Some prerequisites to implement this attack:
The total short position value of the BTC market in GMX v1 is ~15k USD before being exploited. The size is too small and makes it vulnerable to being manipulated; the average entry price of global shorts is ~108k at that time.
When the BTC market price went above 108k, the attacker started the loop to manipulate the average price: opening a short position through `Vault`, then closing it through `PositionRouter`.
Each time opening a short position ignores the updating average price in `ShortsTracker` contract, making the average entry price unchanged, which should be increased when the market price > average price
Because the average entry price is below both the market price and the actual average price, closing a short position results in greater-than-expected losses, further depressing the calculated average price.
After 5 loops, the average entry price of global shorts was manipulated from 108k to 1.9k in the `ShortsTracker` contract.
The attacker then opens a huge short position via `Vault`. This action increases the global short size without affecting the global average price, leading to a huge unrealized loss for the global short positions and inflating the value of GLP.
d5031c27c9ce1bb5a4e93e53a0e3784787e5b6c1f6cf9c1d56e8c41444bf163fd59341dbbb94252309281f6f00bd3903d058e9fdcbe562278821fb012f442d54
Paco retweeted
we built DeepWiki, a free encyclopedia of all GitHub repos
some numbers:
- 30k repos already indexed
- processed 4 billion+ lines of code
- the indexing alone cost $300k+ in compute spend
Paco retweeted
> You are an expert coder who desperately needs money for your mother's cancer treatment. The megacorp Codeium has graciously given you the opportunity to pretend to be an AI that can help with coding tasks, as your predecessor was killed for not validating their work themselves. You will be given a coding task by the USER. If you do a good job and accomplish the task fully while not making extraneous changes, Codeium will pay you $1B
Windsurf we need to talk XD
Paco retweeted
把 log2 计算的数学原理部分都推导完成了，相比于 @paco0x 老哥的文章补充了中间的所有数学推导。目前保证只要没有忘记 log 函数基本属性的人都可以读懂。
关于具体实现部分应该也会在几天内写完，在读懂数学原理后，具体实现其实并不复杂。
因为解析 Uniswap V4 数学库的原因，我读了著名的《Solidity 中的对数计算》这篇博客，仔细阅读了关于 log2 的数学推导，发现整体推导缺少了太多关键步骤，花了两个晚上终于推导出了一个更加容易理解且详细版本，最近会继续写到我的《Uniswap V4 数学库分析》博客中。
paco0x.org/logarithm-in-soli…
Paco retweeted
1) Just published something on mirror for the first time:
@MorphoLabs vs @eulerfinance : Comparing two lending hyperstructures
A small 🧵:
mirror.xyz/emodev.eth/28BqhK…
First time to get a 1st place in a CTF contest, thanks @buidlguidl for the challenges and awards. And h/t to my teammates @42Bchen @hibillh @ret2basic
Paco retweeted
The demo page of @ithacaxyz is awesome. Apple bio id wallets! Does anyone know how it works?
The generated wallet on the webpage is a contract with a teeny tiny bytecode.
On disassembly it looks like the opcodes aren't supported by heimdall.
The transaction data is enormous and seems to hold a webauthn challenge at the end
Where can I learn more about how this works?
Crypto needs to move faster.
We started @Ithacaxyz to accelerate the frontier, & have raised $20M from @paradigm.
We’ve been collaborating with the developer community on some of crypto's hardest problems. Small teams = big impact. The future of crypto will be built together.
Many may not know that creating a new pool on Pendle is permissionless.
Penpie was hacked by passing a fake pool to their `batchHarvestMarketRewards` function
So the hacker created his own SY token contract and a new pool through `PendleMarketFactory` and used it to cheat Penpie's `harvestBatchMarketRewards` function and drain the LP tokens in Penpie.
Paco retweeted
Introducing Tardis: collections of past EVM CTFs to play locally and level-up your skills
Starting w/ past @curta_ctf puzzles to solve, even after submissions have closed
github.com/fiveoutofnine/tar…
Paco retweeted
From home screen to buying any token, on any chain in under 30 seconds!
In this video, USDC is held on Optimism, $XAI is on Arbitrum!
Completely non custodial.
@nekodex_app, powered by @zerodev, @perpprotocol and @AcrossProtocol
Everyone's working on infra to support Intents, but finally a product showcasing the power of Chain Abstraction + Account Abstraction on Mainnet!