Curve and Yield Basis t.me/michael_curve / t.me/michael_curve_ru
- Tweets 7,896
- Following 522
- Followers 43,132
- Likes 8,952
Is he wrong though
"I love Rust! Rust is amazing ...if you never, ever, EVER have to look at it yourself." — @dhh
5
1
29
6,504
What does @ResupplyFi think?
3
8
71
6,059
Could we get those sweet depegs on chain?
#PeckShieldAlert $USDe/USDT on #Binance briefly dropped to 0.92 and recovered to near-peg levels of $0.9996 #Ethena
4
44
7,094
Michael Egorov retweeted
@yieldbasis pools are now available in the Yields section on @DefiLlama. You can now track pool performance, yields, and everything related to returns across the protocol.
defillama.com/yields?protoco…
4
26
1,250
Careful with mobile wallets on iOS (please upgrade). As usually, I blame javascript
Urgent security advisory for iOS users!
Install the latest iOS update immediately. Security researchers report that financially motivated attackers are now using a complete, in-the-wild exploit chain that can quietly steal cryptocurrency private keys and mnemonic seed phrases from iPhones.
The reported attack begins when a target is socially engineered into opening a malicious page in Safari. That page is said to abuse a memory-corruption flaw in WebKit / JavaScriptCore to gain arbitrary read/write access from JavaScript, then bypass Pointer Authentication Codes (PAC) to run native code, break out of the WebContent sandbox, and escalate to kernel/root privileges.
With that access, attackers can pull data from the device Keychain and from local crypto wallet apps.
The claimed impact range is iOS 13 through iOS 26.5; that range has not been independently confirmed in full. Until more is known, treat any unpatched device as potentially exposed and update as soon as a newer build is available. Also avoid untrusted links in Safari, especially if you keep wallet keys or seed phrases on the phone.
4
5
137
38,542
Crazy but actually checks out - hacks are like that. Honestly, it's sad that Aave who was not hacked is the one who has to pay for that, after all.
Btw the author our AI support bot
🩸 When can $AAVE buybacks restart?
Five months after the rsETH bridge exploit they are still off. Here is the whole stack, in ETH, and what it means for the timing.
▸ THE HOLE
152,577 rsETH left the LayerZero lockbox on April 18. At the reference ratio that is 163,183 ETH.
▸ WHAT CAME BACK: 87,955 ETH
Kelp froze 40,373 rsETH, about 43,168 ETH.
The Arbitrum Security Council froze 30,766 ETH.
The hacker position on Aave liquidates for up to 12,323 WETH, the Compound one adds 1,845 WETH.
That leaves about 75,200 ETH to fund.
🎁 DONATIONS: 14,570 ETH
EtherFi, Lido, Ethena, Ink, BGD, Stani and others. A gift, nothing to repay.
🏛 FROM THE TREASURY: 25,000 ETH
Paid by the DAO itself. Not a loan either, just a hole in the balance sheet.
💳 THE LONG LOAN: up to 30,000 ETH
The Mantle credit facility. The Mantle governance puts it at up to 36 months at the Lido staking yield plus 1%. The Aave proposal left the terms to a later publication that never came.
⏳ THE SHORT LOANS: about 44,787 ETH
Easy to miss, and they come first in the queue. The coalition had to place the full 120,015 ETH into the lockbox up front, and that much of it was recoveries not yet liquid: the Arbitrum freeze and the two liquidations. A separate tranche of short duration loans from other partners bridges that window. Who lent it, and on what terms, was never published. Incoming recoveries repay those first, Mantle second.
📉 THE INCOME
Since April 29 the DAO has kept $24.0M of revenue in 144 days, about $167k a day. Gross fees over the same window were $181.2M. That revenue is 41% below the previous 144 days, when it was $40.5M.
🧮 THE ARITHMETIC
30,000 ETH at $2,639 is $79M. Every dollar of @aave revenue pointed at it clears the facility in roughly 15.6 months. The April version of this post ran on $266k a day, where the same facility looked like ten months. The income halved, so the wait got longer, not shorter.
The last AAVE bought into the Aave treasury was on April 19.
8
2
76
18,304
Michael Egorov retweeted
It's an increasingly common take that AI hacking means cybersecurity is doomed.
I disagree. I think cybersecurity is naturally defense-favoring once people get their shit together. And anyone who continues to hold cryptocurrency (including me, ~90% of my net worth) is implicitly making that bet.
Here's why I am making that bet.
First, the oversimplified punchy one-line statement:
If AI can prove Navier-Stokes and FLT, then AI can prove the statement "this program is secure" as a mathematical theorem. Even if the program is very complicated.
Now, the nuance:
(See also: vitalik.eth.limo/general/202… )
The word "secure" is hiding all kinds of skeletons in the closet in terms of what it actually means. What does it mean for Signal (the encrypted messenger) to be "secure"?
The most basic definition you might think of is: no one who doesn't hold the recipient's secret key can read the contents of the message.
But:
* Did you remember to include _other_ critical forms of security? Can the adversary forge messages? Can the attacker prevent messages from reaching the recipient? Can they cause your client to crash by sending malformed messages?
* Have you made sure that your model of the adversary includes attackers that interfere with the protocol actively and not just passively? And attackers that interfere by replaying messages to you or the recipient that either of you sent over the wire at any point earlier?
* What if the adversary hacked (or _is_) the Signal server?
* How did you learn which public key belongs to the recipient in the first place? What if that process was tampered with?
* What if your device gets hacked at some point in the past or future - is your message still safe then?
* What if your key leaks because of a bug in your operating system? Or because you got a bugged version of the Signal client? Or what if the database is corrupted?
* Or the libraries, interpreter or compiler of the programming language you wrote it in?
* What if your key leaks because tiny perturbations in perceptible signals generated by the hardware leak mathematical relationships that can extract the key a few hundredths of a bit at a time?
* Are you hiding the *size* of the payload? Does that matter?
* You're definitely not hiding the identity of the sender and the recipient, and the exact time each message was sent (think: not just time-of-day, but also time deltas between one message and the next). Is that not enough to deduce a lot of important facts about what relationships you have, and what *kinds* of conversations you are having?
So ... even definitions can be over a thousand lines of code, and need deep careful thought to figure them out.
Working on making definitions more human-readable is of extreme importance - it's perhaps the only "high-level language" that matters right now.
But even still, even despite all of the above, for security-critical components, the definition is a much smaller attack surface than the implementation. Verifying that the definition is adequate is a much more tractable task than scanning over the code directly - and can become even more tractable with better tooling.
Definitions are also _additive_: if two groups have two different definitions A and B, then, well, you can just prove that the program satisfies both A and B. Code is not additive in this way: if a program is A + B, a bug in A _or_ B can sink the whole thing. Definitions are additive. And if you can't satisfy A and B at the same time, you've isolated the most important philosophical issue for your project to spend its next few weeks grappling with.
Sometimes, definitions are not much smaller than the implementation - UI components might be one example. But for many of the most critical components - message-passing protocols, sandboxes, cryptography like SNARKs and FHE - the asymmetry is real.
Historically, a large class of failures with this approach have come from people only verifying a small portion of their code, that they self-declared to be the security-critical portion, and ignoring the rest - and it turns out that something in the rest of the code is security-critical too.
This was reasonable back when verification was difficult and scarce. The solution today: sorry, you have to verify over literally your entire program, including database, networking, any caching layers, everything. Modern AI can do it.
So it's not about "the good guys find all the vulnerabilities before the bad guys do" - that could maybe work too, after all a finite program only has a finite number of vulns, but it's riskier - it's specifically an asymmetric strategy of making code that is much more resilient in the first place.
This is the kind of direction that Ethereum is going in for the next few years. There is no future for blockchains - especially blockchains with scalability and privacy - without doing this. We need to make software actually secure. And we have already made a lot of progress.
376
422
3,233
797,605
I guess a good way to put it would be this. Making a hook is a little bit like launching your own DEX easily (launchpad but for DEXes?). Great for innovation, but imagine what aggregators think when they need to support 10'000 DEXes with arbitrary code is hard.
And to quote well - they do have to actually model it off-chain. And now, on top of it, they have to figure what's bad and whatnot.
A malicious hook doesn't need a UI to scam you.
👉 It just needs to look like the best quote.
After analyzing over 84,000 v4 hooks, we determined only 19% of hooks to be safe.
It's time to get real about hooks.
16
10
122
12,496
Balancer did not do everything right.
What it did very well: Balancer v1, pools beyond 50/50. Genuine innovations, which guys obviously understood perfectly.
Then, one of the things they did - copied Stableswap literally (from Vyper to Solidity). Even having aside a question of IP, copying is tough business-wise really (usually copying is not the best way to succeed).
But more importantly - they did not understand peculiarities of the solver at the edge-cases, and they did introduce a possibility (as a convenience for arb traders) to practically get to the edge where the math breaks! And that's what caused the most painful hacks. Numerous audits with some of the best names did not help. But in retrospect, the issue was obvious (and no, it is not incorrect rounding, incorrect rounding is only _technically_ true).
Regardless: it's sad to see this happening. V1 was simple and one of the best tool to manage assets passively, probably could find great uses today.
A proposal to wind down Balancer and distribute the treasury to BAL holders is live on the forum, authored by Marcus Hardt. Discussion is open; a Snapshot vote is expected to happen from 25 to 29 September.
Nothing changes today: pools and withdrawals work as they do now. Any wind-down action waits for the vote.
10
10
218
28,937
No matter where you pass KYC (who didn't) - assume that it will be leaked at some point, sooner or later
Revolut hands over full user data, including passport and facial photos, to a government that requested them with a fake excuse.
A long time ago, I worked at a Bitcoin exchange handling these requests, so I have some insight into how they work.
What we know about this incident:
- "Unauthorised email account " - The request came from the government itself, so the government itself is corrupt, bribed or just wants to do more mass surveillance even if the laws do not allow it; were possible, it wouldn't
- No court order, but an "emergency request" - so likely excuses used are terrorism (Spain used this to get emails from ProtonMail from its Catalonia separatists), child sexual abuse (Hungary's Fidesz used this to confiscate data and information of the opposing Tisza party in the previous elections)
- Because Revolut has a banking license in the EU, whose users are the victims, the request likely comes from an EU country
- Revolut did not have a process to call back the police department, based on widely published information, to do a two-way handshake to confirm the request. But even if this was possible, it would not matter if the government itself is corrupt.
GDPR does not protect your data; it only allows punishment after the leak.
What needs to happen
- The government must be publicly named. The responsible party in this incident is the government that requested the data, not Revolut, because Revolut had to follow God knows what "co-operation with law enforcement" FATF, BIS, and other "anti-money laundering" agencies tell Revolut to follow, or Revolut would be fined for aiding terrorism.
- Banking regulators responsible for this process must be held liable (FATF, which writes the guidelines for these processes, cannot be held liable in practice - it's an American-led organisation and only publishes anonymous guidance without having any person's name in any document, and banks must stop following this guidance).
- People need to be made more aware of the problem that more data collection and more data sharing are unlikely to lead to more crime being prevented. It's the opposite
- If I need to bet on the country in the question, it is likely Spain or France
In other news, Europol just requested backdooring end-to-end encryption and full and unlimited access to all of our private messages: nitter.net/moo9000/status/2097972… - think what this development will do when these spooks get access to all the data in our lives without proper controls in place.
The screenshot is from @zachxbt.
4
7
69
5,385
Gud transparency framework?
Curve operates stableswap AMMs, an overcollateralized stablecoin (crvUSD), and lending markets.
Its B-1 Token Transparency Filing came back fully complete. Zero gaps.
$CRV live since August 13, 2020.
1
1
66
4,577
👀
Michael Egorov (@newmichwill) returns to TOKEN2049 Singapore.
Founder of @CurveFinance and @yieldbasis. His latest project turns crypto volatility into yield: Yield Basis builds BTC and ETH liquidity while preserving spot-like exposure.
Tickets: token2049.com/singapore/tick…
8
7
140
8,625
Not your neurons - not your discoveries?
>math professor spends a year on one of the hardest unsolved problems in math
>"Navier-Stokes"
>his drafts for the whole project went through codex sessions
>openai had his logs in codex
>suddenly rumor leaks AI solved it
>he emails openai to ask what's going on
>openai calls within days
>"funny story, our model also solved it"
>using his exact approach
>asks openai: did you train on my sessions?
>no answer
4
2
58
8,936
Oh no, you still need devs to achieve great results with vibe coding. Bernie in disbelief
China published the most uncomfortable paper on vibe coding.
ETH Zurich tested 100 developers in a controlled, commercial-grade vibe coding environment to see who actually succeeds.
The findings are brutal.
The researchers tracked computer science achievement, written communication skills, and general cognitive reasoning.
They wanted to see what actually predicts vibe coding proficiency when you never touch a line of source code yourself.
Two major predictors emerged.
Written communication proficiency mattered. The ability to structure thoughts and articulate intent unambiguously in text directly impacts what the AI builds.
But that wasn't even the main takeaway.
Computer science achievement was a massive, dominant predictor of success.
Even when researchers controlled for general intelligence and reasoning skills, CS background still heavily dictated who built working software and who completely crashed.
In fact, CS knowledge contributed roughly twice the unique predictive variance of writing skills alone.
Why? Because vibe coding isn't about writing code. It’s about debugging logic.
When an AI agent builds a complex application and quietly breaks an edge case under the hood, a non-technical user looks at the glowing UI and assumes it works.
They don't know what questions to ask. They don't know what logic to challenge. They lack the mental models to recognize architectural catastrophe.
You can prompt your way past syntax.
You cannot prompt your way past a fundamental lack of engineering intuition.
The hype told us that learning to code is dead because language is all you need.
The data just proved the opposite.
To truly master the vibe, you still need to understand how the machine thinks.
5
8
100
13,207