yoav.eth

bartek.eth Verified account @bkiepuszewski · Mar 24

I think people are seriously misunderstanding the role of audits. To quote the article below:

"Resolv’s smart contracts had received multiple audits from well-regarded security firms, none of which identified the privileged key vulnerability prior to the exploit"

I have no idea why anyone would think that audits should surface trust assumptions of smart contracts. Their role is to check if the implementation of whatever they are auditing is bug-free, ie the code does exactly what it is supposed to do. If the code allows a single EOA to mint tokens by design - it's fine from the perspective of auditors. This is simply not a bug, it's a feature.

What we're doing at @l2beat is exactly what auditors are not doing. We expose "features" to end users. Make them visible and transparent with constant online monitoring (because "features" can change, most contracts are not immutable). You can call them "trust assumptions", "counterparty risks", however you want. But minting by EOA is a feature. If you held USR, you simply had to trust that EOA.

If analysing trust assumptions of chains, interop, defi protocols, tokens is not (yet) part of your risk assessment, talk to us. That's exactly what we've been doing for years now

View quoted post on X

thedao.fund Verified account @thedaofund · Mar 19

With no further ado, below are the first batch of applicants that were minted badges today:
@samczsun
@yoavw
@nicht_tintin
@GNSPS
@montyly
@gf_256
@hritzdorf
@Fredrik0x
@tinchoabbate
Gustavo Grieco
@AndrewMohawk
@iphelix
@dxo1312
@SoosMate
@rv_inc
@0x11b6
@MatthiasEgli
@a_permenev
@FrankResearcher
@DanielVF
@sbetamc
@RenaudDUBOIS10
@dr_zircuit
@notdeghost
@1nf0s3cpt
@poojaranjan19
@theRaz0r
@x86NOP
@mattaereal
@palinatolmach
@k3mmio
@donnoh_eth
@auryn_macmillan

TheDAO Curators also all received an ETHSecurity Badge:
@VitalikButerin
@GriffGreen
@jbaylina
@Pol_Lanski
@pcaversaccio
@avsa
@tayvano_

View quoted post on X

Aerugo Verified account @aerugoettinea · Feb 13

I am stepping into the role of interim co-ED @ethereumfndn to continue the progress that Tomasz has made over the last year.

Tomasz brought an energy and urgency that the EF needed at a critical time, and I join the community in thanking him for his work on behalf of the Foundation and the network.

This task isn't something that I take on lightly, knowing the weight of responsibility of the role through seeing it up close for some time, but it is one that I am prepared to handle.

I've served in a management position at the EF over many years, working closely with Hsiao-Wei, Tomasz, Josh Stark, Danny Ryan, Aya, and Vitalik at different points in time. My focus has been deliberately on illegible but essential work, helping management try to make well-informed decisions, working with EF's team leads, considering budgets, articulating strategy, setting priorities, and more.

The decisions I make will be guided by a principled insistence on the properties of what we're building (censorship resistance, open source, privacy, security). These properties are what make Ethereum relevant and competitive, and they are the foundation of Ethereum's value proposition to the world and everything the world builds on it; just as Ether is the foundational store-of-value that underpins every transaction across it; and just as both are indispensable to the EF's own treasury.

The mandate of the EF is to make sure that real permissionless infrastructure, cypherpunk at its core, is what gets built. Ethereum should outlast us, and it has been our job from the beginning to make sure it is robust enough to do so. I, and the rest of the EF, will work alongside other members of the community - core protocol contributors, researchers and client implementers, auditors and whitehats, incident responders, spec authors, solo stakers and validator operators, node runners, MEV gremlins, rollup and L2 teams, bridge and interoperability integrators, UX and product builders, infra providers and tooling maintainers, educators, community organizers, forum crews, lurkers, and free software advocates, grant-givers and culture-makers, artists, memers, cypherpunks, cyberanarchists, Landian accelerationists, financepunks, femboys, soundcloud rappers, transgenders, disinformationalists, cyborgs, anons, revolutionaries, shitposters, trolls, federal lists, hypebeasts, pirates, preppers, the bros, incels - to make it last 1000 years or more.

View quoted post on X

marc Verified account @heymarcopolox · Feb 10

We lost a valued customer last year.

They needed chain abstraction. Managing Safe accounts across multiple chains, and the signing overhead was killing their UX. Every key rotation meant six separate ceremonies. Every guardian update, same thing. Their users were drowning in signatures.

They asked if we had a solution. We said no.

Not because we couldn't build it. Chain abstraction was the 2025 narrative. Everyone was shipping it. We could have done it in weeks. Feature velocity, customer win, done.

But every solution we looked at had the same problem: trusted intermediaries. Relayers you had to trust. Wrapped assets. New points of failure. For infrastructure that secures savings, checking accounts and treasuries? No.

So we told them we didn't have it. They went with someone else.

That one stung.

You second guess it. Maybe we're being too pure. Maybe we're just slow.

But the teams we work with are building neobanks. Real money, real users. If a relayer goes down, if a bridge gets hacked, it's not our problem to solve. It's their users' funds. We can't sell infrastructure we don't control.

Then EIL was announced at Devconnect.

I was skeptical at first. But I read @yoavw's post on how EIL work under the hood. L1 as source of truth. Voucher system with economic guarantees. No trusted relayers. No new intermediaries.

It clicked.

Suddenly we had a way to build chain abstraction without compromising on what matters.

So we built Safe Unified Account.

Here's what it does:
• Sign once for operations across multiple L2s (Merkle proof verification)
• Atomic cross-chain via EIL integration (L1-anchored, not trust-based)
• No bridges, no relayers, pure cryptographic verification

The flow:
1. Construct UserOps for each chain
2. Arrange in Merkle tree
3. Sign root once
4. Submit with proofs to bundlers
5. Each chain verifies independently

For atomic operations, EIL's voucher system provides economic guarantees through XLP staking/slashing. Same signed voucher that claims funds on source releases funds on destination. Guaranteed by L1, not by trust.

The module is feature complete. Audit pending. We're sharing now to get feedback before we lock it down.

I don't know if we'll get that customer back. Maybe they're happy with what they chose. Maybe the trusted relayer approach works fine for them.

But I know we can finally offer chain abstraction to the teams building on Safe without asking their users to trust what they shouldn't have to trust.

Sometimes saying no is just buying time until you can say yes the right way.

View quoted post on X

LI.FI Verified account @lifiprotocol · Feb 5

What is the EIL?

The EIL focuses on trustlessness. Wallet-centric, cross-chain orchestration where the user is always in control - without the intermediaries.

But what does this mean for markets today, and how could markets look with wider adoption of the EIL?

Read more: li.fi/knowledge-hub/…

View quoted post on X