you can now deploy disperse to any network right from the ui. this new feature uses createX for deterministic deployments.
the app may look the same, but it was rewritten from scratch with a modern stack. the side effect of this is that it supports most wallets now. i also added a chain selector for wallets that expect the app to switch the chain.
new canonical create2 address
0xd15fE25eD0Dba12fE05e7029C88b10C25e8880E3
the whole conversion and liftup took me roughly 10 hours with claude code. i've tested the most important pieces a little but there might still be some bugs.
one issue i encountered is wagmi only uses its own transports. i added all the 266 chains it currently supports, but i think if you switch to a custom chain in a wallet it doesn't know, it won't use a transport offered by a wallet, and the app might not work.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
🚨 ledger library confirmed compromised and replaced with a drainer. wait out interacting with any dapps till things become clearer. cdn.jsdelivr.net/npm/@ledgerhq/…
seems ledger connect-kit-loader is also vulnerable since it specified the dep loosely
ledger asks to use connect-kit loader to load connect-kit, but even if you follow the best practices and pin the version of the loader loader, it fetches the latest version of connect-kit >=1.0.0, <2.0.0.
this has allowed the attackers to infiltrate a shitton of libraries by compromising just the connect-kit. last known version coming from ledger is 1.1.4. three releases up to 1.1.7 were posted today, all should be considered compromised.
after investigating more than 90 million deposit and withdrawal events, i've found a supply discrepancy between the total supply weth contract reports and the actual outstanding weth.
it appears the contract holds 1 wei more than it owes. how is it possible?
the contract mints a token when you send ether to it. it doesn't track the token supply, using its own ether balance instead.
but there are two ways to send ether without triggering a contract.
first, you can set it as a block reward recipient. it will update the state, but won't run the contract code.
second, what our hacker has used, is selfdestruct (soon to be sendall). it destroys the contract and sends all ether balance to another address, without alerting it.
here is an idea for the fed devs, why not also ban 401,548 addresses which use exactly the same unverified (must be hiding something) bytecode? surely this code is up to no good. might be the same guy even.
It appears oasis.app, following Uniswap, has started sending all your data to TRM Labs. This is what happens when you connect with an address they don't like. No way to close positions from the UI, no explanation or anything.