Fraz @frazWeb3

@iamthedrifter Mam blockchain is not equal to crypto. Under PVARA they have made legislative framework that will regularize the informal crypto economy & create environment for smart solutions using Blockchain tech. app.notion.com/p/fraznaveed/A…

me convincing myself go to work, because i need salary:

New article: write crazy gas optimizations directly in EVM bytecode, prove them equivalent to the original in @leanprover, profit. - Compilers won't do these. - Most humans don't dare. - AI + Lean proofs can. Read more + full article link below 👇

whenever you see a two-digit number and its reverse added together, like ab + ba, the result is always divisible by 11. For Example 97 + 79 = 176, and 176 is divisible by 11. Similarly, if the format is ab − ba, the result is always divisible by 9.

Getting started with ZK isn’t easy. One reason is that there are many possible paths. I personally think the best approach is to learn one proof system end-to-end, so you can see how the ideas in ZK fit together. It could be Groth16, PLONK, or STARKs. I like Groth16 and Pinocchio. To understand them, you need to know modular arithmetic, the basics of groups, fields, and elliptic curves. You don’t need to know everything about these topics - you don’t need to understand what a Twisted Edwards curve is - but you do need to understand homomorphic encryption and how we can hide values in points on a curve. You’ll also need to learn a bit about circuits, instances, and witnesses. You’ll learn R1CS, which is an important arithmetization, and then later compare it with Plonkish systems to see how different they are. You’ll learn how to encode constraints as polynomials and how it’s possible to use simple polynomial properties to prove multiple constraints by checking just a single constraint at a random point. This idea, often called the zero-th check, or quotienting, is used in every proof system based on univariate polynomials. It’s how we achieve succinctness. However, the prover needs to commit to a polynomial or evaluate a polynomial without knowing the evaluation point. This leads the student to learn about toxic waste and trusted setups, which are fundamental concepts in SNARKs. Finally, the protocol itself. Pinocchio and Groth16 address security by introducing toxic waste tied to the circuit - essentially placing the circuit inside the trusted setup. It’s elegant and not too hard to understand, but it’s also not ideal: if the circuit is part of the trusted setup, then every time the circuit changes, a new trusted setup is required. This naturally leads to the idea, after Groth16, of looking for protocols with at least a universal trusted setup. The student can then move on to systems like Aurora or Marlin. Then take a detour to another arithmetization and move to PLONK with its Plonkish arithmetization. Even though QAP-based protocols like Pinocchio and Groth16 are no longer the most "popular" (I don't know the correct word here) proof systems, they are still an excellent starting point for truly learning ZK, not just through analogies. Two resources that teach Groth16 from scratch, for example, are the @RareSkills_io ZK Book and the Moonmath Manual for SNARKs. Lecture 9 of the 2023 Zero Knowledge Proofs MOOC also covers this topic.

You don't need paid courses. You need consistency The only Web3 security roadmap you need.

Smart contract Maxis. DeFi Is Not Dead, Crypto Is Not Dead. Master Smart Contract development. Master Smart Contract Auditing. Master Symbolic Execution. Master Formal Verification. Master Fuzzing. This is the future of finance.

The complete Solidity gas optimisation checklist - in order of impact in 2026. ➔ Cache storage in loops. Reading from storage inside a loop hits 2,100 gas cold on the first access. Cache to a local variable before the loop. 100 iterations of an uncached SLOAD = 210,000 gas. Cached once - 2,100 gas. This is the highest-ROI optimisation in most contracts. ➔ Immutable for constructor values. Any value set once in the constructor and never changed should be immutable. It's baked into bytecode. Zero storage cost, zero SLOAD on every read. Common targets - owner address, token address, factory address, fee parameters. ➔ calldata over memory. For external function parameters you only read, declare them calldata. memory copies the data - that's an allocation. calldata reads directly from the transaction input. On large arrays and structs, this difference is significant. ➔ external over public. For functions only called externally, external reads arguments straight from calldata. public copies them to memory first. No other difference - but on functions with large argument lists, this adds up. ➔ unchecked arithmetic. Solidity 0.8's overflow checks add ~20 gas per arithmetic operation. For math you've already bounds-validated, wrap it in unchecked {}. In tight loops doing counter math, this compounds meaningfully. ➔ Events over storage for history. Transaction history, timestamps, metadata - if data is only needed off-chain, emit events. Event logs cost a fraction of SSTORE and are fully queryable by any indexer.

x.com/i/article/2046…

x.com/i/article/2046…

Look guys, it's actually really straightforward, a bunch of people staked their ETH on the Ethereum blockchain to earn yield, except they didn't want their capital to be locked up, so they actually staked with a liquid staking protocol called Lido who provided them a liquid staking receipt token called stETH, except they decided to juice their yield further by depositing their stETH receipt tokens into a restaking protocol called Eigenlayer, except they didn't want to lock up their capital, so they actually restaked with a liquid restaking protocol called KelpDAO who provided them with a liquid restaking receipt token called rsETH, except they decided to juice their yield further by depositing their rsETH tokens into a lending protocol called Aave so that they could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero that was hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry

x.com/i/article/2027…

If you want to learn malware development you need to do two things 1. Learn to code without the assistance of an LLM 2. Learn malware techniques, tactics, and procedures (TTPs). It doesn't really matter which one you start with. When I first started, I started with #2. I wasn't particularly interested in learning to program, but the theory and underlying concepts fascinated me. If you choose #2 you don't have to get super low level and start studying Windows internals (in this context I'm discussing Windows malware). You just need to know how a particular method works fundamentally. I think malware TTPs are really cool and I loved learning about them (I still do). What you'll eventually discover however is that TTPs "stack". You'll see newer techniques are based off of older techniques or they're slightly modified variants of older techniques. You'll also see some of the TTPs are completely legitimate things which are abused. You don't need a fancy course to study malware TTPs. You can just Google it or ask an LLM, or something.

I stumbled upon a bug while auditing an ERC4626 vault, and I thought it would be nice to write a post about it. Imagine that you are looking at a custom ERC4626 Vault that is meant to accept native assets deposits (ETH) instead of ERC20 tokens. -- The Scenario -- 1. The Vault is deployed. 2. Alice is the first depositor. She calls the `deposit()` function with 10 ETH. She is an honest depositor. Assume that the typical vault inflation attack is already mitigated. That's not the bug. 3. Since `totalSupply` is 0 at the time of her deposit, she gets minted 10 shares. 4. The Vault now has `totalSupply = 10` and `totalAssets() = 10 ETH`. Below is the code for the `deposit` function. Can you see what will go wrong?

please delete bro solscan API premium from $200 > 0$ gg unlimited access 😭

4nzn @paoloanzn

5 months ago

x.com/i/article/2026…

99 197 3K 1.0M 7K

Don’t overcomplicate it. • Build a Password Manager to learn file handling, hashing (not full crypto) • Build a URL Shortener to understand routing, IDs, and persistence • Build a Todo App with deadlines to practice CRUD and basic state • Build a Web Scraper to learn requests, parsing, and rate limits • Build a CLI Expense Tracker to master logic, files, and edge cases • Build a Log Analyzer to work with files, timestamps, and patterns • Build a Simple Recommender using similarity rules (not ML magic) • Build an Email Automation Script using SMTP and scheduling Projects. Not tutorials.

Solidity. Rust. Move. Vyper. Javascript/Typescript. There is enough security demand for all the languages. Don’t let the FOMO hit you and stick to one.

As a React.js Developer, how many of the below concepts can you explain : 1. Fiber Architecture 2. Concurrent Mode 3. Suspense for Data Fetching 4. Passive Effects vs Layout Effects 5. Hydration 6. useTransition 7. FlushSync and Deferred Updates 8. Error Boundaries 9. React.memo vs useMemo vs useCallback 10. Context Re-renders

bro created an entire 16-hour free youtube playlist on how to build a DeepSeek model from scratch. it goes over the papers, explains the theory, and implements the code. Syllabus: → attention mechanism fully explained → multi-head latent attention → grouped query attention → everything about positional encodings → mixture of experts (MoE) just start today with a laptop and motivation. playlist: youtube.com/playlist?list=…