data
Joined August 2018
- Tweets 6,701
- Following 169
- Followers 7,507
- Likes 330
925 Photos and videos
Pinned Tweet
15 Nov 2023
on compliance impossibility:
now that folks are focused on compliance because they are afraid of facilitating terrorism xfers....lets look at how it's not possible for the types of systems people want
@BenCharoenwong posted our preprint last week
papers.ssrn.com/sol3/papers.…
1
3
12
6,253
The kalshi-bar-knicks "hedge" is a great illustration of hedge effectiveness and how sports gambling doesnt 100% fix real biz problems.
By taking this bet the bar is changing their payoff profile but it is still risky...
Jun 1
Kalshi's first example of a small business using it as hedging tool is The Jeffrey, an NYC bar that's promising free drinks to all customers if New York Knicks wins NBA Finals Game 1 on Wednesday
1
1
642
The old payoff was:
Knicks loose -> uncertain gain from more customers
Knicks win -> large loss free drinks
This is clearly risky with one ve and one -ve
1
302
With the bet it is:
Loose -> unknown more customers - wager amount
Win -> bet payoff - unknown cost of drinks
Yes this adds something to the loss and reduces the gain. Its less risky but not magic. Both outcomes can still be a loss!
172
In the us you normally only get done for securities fraud after the price drops a lot.
The notes mstr repuchased that used up their cash are the puttable notes that made these 2024 comments false. Lol
Cases dont get easier than this.
19 Dec 2024
if this isnt material misrepresentation then nothing is
hes asked if there is an ability for debt holders to recall the debt. answer is that its convertible debt, theyll redeem with stock if needed and basically "no"
but the bonds are puttable for cash!
youtube.com/watch?v=y5UxvInD…
1
2
479
Remember that hyperliquid, like many platforms, can use the playback aave is using for "safety" on the Kelp mess to take all user deposits.
Tho the sanctions problems seem better at getting attention these days...
May 15
[ ZOOMER ]
CME AND NYSE ARE PUSHING THE US TO REGULATE HYPERLIQUID, DUE TO CONCERNS ABOUT MARKET MANIPULATION AND SANCTIONS EVASION: BBG
2
3
439
Details of how so many of these are outlaw. The only things that's immutable about many of these systems is the evidence they were always centrally controlled.
x.com/i/status/2008368303417…
fake-d dexes: some research on @Aster_DEX and @HyperliquidX
a detailed exploration of how both of these platforms have central operators despite of their public claims.
each is a different flavour of fake, but fake-d nonetheless.
as usual blog posts have full details...
205
Too rarely does anyone *test* these failovers. I was in the Morgan Stanley ny hq during the 2003 blackout and things worked (ex the aircon). They did test and it showed.
Its too rare sadly & have seen this many times since. Dont accept these failures. Engineers need to engineer
May 9
> We run a primary replica of our exchange infrastructure in a single zone, consistent with industry standards to reduce latency.
Primary & fallback architecture always sounds nice in theory but works poorly in reality. When you have some “standby” you never really use, and don’t do regular rehearsal to test fallback, they likely won’t work in the real disaster scenario, but you still pay for the redundant capacity 🥲
1
669
Recently hacked project reveals ongoing dependence on two more self-rolled tools: onesig and console.
Sure that'll be great.
schneier.com/blog/archives/2…
1
470
even @MessariCrypto is calling out faux decentralization. we are like 3 tweets away from even governments figuring out all the gaslighting.
just a sampling from the greatest hits list
🚨 @MessariCrypto just put out a vulnerability alert for @LayerZero_Core classified both high urgency and high impact under the "Security and Hacks" category
TL;DR:
- Independent security researchers flagged a structural vulnerability in LayerZero's default receive library configuration
- OApps that haven’t explicitly pinned their receive library fall back to the default set by the LayerZero Labs multisig, which can forge messages to any such OApp
- @LayerZero_Labs CEO Bryan Pellegrino confirmed: “Labs could create a malicious library or could point to itself as the only DVN”
- @banteg simulated the exploit path: ~$3.13B in adapter value was exposed after the Kelp bridge incident. ~$175M still sits unpinned today
- This is a recurrence of vulnerabilities @_prestwich disclosed in January 2023. LayerZero Labs CTO's public denial at the time was called false in the original disclosure report
- 3 of the 5 prior LayerZero Labs multisig signing keys were engaging in active DeFi txs (memecoin trading, DEX swaps, Stargate staking) while the signing threshold was only 2-of-5
- Pellegrino said one of the multisig signers was just “testing PEPE’s OFT integration” but onchain data contradicts this claim as the address was actually buying "McPepes" on Uniswap with ETH
--
Trading memecoins on production multisig keys ... An absolute failure of even the most basic opsec and key isolation best practices
We as an industry must do better than this
1
659
ah yes, good times. it sure looks like we are moving to the punishment phase soon.
197
Aws had a single az outage. Coinbase "observed failures impacting multiple AWS zones"
So if "Coinbase systems are designed to be resilient to a single zone outage" that is buggy and still has a single az dependence.
This is quite common in large orgs. But...
On May 7th Coinbase experienced service disruptions. Here’s a quick summary of what happened:
→ Around 8PM ET, Coinbase systems flagged high error rates across multiple services.
→ We traced these errors to amazon failures in Availability Zone (use1-az4) in the AWS US-EAST-1 Region.
→ Coinbase systems are designed to be resilient to a single zone outage, and are designed to recover quickly if this happens.
→ In this case, we observed failures impacting multiple AWS zones, which caused an extended outage of core trading services.
→ Coinbase users experienced an extended outage while the AWS team worked to restore temperature controls and other Amazon Managed Services.
This primary issue is now fully resolved - thank you for your patience. If you have any outstanding questions about your account, please reach out to Coinbase Support, we’re ready to help.
Our team will conduct a full analysis. Details may change as our investigation progresses and more information is received from AWS’s official retrospective, once published.
1
3
518
You have to admit the real problem a) if you want to have any chance of fixing it (ref: @AlcoholicsAnony etc) and b) because you are a public company and misleading public statements about your resilience might be bad.
On b its obv possible aws is lying but I wouldn't bet on it.
1
191
Its funny to watch people glom onto "thieves dont get title to property they steal" because the property at issue isnt what was "stolen" and thieves *do* get title to what they buy with the loot
Well grifted whichever cryptolawyer charged for this bs
May 6
TL;DR on the Aave/Arbitrum/Lazarus mess ↓
April 18: Kelp exploit hits. Bad rsETH/wrsETH collateral creates debt across Aave and Compound.
April 21: Arbitrum freezes ~30,766 ETH linked to the attacker.
April 24/25: Aave DeFi United coordinate a recovery plan to freeze the funds, recover assets, and prove ecosystem support to cover the shortfall.
May 1: A law firm serves Arbitrum DAO with a restraining notice, trying to block the frozen ETH from moving into recovery.
Their argument is that if the ETH is tied to North Korea/Lazarus, then people who already won lawsuits against North Korea should be able to claim it first.
But the issue is that no court has actually proven North Korea or Lazarus executed the hack.
May 4: Aave filed an emergency motion asking the court to remove the restraining notice so the frozen ETH can be released for recovery.
This has turned into a circus.
But I side with Aave here. A thief doesn't gain lawful ownership of stolen property by stealing it.
416
hard to feel bad for @krakenfx with etana given they claim "Unbeknownst to Kraken, the reality of Etana’s operation was nothing like what Defendants represented" while it was publicly known etana did exactly what they are moaning about
let's prove kraken are at best incompetent
@krakenfx entrusted Etana with millions of dollars that it was supposed to safekeep but has failed to return. Today our federal lawsuit against Etana and its CEO is calling it what it is: fraud.
Complaint here: bsfllp.com/a/web/7vyvfrjKSB4…. 1/3 🧵
1
3
958
and kraken has money to cover whatever etana's other clients are out surely. that they are now claiming not to know is an odd choice for legal filings rather than just pr statements.
that could get really good because...
1
164
if you can plausibly make a claim at kraken here youll get discovery. if it turns out kraken had a copy of the public doc quoted above or anything similar there will be all manner of attempts to blame all kinds of people.
@jespow maybe this was raised to you long long long ago?
1
164