Minebuu.eth (theo/acc) (@minebuu) header
Minebuu.eth (theo/acc) (@minebuu) profile picture

Web3 Security Researcher at @chainlight_io @theori_io

Joined September 2012
Photo by Minebuu.eth (theo/acc) (@minebuu)Photo by Minebuu.eth (theo/acc) (@minebuu)Photo by Minebuu.eth (theo/acc) (@minebuu)Photo by Minebuu.eth (theo/acc) (@minebuu)Photo by Minebuu.eth (theo/acc) (@minebuu)Photo by Minebuu.eth (theo/acc) (@minebuu)Photo by Minebuu.eth (theo/acc) (@minebuu)Photo by Minebuu.eth (theo/acc) (@minebuu)Photo by Minebuu.eth (theo/acc) (@minebuu)
📜 Introducing the Founding Deeds 3,333 Deeds, each with randomized rarity and metadata. Anyone can farm in Yield Fields, even without deeds. But deed holders have a separate loop that generates resources through gameplay. The fields now need keepers ⬇️
1,372
1,201
296
3,577
588,122
Why pair a memecoin with just one stock? Why not a basket of stocks? Stock-paired memecoins have been doing well on Robinhood, and while looking for similar ideas I found @pairdotfund, which lets you launch memecoins paired with multiple stocks as a basket. Two tokens have graduated so far: $CHIPS 0xbcd09284dffe06f868a4650546233e3e9abe4d97 : Paired with NVIDIA, AMD, and Intel. All three make chips, hence the name CHIPS $PEAR 0x3567c5d0ae5c5933920bbd6db982aa463a203bb2 : The first token launched on the platform, paired with AAPL, MSFT, and NVIDIA. I especially liked the CHIPS concept. There are a lot of things you could do with stock baskets based on a common sector, theme, or even rivalry. Musk and Sam Altman fighting again? Maybe someone launches a meme paired with SpaceX and OpenAI. The mechanism is simple. Each memecoin gets a separate pool for each stock in its basket. For CHIPS, roughly 33% goes to the NVIDIA pool, 33% to Intel, and 33% to AMD. A few risks / things I think are missing: 1. The team and product are still very small and relatively unknown. The contracts are also unverified. That said, for tokens that have already graduated and are trading on Uniswap v4, the team shouldn’t be able to modify the token supply, and the liquidity is locked in a locker, so the impact seems relatively limited. 2. Both graduated tokens are still only around $300K–$400K market cap. They could simply never get attention and die out. 3. Liquidity is fragmented across multiple pools. This is probably the biggest issue right now. Since each stock has its own pool, liquidity for the same memecoin is fragmented. That makes execution worse for users and creates easy arb opportunities when prices diverge. I think they need an aggregator that routes one trade across multiple stock pools automatically. I DMed the team about both the unverified contracts and the aggregator, and they said they’re already working on both. Disclosure: I hold both CHIPS and PEAR Tagging three people I often follow for Robinhood Chain updates: @theunipcs @AvgJoesCrypto @that1618guy
7
3
1
24
2,202
Primus는 web2 데이터를 web3에 쉽게 연결할 수 있기 때문에 다양한 앱이 가능 > Primus의 zkTLS는 HTTPS(TLS)로 받은 Web2 데이터를, 서버의 도움 없이도 진짜임을 증명할 수 있는 기술 > 은행 사이트에서의 내 잔고 내역, 민원 24에서의 내 신원 정보, 신용 평가 기관에서의 내 신용 점수들을 블록체인에서 인증할 수 있음 > 가령 해당 유저의 신용 점수가 900점 이상인가?를 zkTLS를 통해 개인정보 노출 없이 인증이 가능함 > 블록체인에서는 900점 이상의 신용 정보를 가진 유저에 대해 무담보 대출을 수행해주거나, 특정 나라의 유저만 에어드랍 클레임이 가능하게 하는 등 다양한 시나리오가 가능함 > 여기서 주목하는건 web2 신용을 web3에 가져오는 것. 최근 무담보 web3 대출앱들이 보이는데, web2의 신용정보를 기반으로 web3 앱들이 더 정확한 이자 모델, 리스크 모델을 구축할 수 있음 > 즉 web2 신용을 이용한 web3 무담보 대출도 가능
🍊 Rewind Primus AMA for seeking WEB3 new phase Xiang Xie (@xxiang_xie) said Primus is a solution that enables real-world data, which is necessary for building various applications in Web3, to be brought on-chain and verified without exposing sensitive information. Through this, Primus enables use cases such as proof of deposits in DeFi, and in the AI agents sector, it allows agents to prove the information they need and the actions they have completed in a trustless way, without relying on third parties. This expands the scope of what these sectors can do and makes broader product development possible. This kind of solution is an essential component for Web3 to move beyond degen culture or crypto-native use cases and enter a much larger arena. Beyond mainnet, Primus acts as an enabler that helps diverse dApps adopt and apply this technology stack. Discover what kind of ecosystem they are building and what plans they have through our recent podcast.
4
1
1
13
2,144
Let’s check a few facts about this market: 1. According to both the API results and what users saw in the mobile app, the end date was set to July 1 (nitter.cf/munchPRMR/status/20617…) 2. The rules did not specify a concrete final source-data cutoff date. 3. In practice, determining a company’s sales activity through May 31 requires some reporting delay. Traders were generally waiting for Strategy’s 8-K filing to confirm whether any sales had occurred. The fundamental issue is that the rules set by Polymarket were not sufficiently clear. To determine whether sales occurred by May 31, it is reasonable to rely on the company’s official disclosures. If that was not the intended approach, the rules should have explicitly defined a final cutoff date for acceptable data sources. What makes this even more surprising is that similar controversies have occurred before (polymarket.com/ko/event/micr… ), yet the rules were still written in such an ambiguous manner. It is even more unfortunate because the market’s open interest has now grown beyond $100 million, making it practically impossible to resolve the situation in a way that satisfies everyone, whether through a refund or some form of universal settlement.
I was just scammed for $500K by Polymarket. I am "willo2", the top holder of YES on "MicroStrategy sells Bitcoin by May 31st". Here's what happened:
6
3
53
3,761
Minebuu.eth (theo/acc) retweeted
Time to talk about this one. CopyFail (CVE-2026-31431) — a 732-byte Python script that roots every Linux distro shipped since 2017. 🧵
a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9 👀
42
448
79
2,706
747,935
Minebuu.eth (theo/acc) retweeted
Big news: Samsung Electronics selected Xint as a strategic tool to overcome the limitations of traditional manual security audits and to eliminate security blind spots. Leveraging AI on top of Theori's expertise as world class hackers, Xint autonomously analyzes the structure and context of services within complex infrastructures. This allows it to identify potential penetration paths from an actual attacker's perspective, even within frequently updated hybrid cloud environments. theori.io/news/316173ae-b1aa…
5
1
17
4,157
Minebuu.eth (theo/acc) retweeted
Anthropic is (rightfully) generating a lot of attention for Mythos’s ability to find 0days, BUT the hard problem is not whether an LLM can recognize a bug when pointed at it; it is whether a system can find the right code to examine across a 9-million-line codebase, distinguish the one real vulnerability from the hundreds of theoretical weaknesses the model will flag along the way, and deliver output a developer can act on without wasting a week on false positives. This is something Xint has been doing since our wins at AIxCC and #ZeroDayCloud last year. We wanted to see if using publicly available models with the right scaffolding would reach the same performance as the latest limited-release frontier model under **real world conditions** In this research paper not only did we find all the same bugs highlighted in Anthropic’s report, but found an additional 12 mid- to high-severity vulnerabilities not included in their public disclosures. Check out the full report here: go.xint.io/xint-mythos-appse…
14
2
49
19,304
The @AbstractChain team has just released an MCP server for AI Agents. For now, it seems to only support reading AGW and chain values, but it looks like it may soon be able to generate transactions through AGW as well. What I find especially interesting is the combination of AI and Smart Wallets. AGW, as a Smart Wallet, supports session functionality, which means I can delegate my AGW to an AI Agent on a per-session basis. The code below is AGW’s SessionLib contract. If you look at 'SessionSpec', you’ll see things like 'feeLimit' and 'callPolicies'. What does that mean? Unlike a typical EOA, it means you can configure detailed permissions for an AI Agent, such as allowing it to call only specific contracts, use only certain tokens, or spend only up to a certain amount. So even if I entrust my wallet to an AI Agent, I would not be handing over all of my assets. Instead, I can set much safer and more fine-grained permissions. I’m excited about the future!
🦞 Introducing the Abstract MCP Server 🦞 Agents can now manage Abstract global wallets, read Portal data, and interact with the chain. This server works with any MCP-compatible client including OpenClaw and Claude.
5
25
1,301
Gemini 3.1 Pro-Powered Detector for the Solidity “Transient Storage Clearing Helper Collision” Bug transient-bug-scanner.vercel… github.com/minebuu/transient… Using @Google's newly released Gemini 3.1 Pro model today, I built a tool that detects the Solidity Compiler high-severity vulnerability disclosed two days ago: the Transient Storage Clearing Helper Collision Bug. You can visit the site and either drop your project folder, or clone the repo and run an easy check from the CLI. No internet connection is required, and the scan runs locally. Your source code is never uploaded to a server. If you’re worried your project might be affected, give it a try! The core logic took under an hour to build, and after adding several exception and edge cases, the static tool now covers most scenarios. One caveat: if you import libraries like OpenZeppelin or Solady but they aren’t present in the same local folder, the verification may not work correctly. FYI: The video below is also a virtual demo generated with Gemini.
5
1
12
1,338
cc @solidity_lang Kudos to @hexens for discovering this bug
3
236
Abstract’s new game Maze of Gains is pretty fun. mog.onchainheroes.xyz/ It’s made by @onchainheroes (an Abstract OZ project) and it’s currently featured as an Abstract Spotlight app. You start with 100 energy, and each move costs 1 energy. As you explore the dungeon, you can break chests to recharge energy, and defeat monsters to earn gold and loot. Find the stairs to go down to the next floor, each new dungeon also gives you a random ability. Like PoP arcade, you can pay to increase your multiplier, and since there’s a prize pool involved, I’m still figuring out whether it’s possible to recoup the cost. Overall, it’s simple but really enjoyable. If you’ve got any tips, drop them in the replies. I’ve only played six runs so far—my only “tech” is that you can press Space to skip a turn without moving.
7
34
1,943
To celebrate Abstract’s 1-year anniversary, you can check your personal stats, and my top apps were Kona, POP, and Cosmo. My biggest XP week was 434,486 XP Honestly, considering how much I’ve spent on @DeathFunGame, it probably should’ve been #1, but maybe they hid it for my mental health Anyway, just like Pudgy is driving strong revenue with the Pudgy Penguin Shop and Walmart toy sales, I’m hoping Abstract shows clear, tangible wins this year across IP, DeFi, RWA, payments, AI, and more wrapped.abs.xyz/
3
20
599
I just got @minebuu from the X Handle Marketplace! Get your own at handles.x.com
4
339
Finally hit Obsidian tier on @AbstractChain
6
16
465
Clawbot is trending, but a lot of people don’t realize there are better alternatives How about having a cute, smarter monkey assistant? You can download the Mac version at smol.app
This quoted post is unavailable.
6
10
1
41
13,750