑、站到用户对面，信任崩塌。
赔吧，外界又会解读成：官方自己承认风控和审核流程有问题，信任还是崩塌。
之前术层面犯的错，多说无益。此刻真正的解题关键，是怎么把“赔钱”这事的口径设计好。
如果我来操盘，死马当活马医，我会先借着链上侦探给出的信息，把矛头对准盗币黑产集团，明确摆出全力配合用户、警方和安全团队追查真凶的姿态。
同时，以人道主义关怀和用户保护为名，在资金完全追回前，由平台先行垫付一部分损失。
该口径的重点是：这不是承认责任，而是告诉市场，平台在极端事件里不会把用户一个人扔在原地。
调查需要时间，而时间有魔法，它可以让人忘记大部分事情。
只要你持续释放“事情正在被推进”的信号，最终吃瓜群众未必记得所有细节，但会大致印象会是：平台没有装死，用户利益也被放在了一个相对较高的优先级。
电视剧里的危机公关，演的基本都是深谙舆论的操盘手，在危机发生后，化身超级救火队长，挽狂澜于既倒，扶大厦之将倾。
而真实的商业世界里，善战者无赫赫之功。
一个真正高段位的市场操盘手，最重要的能力不是火烧起来以后冲进去当英雄；而是在别人只看到一丁点小火苗时，就意识到这东西如果不管，会烧成燎原大火，然后提前把它按灭。
可问题是，在一个藩王林立、各扫门前雪的标准企业组织里，这种人很难被识别，也很难被奖励。
因为他花了公司的钱、动了别人的资源、打断了原有节奏，最后换来的结果只是：什么都没发生。
而“什么都没发生”，在公司报表和绩效系统里，就不能算功劳，只能算成本。
这也是预防型人才的悲剧，他的成绩单是一场场“没有发生的灾难”。 没发生，就没人知道它本来会发生；没人知道，就没人愿意为它付费、升职、背书。
所以公司制天然更容易奖励那些解决大问题的人，而不是预防大问题的人。
可最讽刺的是，很多所谓“大问题”，本来都只是一些没人愿意提前踩灭的小火苗。
币圈交易所做的是信任生意。
最愚蠢的公关，就是在事实还没被第三方查清、证据链还没公开闭环，手里没有 smoking gun 的调查期间，就把屁股坐在了用户的对立面，开始对受害者进行有罪推论，让员工和吃自家广告的小 KOL 们一起阴阳用户，往「自导自演」方向上带节奏。
判断错了，你是要被钉上耻辱柱的 24K 纯小丑；
退一万步说，就算最后真被你说中了，又如何？
你怼赢的是一个用户，输掉的是所有旁观者对“我出事后会被怎么对待”的想象。
我和当事人 @jheioff 没有任何往来，看到被盗帖后，去翻了下他的历史 posts，基本都是交易类内容的转发；再结合他关注了我，初步判断是：这就是一个把推特当作学习金融/交易知识工具、和你我一样在努力赚钱养家的人。
这种画像的用户，上来不放预言家，至少也先发张好人卡再慢慢听发言吧？
innocent until proven guilty.
程序正义，是交易所应该给到每个用户的基本尊重。
liqwang.eth retweeted
站在上帝视角，压缩时间线，把几十年间几代人的痛苦挣扎缩小成历史上的一个点，就会得到科技圈现在对 AI 的无限乐观：未来的生活质量会更好，工作环境也会更好，新创造的就业机会远多过被消灭的就业机会。
如果把我们传送回去 1780 年代工业革命初期的英国，我们遇到的第一个问题并不是「失业」。真正的问题是手工业收入的下降，要解决这个问题我们必须放弃手艺，进工厂打工。工厂只存在于大城市里，我们要做的第一件事情是拖家带口背井离乡进城。
工厂的生产环境比在自己家里做手艺活差很多：高温，高湿，高噪声，粉尘污染严重，一天 12 小时工作制。蒸汽纺织机没有现代纺织机的安全防范机制，一不小心你就会被纺织机卷进去，致残并不罕见。
我们有限的余生在工厂打工还不是最糟糕的。禁止 9 岁以下童工的法律要到 1833 年才出现，所以为了养家活口我们的子女一早就被送进工厂里打工。他们会目睹工业革命带来的经济增长，但却享受不到成果，因为 1780 年到 1840 年工人产出提升了 46% 但薪水只上涨了 12%。
工业革命的福报要等到我们的孙辈甚至曾孙辈才能享受到。1840 年到 1900 年工人产出提升了 90%，薪水上涨了 123%。他们能享受到廉价的日用品，能搭上火车，文职和技工职位开始增多。当然这也要看他们所处的社会阶层，如果处于社会底层的话他们依旧享受不到经济增长所带来的好处。
至于 Luddite，反对工业革命只是表象，他们真正反对的是工业革命造成的不公平现象——工人产出增加了，但薪水没有上涨。这成为了日后马克思《资本论》的理论基础：机器并不坏，资本家控制着机器才是真正的问题。
最后不要忘记了，今时今日优越的工作环境不仅仅来源自科技革命，还依赖于漫长的阶级斗争。如果不是工人持续抗争，生产环境不会变得更安全更舒适，薪水也不会涨上去。
这个过程在 AI 革命后可能又要再演绎一遍。AI 破坏现有社会经济秩序后会导致一部分人陷入困境，他们觉得社会不公平于是站起来抗争。科技革命可以发生得很快，但重新分配蛋糕的过程总是非常缓慢，又要花几代人的时间恢复平衡。
研究这个话题的原始对话：chatgpt.com/share/6a02517b-c…
liqwang.eth retweeted
Spark的创始人发布的这份对于风控体系全面总结，也印证了为什么Spark可以在多次黑客事件中独善其身并大放异彩，首先Spark拥有6层损失吸收机制，层层缓冲防护，全部击穿耗尽后才会分摊给USDS持仓者。其次严格限制抵押品数量和准入门槛，并且所有跨链资金都有智能合约级别的速率限制，如果AAVE也具备这两点，这次3亿美金的rsETH被盗事件就不会发生。
这份报告值的每一个Defi协议学习，建议所有主流项目应该组成一个联盟，将其形成强制的Defi基准安全准则，只有符合标准通过审核的项目才会将其纳入联盟。
liqwang.eth retweeted
我用我的亲身例子跟大家说美国NG是真不行了。
我已经听太多同事跟我讲他们是刷了1000道leetcode题进厂的，我觉得这件事完全是浪费生命🫠
而且今年抽签情况也不容乐观，移民局各种审核卡签证，h1b抽到了也是坐牢。
ai作弊的越来越多，面试题越来越刁钻，以前NG只需要会做leetcode就行，现在普遍要讲system design 而且考的很难（面完会手抖的程度）
至于面试进去之后做的内容基本上高中生都能做，而且相当螺丝钉化，避免一个人过于重要，所以跳槽的时候你也会发现几乎没什么特别值得写在简历上的项目，因为没什么社交，所以社会化程度也很低。
房租嘛被那些早来硅谷拿大包的人炒到天上去，NG一个月到手一万刀，1/3拿去交房租，剩下的扣除401k所剩无几，外食小费18%起，食堂的盐水油盐混合物让人疯狂长胖，日复一日的罚坐和跟印度人内耗中消耗掉宝贵的20s人生。
想学习点新技术，下了班只想咸鱼躺，或者仔细想想对跳槽无帮助不如再做两道leetcode题。
咱们出生晚两年，一辈子只能当鼠鼠人中的鼠中鼠，你我都赶不上15年会做easy题进大厂的黄金时代了，只能放手一搏，听天由命。
liqwang.eth retweeted
好吧，这次手法细节有点意思了：
攻击目标是 LayerZero 运营的 DVN（去中心化验证器网络）所依赖的下游 RPC 基础设施。大概攻击步骤：
1. 拿到 LayerZero DVN 使用的 RPC 节点列表；
2. 攻破其中两个独立集群的 RPC 节点，替换 op-geth 二进制文件；
3. 使用选择性欺骗（selective spoofing）：只对 DVN 返回伪造的恶意 payload，对其他 IP（包括 LayerZero 自己的 Scan 服务）则返回真实数据；
4. 对未被攻破的 RPC 节点发动 DDoS，迫使 DVN “故障转移（failover）”到已被投毒的 RPC；
5. 完成伪造消息验证后，恶意二进制自毁，清除日志。
导致 LayerZero DVN 错误地为“从未发生过的交易”签发了验证。这不是 LayerZero 协议、DVN 密钥管理或 Endpoint 本身的漏洞，而是 RPC 基础设施被针对性投毒…
最终造成了 KelpDAO 这次 $290M 被盗事件。LayerZero 认为责任在 KelpDAO 只使用了 1/1 DVN 配置，存在“单点风险”…
嗯，这次也同样怀疑极大可能是“朝鲜黑客”的“杰作”…
RPC 投毒攻击也是老技巧，早年交易所们多少都经历过，这次干到了这些“去中心化”协议上了…🤦🏻♂️
liqwang.eth retweeted
Claude Design is insane.
❤️🔥Just recorded a 18-min tutorial on how to build animated, award-winning websites with Claude Design + Opus 4.7!
liqwang.eth retweeted
This is the story of Hyperliquid, the most profitable startup per employee on earth, told from a guarded office in Singapore.
Last year, its team of 11 generated $900 million in profit. It's 3 years old, has never taken a dollar of venture capital, and is beginning to change how century-old markets work.
Its founder, Jeffrey Yan (@chameleon_jeff), had never taken a physics class when he picked up a textbook at 16. Two years later, he won gold at the International Physics Olympiad. In 2019, he started trading with $10,000 from a living room in Puerto Rico—working off a television because he didn't own a monitor.
Within 3 years, he was running one of the largest anonymous crypto trading firms.
Then he shut it down. Yan was rich and free, but he had spent years inside crypto, watching it betray itself. Bitcoin's central premise was decentralization. Yet the biggest exchanges were centralized. Crypto kept reintroducing the dependence on trust it was built to eliminate. He set out to create what should have existed.
Hyperliquid is a blockchain with a trading exchange on top, and anyone can build on it. Yan's vision is to house all of finance. In 3 years, it has done over $4 trillion in volume. And in the past few months, it has begun to outgrow crypto.
Markets for oil, silver, and the S&P 500 now trade on Hyperliquid around the clock, weekends included, and are growing roughly 40% week on week. When the US and Israel bombed Iran on a Saturday in February, Hyperliquid was the venue traders turned to.
Hyperliquid's success has cost Yan his freedom. He works out of a secret office in Singapore and cannot travel without two bodyguards. Even the team's housekeeper doesn't know what they do.
In January, @domcooke spent a week at their office. Read his profile on Yan and @HyperliquidX below.
liqwang.eth retweeted
You can now enable Claude to use your computer to complete tasks.
It opens your apps, navigates your browser, fills in spreadsheets—anything you'd do sitting at your desk.
Research preview in Claude Cowork and Claude Code, macOS only.
