Doing this on my account as it allows longer posts, but this is @Compxlabs related. Unfortunately our legacy token stream contracts were exploited today, 9th October. These contracts, from 2023 are no longer used, as they were replaced with the more modern Waypoint contracts for payments - any payments set up via the current contracts are not affected. --- A stream is supposed to pay one recipient on a schedule. The contract holds the tokens and releases them over time. An account that was not the sender or the recipient replaced the code on those contracts, then withdrew what was still inside. 44,078,064.233629 COMPX was drained. The first two we found were 2,241,758 COMPX from app 2460984089 and 2,184,066 COMPX from app 2461112995. Each of those also lost about 0.2 ALGO. The non-cancellable contract runs its withdraw logic on every application call, and a successful withdraw approves that call. Replacing the program is one of those calls, so the attacker’s update was accepted. They put a timestamp in the transaction that made the vesting math owe the recipient nothing, so the contract paid 0 COMPX and still approved the update. The new program then ignored the schedule and sent the remaining balance to the caller. Cancellable streams do check the call type. 599 streams are cancellable and are not affected. We have upgraded and fixed 187 non-cancellable streams. A claim still pays the recipient on the original schedule. A further change to the contract can only come from our admin account. 469 streams could not be upgraded because the receiver is not opted into the asset anymore. The contract cannot pay that account, or accept this update, until they opt in again. We will pay the taken COMPX back directly to affected users over the coming week with the aim to have all affected users' funds repaid by Friday 16th October.

We already did! Pqattest.com

As you know I love some x402 agentic payments. @LitecoinVM doesn't have a facilitator for LiteForge testnet so.... I made one! And made a little demo to try it out. Thanks for the tip @SirAlbert2A It's called Relay-14, and it's a part of the @Compxlabs As always, you can just do things!

❗️Introducing: PQ Attest Post-quantum attestation for any transaction. PQ Attest writes a transaction fingerprint , from any supported chain, onto Algorand’s quantum-secure ledger and returns a proof you can verify independently. Today that means @base and @Algorand: pay in USDC on either network to attest a @base transaction onto Algorand's future proof ledger. Built for agents (x402) and for teams who need a durable, post-quantum record they can independently verify. More supported chains coming soon. Learn more and try it yourself via the links to follow 👇

The campaign is live! Money is Boring: A human wallet for Algorand — with an agent that puts x402 and agent tools in your pocket. Live on @SproutAlgo, ask is 5k ALGO, 30 days long. A successful campaign means that all backers get early access to the app as I build in public. Make money less boring, with an agent in your pocket. . . . . . . Ignore the cube.

Very excited with this one! Being able to get quotes from @alphaarcade was great, and still is. But being able to see the markets on both @Kalshi and @Polymarket is the next big step! Getting back unsigned transactions is still only on Alpha, but it's coming very soon so your agent can be completely self served by the endpoints. Now, if you can get all the best market opportunities across 3 prediction markets...surely you'd see where they diverge on the same market....hmmm. Arb next!

Ok, well that's me very busy! - Canix402 v1.6.5 coming out tomorrow with some nice new features - @pplsDEX on mainnet, Mallow app is back to high priority - Canix402 v1.7.0 planning with adding @LiquiHog STAMM - Amarok v1.7.0 is underway already with @Kalshi and @Polymarket being added Oh and super secret new project is looking good so far, should get the green light! Anyone want to help 😂??

I like saying “you can just do things.” Starting is cheap. Getting taken seriously isn’t. Fail fast used to be a poster. Now a bad idea costs a weekend.

Look at this little guy! Mallow: Soft Defi - soon!!!

New Substack article: 'Roadmaps and Cloud Agents' Link follows 👇

Looking at something like SolanaClawd, I think Algorand could do a great version powered by @NFDomains rather than NFTs for the identify part. If you think it’s interesting, let me know!