I am absolutely RESPONSIBLE for the outcome of my life 📌 💙
- 0 replies
- 1 recast
- 21 reactions
Today I got a reminder that shipping isn’t the finish line. Security is. We discovered an exploit in Shreds that allowed an attacker to repeatedly claim paid pack rewards without making valid purchases, draining the reward wallet. The smart contract wasn’t the issue. The vulnerability was in our backend validation flow. We were missing a critical rule: never trust client requests when rewards are involved. Every reward must be backed by verified onchain payment. We immediately investigated the attack, identified the root cause, and implemented fixes: • Every paid reward now requires verified onchain payment. • Approval transactions alone are rejected. • One purchase can only ever produce one reward. • Replay attempts are blocked. • Additional server-side validation and monitoring have been added. A tough lesson, but one that’s already making Shreds more secure. Back to building. Shred.signalify.xyz
- 0 replies
- 1 recast
- 1 reaction
It’s here. After weeks of building, testing, and refining, we’re excited to introduce the Celotip Telegram Bot for Shreds. Tip anyone on Telegram using their @username with tokens on Celo, no wallet address required. Powered by Celo’s gas abstraction, you can send supported tokens even if you don’t have CELO for gas. What you can do: • Tip anyone with CELO, USDM, cUSD, USDC, USDT, and 15+ Celo stablecoins • Check wallet balances • Deposit funds with a wallet address and QR code • Swap tokens directly • Buy CELOTIP onchain • View transaction history • Learn everything about Shreds, packs, rewards, XP, and the Celo ecosystem This is just the beginning. We’re also bringing Celotip to X (Twitter) and Farcaster soon, making it even easier to tip, discover, and interact with the Celo ecosystem wherever the community is. Stay tuned. 🚀 https://t.me/celotipbot
- 1 reply
- 3 recasts
- 6 reactions