Posts
-
Rusty Pipes
An npm supply-chain exploit that checks which packages you contribute to, then injects a malicious Rust binary into the next release.
-
Rusty Pipes Exploit
Using Rust to inject malicious code into npm packages. And hijack your entire node runtime.
-
Hot Potato: the floor that won't budge (unless you're math)
TATER is a potato with a hidden floor that is proven never to drop and a reserve proven to cover every holder. Built on the shielded-note stack I've been assembling for Zera and Vanta. A plain-English tour of what a ZK proof actually buys you.
-
Hot Potato post-mortem: the floor held, the token didn't matter
Four days of TATER on mainnet, every trade on one chart. The proven floor did exactly what it promised and was irrelevant to the price the whole time. What went wrong, what held, and how I would build the next one.
-
The post-quantum migration path: lattice commitments, STARK wrapping, isogeny credentials
Series finale. Shor's algorithm breaks every elliptic-curve assumption F_RP currently rests on. The migration: lattice polynomial commitments (Brakedown/Orion), hash-based STARKs as universal backend, isogeny group actions for credentials.
-
MEV resistance: why UPEE is sandwich-proof by construction
Theorem 7.3 — UPEE transactions resist sandwich/frontrun/liquidation MEV by construction. Theorem 7.4 — block MEV bounded by public-bit leakage, not transaction value. Independent of V, not super-linear.
-
F_RP vs Zcash, Tornado, RAILGUN, Aztec, Penumbra, Aleo, Namada, Monero
F_RP vs nine deployed privacy systems on the four axes that matter: relayer-free, Turing-complete, on-chain verifiable on a high-perf L1, low-trust setup.
-
x402 Vector 9: amount-string parser fuzzing
x402 amounts travel as JSON strings. "1000", "1e3", " 1000 ", "+1000", "01000" round-trip differently across implementations. Any disagreement between the facilitator's validator and Solana's transfer is monetisable.
-
Fitting F_RP in 656 bytes on Solana
Concrete F_RP instantiation on Solana. Groth16 over BN254, Poseidon Merkle, indexed nullifier tree, BN254 Pedersen, transaction in 656 of 1,232 bytes, 235K of 1.4M CU.
-
x402 Vector 6: AI-agent wallet drain via slow-burn pricing
AI agents on x402 use programmatic keypairs and auto-approve every payment under a price threshold. A service that ramps prices upward slowly after trust is established drains the agent without ever tripping the threshold.