Used jpeg dealer \ Solidity dev & auditing \ VP Blockchain @yugalabs \ Founder @oSnipeNFT
The swamp
Joined June 2014
- Tweets27.3K
- Following3.8K
- Followers112K
- Likes62.4K
Pinned Tweet
I owe everyone a proper technical breakdown of the exploit of PaymentProcessorV2 and the rescue that followed.
The short version: Payment Processor trusted an ERC-2771 style “original sender” supplied through a trusted forwarder.
That sender could be forged.
1/🧵
Quit retweeted
ELECTRUM BITCOIN WALLET CONFIRMS CRITICAL SECURITY VULNERABILITY EXPLOITED IN THE WILD
Electrum has disclosed a high-severity vulnerability allowing malicious servers to trick users into sending Bitcoin to an attacker when increasing a transaction fee.
The attack works by intercepting a broadcast transaction and replacing it in the wallet’s history with a fake transaction redirecting funds to an attacker-controlled address.
If the user attempts to increase the fee using Replace-by-Fee (RBF), Electrum can sign the malicious transaction, sending the Bitcoin to the attacker.
Electrum confirmed two reported incidents, including one user who lost funds. Attackers even generated addresses matching the last four characters of the intended recipient’s address.
The vulnerability affects versions before 4.8.3 and has been patched in the latest release.
Users are urged to update immediately and verify all destination addresses and amounts before signing transactions.
Vulnerability disclosure: github.com/spesmilo/electrum…
Trying to get myself more chickens.
Went to use relay, slippage is too high.
Went to official abstract bridge, routes to relay.
Went to the official-but-hidden native abstract bridge, frontend misquotes gas so bridging is broken.
Hand built a tx with proper gas and bridged ~1 eth.
Everyone who wanted a chicken went through hell and back to get one, thank you guys for that.
Anyway, I'm now the highest offer among any given trait, so if you were going to sell your chicken please do it now.
And man I can't wait until these things are on Ethereum.
ya so unfortunately it seems humans are pretty dumb and nothing we built is secure, which would be fine if the opposition were humans because again, we are pretty dumb.
but we've gone and invented something smarter than us, which will now surgically tear down everything we've come to know and love.
ggs.
Safu receipts are live and verified on OpenSea, and 7,462 receipts have been airdropped to 1,738 victims affected on 9/25
If somebody you know has a receipt in their wallet, let them know to go claim at nftsaresafu.xyz
collection link (not tradeable): opensea.io/collection/safu-r…
Claim checker is live at mudwater.bayc.com/claim/
Enter an ID and see how many pack any bayc or mayc has available to claim.
A custody wallet has been deployed to house remaining assets. I will soon begin moving eligible assets* to custody. nftsaresafu.xyz will remain hosted for the foreseeable future, but this move is a more permanent solution that enables easier onchain claims and allows for the eventual deprecation of the site.
Contract deployed at vanity address 0x5AFe00...005AfE for added recognizability.
*some assets block contract custody via ERC721C rules, these will remain in the safu wallet and claimable via the old method. If their transfer validation rules are updated to allow the custody wallet, they will be moved at that point.
Just passed $4.5M in value returned.
As an aside, claims have slowed considerably and I will soon be transitioning all remaining assets to a more permanent home: a dedicated smart contract that issues ERC721 receipts to claimants.
Do not be alarmed if you see the assets begin to move - I will pre-announce the contract address.
This comes at an additional gas expense but means that each claimant will be written to storage, so assets will remain claimable for as long as Ethereum exists.
Stay safu.
nftsaresafu.xyz
As part of the migration, all assets migrated will issue an NFT receipt to the claimant, aimed to help bring awareness of the exploit to each affected user. This receipt is burned upon claim.
OpenSea: opensea.io/collection/safu-r…
Etherscan: etherscan.io/address/0x5afe0…
Quit retweeted
I often think @0xQuit is 6 different people because how can one person single handedly save all of our bags 3x and launch a gamified blockchain version of last man standing on a chain that’s about to be depreciated all in the same week.
Not all heroes wear capes.
Thx to @beijingdou for breaking down Abstract Chickens to me and @starlordyftw on the @Unc_Show.
Indeed about 2500 eth across 4 Swell proxies at risk here, however no indication that it can be taken.
Both ProxyAdmins are owned by the Swell Timelock.
The Timelock delay is set to seven days, and its administrator is a 4/7 multisig. None of the 7 signers have transacted since the attack started.
On the one hand, would expect the attacker to start the timelock period ASAP if they could acquire the necessary 4 signatures. On the other hand, would not expect them to deploy 4 targeted upgrade contracts if they couldn't.
However even without the upgrade, they can slowly drain the protocol. The attacker inflates swETH and rswETH’s reported backing by 1% hourly, buys tokens below the fake rate, then process their own redemptions at the inflated rate. Meanwhile they can block other holders' redemptions so only they benefit.
Railway is compromised and reports are that attackers are actively draining keys. Rotate any API keys stored in railway immediately.
Deployments are down so unfortunately this means many deployments will wind up broken, but it is better than the alternative.
Internet D-Day
Quit retweeted
I asked my AI to find the owners:
#6673 #9410 @EvelSpaceApe
#7651 #8964 #3996 @wakeandbayc
#7185 @RaviVora
#4837 @superwo03034397
#6268 likely IG @ketsubutsu
#594 #4375 likely nftari.eth
#3379 #1117 likely yassar.eth
Quit retweeted
"Quit" by @bookofbee. Minted into The Memes by 6529 today; a homage to the work of @0xQuit and a commentary on an ecosystem under siege.