alcueca Profile Banner
alcueca Profile
alcueca

@alcueca

4,907
Followers
161
Following
447
Media
3,269
Statuses

Co-Founder @yield Co-Author ERC4626 (Tokenized Vaults), ERC3156 (Flash Loans) ERC7266 (Oracles) Judge @ Code 4rena

Portugal
Joined March 2020
Don't wanna be here? Send us removal request.
Pinned Tweet
@alcueca
alcueca
11 months
I’m looking for advisory roles in DeFi and Web3. As most of you know, I like to help people with the knowledge I have. Trying to do it in a regular manner with a small group of companies looks like fun for me. 1/4
Tweet media one
6
6
66
@alcueca
alcueca
11 months
We are so back
Tweet media one
20
20
621
@alcueca
alcueca
3 years
Since I mentioned that I started coding solidity three years ago, at the ripe old age of 38, many have asked me how to do the same. There isn't a secret or a resource that is exceptionally better than the others, but here is my story.
25
83
493
@alcueca
alcueca
2 years
This is what peak auditing performance looks like.
Tweet media one
13
49
363
@alcueca
alcueca
3 years
A thread 👇
Tweet media one
4
40
254
@alcueca
alcueca
1 year
My most successful failure. Thank you everyone for all your support during these years ❤️
@yield
Yield Protocol
1 year
We’ve made the tough decision to wind down the Yield Protocol. The March 2024 fixed rate series will not be launched. Only the December 2023 series remains active for borrowing and lending. All borrowing and lending will end by December 31st.
57
115
350
23
2
257
@alcueca
alcueca
1 year
The ERC7399 Flash Loan Standard, and ERCs in general, don't mandate you code in @solidity_lang . Code a reference implementation in other language ( @vyperlang , huff, whatever), and we will link it on the EIP. That's your ticket to greatness right there, young hack.
7
1
26
@alcueca
alcueca
4 years
The ERC3156 standard for flash loans is now FINAL 🎉 Everyone rejoice, this is a step beyond what you can get from traditional finance.
8
31
168
@alcueca
alcueca
3 years
Tired to do liquidity mining with the same old contracts? Try our new ERC20Rewards.sol. We merged the math from Unipool into an ERC20 contract so that token ownership is rewarded, without the need for staking transactions. Brought to you by @yield 👍
14
20
174
@alcueca
alcueca
1 year
Understanding the architectural design of DeFi borrowing applications will make you a better developer, architect and researcher. 🧑‍💻 This is an article I had wanted to write for quite a while, with lessons from building @yield . 1/🧵
2
46
166
@alcueca
alcueca
4 years
There is a new WETH in town! 👋 The Wrapped Ether contract we all know and love was deployed almost 3 years ago, so a bunch of us decided to upgrade it. Flash minting, ERC2612 permits, transferAndCall and much more, check it out! 👇
10
35
119
@alcueca
alcueca
2 years
Are you starting out as a security researcher and looking for your first solo audit? I'm looking for two security researchers for a special project, that would suit a junior profile. If you know me, you know this will be good for you. DM me.
18
18
115
@alcueca
alcueca
3 years
When developing the oracle layer for @yield I learned one (1) thing that has helped me build more robust, scalable and precise smart contracts.
7
17
116
@alcueca
alcueca
4 years
I dealt with critical systems in investment banking for years. The upgrade process of the USDC token has left me speechless in its relative simplicity and robustness. Long Ethereum 🚀
@coinbase
Coinbase 🛡️
4 years
Here’s a technical walkthrough of the challenges and solutions for upgrading USDC, a multi-billion dollar ERC-20 token:
181
132
633
1
10
107
@alcueca
alcueca
9 months
Tokenized Vaults are growing in popularity, and they are becoming a more desirable target for hackers. Along with @zimbeme from @eulerfinance , let me take you for a trip of exchange rate attacks and their defenses in tokenized vaults. Article link in the last tweet. 🧵
Tweet media one
4
31
112
@alcueca
alcueca
8 months
Judging the most insane contest at @code4rena ever. - Small pot ($36k) - Small codebase (550 sloc) - ~200 competitors - ~1500 submissions I need a hug
6
1
110
@alcueca
alcueca
4 years
The $YAM debacle was caused by a fixed point math error, which would have been avoided if a strongly-typed fixed-point library would have existed. Now it does :D
3
16
101
@alcueca
alcueca
7 months
If you are a borrower of flash loans in your protocol, we have now 10 adapters in ERC7399, deployed in 5 chains. Borrow from anyone, anywhere. Free to use, permissionless, because we love you.
Tweet media one
11
5
66
@alcueca
alcueca
4 years
Some of the things you can do with WETH10: - ERC2612 `permit` for gasless transactions ⛽️ - ERC667 `transferAndCall` to skip `approve` 👉 - `deposit` and `withdraw` with arbitrary sender and recipient 💸 - ERC3156 zero-fee flash mints ⚡️
5
8
86
@alcueca
alcueca
3 years
@nanexcool I was 38 and had never coded anything to be used by other people. So no, it's never too late.
4
1
84
@alcueca
alcueca
9 months
I had a role in creating the @erc4626 standard, for which token donations are an attack vector. I've always been very vocal about tracking balances as an effective defense against donation attacks. With the Wise Lending hack, and @danielvf 's excellent analysis, it's time for me
@danielvf
Daniel Von Fange
9 months
Yesterday's complete hack of Wise Lending was far more complex than reported. Very worth examining. The protocol had added explicit defenses against this style of attack, which the attack then either bypassed or used against the protocol. 🧵 1/21
Tweet media one
21
99
522
5
15
86
@alcueca
alcueca
4 years
3/ I made ERC-3156 wrappers for Aave, dYdX, Uniswap and Yield: If you can execute a `flashLoan` function and receive an `onFlashLoan` callback, you can use any lender. Aave was easy, but charged 0.09%. dYdX was difficult but free. Now they are both easy.
2
10
80
@alcueca
alcueca
3 years
A wild Timelock.sol appears! It's based on the mechanics of the venerable Compound contract, uses roles like the OpenZeppelin version, and has that @gakonst magic. All that in 97 lines. Being audited now for @yield v2 at @code423n4 . Enjoy!
6
9
76
@alcueca
alcueca
9 months
I recently completed a review of Euler's EVC, which went public last week. It is the first engagement after Yield that I can talk about. I got a lot more out of it than I ever expected. 🧵 1/5
@eulerfinance
Euler Labs🛢️🇬🇧
9 months
1/ The first building block of Euler v2 is here. Introducing the Ethereum Vault Connector - a powerful primitive that enables anyone and everyone to build products and credit-based protocols. Let's dive into the details:
19
66
339
4
9
75
@alcueca
alcueca
8 months
We coded 15 different oracle adaptors for @yield , it's wasteful for each protocol to do the same. I'm thinking on drafting an oracle ERC or releasing an oracle aggregator (like ERC7399). Thoughts?
6
5
69
@alcueca
alcueca
4 years
For the last couple of months I've fuzzed all my smart contracts with echidna from @trailofbits . 🦔 I found critical bugs that escaped unit and integration testing. This an essential phase of smart contract development. Read how to fuzz below 👇
2
19
72
@alcueca
alcueca
1 year
The signal to noise ratio in @immunefi is dropping to zero lately. Today I had to explain someone that updating a contract in GitHub (meaning it now differs from the deployed contract) is not a vulnerability. Tiresome.
5
3
66
@alcueca
alcueca
10 months
A bunch of you suggested I check out @LiquityProtocol , after my recent articles on lending protocols and liquidations. I did, the documentation is excellent, and this is some of what I found 👇 1/10
Tweet media one
2
8
65
@alcueca
alcueca
3 years
For the last few months, I assisted my wife to preserve her identity while being pregnant, something that many women will relate to. I've immortalised that fight by naming a hashmasks in her honour. Read the story here 👇
9
12
60
@alcueca
alcueca
3 years
Your startup hires highschoolers. My startup hires 40 year old engineers with small children. We are not the same. Nah, not true. Of course we are the same. Same ridiculous energy everywhere. wagmi ❤️
1
1
60
@alcueca
alcueca
4 years
1/ It used to be that only @fifikobayashi would know how to do a flash loan from more than one provider. I've made it now so that any of you can have her same superpowers.
4
13
62
@alcueca
alcueca
11 months
I wrote a comprehensive article about liquidations in DeFi with @cal_nix . In it, we detail how different liquidation systems work. Whether you are a novice and you want to know more, or you are a veteran and want to fill in the gaps, there is something in it for all of you. 🧵
2
11
59
@alcueca
alcueca
2 years
@0xhashmi @gakonst @paradigm If I aim to build something, I do a deep dive into what others have done. I will reuse the parts that work fine, make others better, combine features from different sources, come up with some ideas of my own. That's how you build. I see nothing wrong in these screenshots.
1
1
60
@alcueca
alcueca
3 years
I started in the summer of 2018, completing the tutorial. It took me about a week. That was my first assignment as Blockchain Architect for now-defunct TechHQ.
1
1
59
@alcueca
alcueca
9 months
You are proud of adding 108,000 sloc. I'm proud of deleting 75 sloc. We are not the same.
@pvpdotmoney
pvp.money
9 months
98 Contracts. 1,266 Functions. 108,000 lines of solidity code. The largest smart contract network the auditors have ever seen. PvP Money. Coming Soon.
27
11
78
5
2
54
@alcueca
alcueca
3 years
@0xtuba You learned about your users, use cases, and product. You learned about your technology. You learned about go to market strategy. You release a v2 and fail better. You keep learning and building.
1
2
56
@alcueca
alcueca
4 years
Hello darkness, my old friend.
Tweet media one
5
2
55
@alcueca
alcueca
3 years
When people ask me how to become a smart contracts developer, I can't say that I knew what I was doing at the time. I just kept failing, and learning, and writing, and doing it all over again. I'm sure you can do the same. Now, go code something.
2
3
53
@alcueca
alcueca
3 years
@SurrealsNFT Just beautiful.
Tweet media one
3
6
48
@alcueca
alcueca
9 months
The EVC playground is out, and you can start building lending apps on top of it. I went through the examples in the repo and recommendations from the existing workshops to distill an easy-to-follow checklist. Read on, you nerds 👇
3
9
50
@alcueca
alcueca
2 years
For a long time, I've wanted to write an article about smart contract integration at @yield . Using multicall and balance tracking throughout our contracts allows us to integrate and scale very easily.
3
14
50
@alcueca
alcueca
1 year
We got our first @immunefi submission for a critical. The two weeks of downtime working to fix and restore were bad, but better than getting hacked to oblivion. A bug bounty is your last line of defense against bugs, don't underestimate its importance.
@yield
Yield Protocol
1 year
We are back online on Arbitrum! The reported vulnerability has been fixed by replacing the affected contracts and migrating the funds. A post-mortem for the bug can be found in the medium article below.
15
246
49
4
8
42
@alcueca
alcueca
1 year
Securing a blockchain protocol is more than having unit tests and getting an audit. The threats are many, and many are the defensive measures. Read below to learn how I classify threats and how I make sure that @yield is fully protected.
4
8
40
@alcueca
alcueca
2 years
She's a 10 + 10i, and my parents keep asking when are they going to meet her.
9
0
46
@alcueca
alcueca
1 year
PSA to wardens on @code4rena If your report says that a vulnerability "may lead to" an undesirable situation, that's hypothetical and therefore a QA. Show me the actual impact, and then it is Medium or High.
5
2
43
@alcueca
alcueca
2 years
1/ You can easily convert your foundry unit tests into a test harness for live contracts. In this video I explain how to do it with @sabnock01 .
5
12
44
@alcueca
alcueca
11 months
For every 10 likes, I'll ask chatGPT to make this offer even more suspicious.
0
0
42
@alcueca
alcueca
9 months
The EVC is rad. I gave @eulerfinance a hand to make it tighter and cleaner, but I take no credit for any of the features packed within. Check the repo, there is plenty to learn from it.
@eulerfinance
Euler Labs🛢️🇬🇧
9 months
1/ The first building block of Euler v2 is here. Introducing the Ethereum Vault Connector - a powerful primitive that enables anyone and everyone to build products and credit-based protocols. Let's dive into the details:
19
66
339
1
3
39
@alcueca
alcueca
1 year
Everyone is having a laugh at the SG Euro stablecoin, as if the developer didn't know any better. I've worked in a bank. The guy had to implement what seven different stakeholders with veto power and their own agendas and egos told him to do. He probably cried at the result.
@pashovkrum
pashov
1 year
That French bank's EURO stablecoin has some issues people already tweeted about, they should have reached out for a solo smart contract security audit I think
Tweet media one
19
13
140
1
0
43
@alcueca
alcueca
3 years
@gakonst A baby, among other things
Tweet media one
1
0
41
@alcueca
alcueca
2 years
I never heard of @superformxyz before, but this is what we had in mind when we wrote ERC4626. Feels good man.
@superformxyz
Superform Labs 👽
2 years
Introducing Superform: The Universal Yield Marketplace
28
247
624
7
3
41
@alcueca
alcueca
1 year
We got requests to make 4626 compatible with non atomic deposits and withdrawals, but declined due to the complexity. This draft eip by @centrifuge solves the issue very convincingly.
@centrifuge
Centrifuge
1 year
1/ We're excited to share EIP-7540, an extension of ERC-4626, written to make onchain lending more flexible across different use cases. Read the proposal and provide feedback
5
49
205
0
3
36
@alcueca
alcueca
4 years
At @yield we are recruiting frontend, smart contracts and devops engineers. Please DM me if you would like to work in a small but well-funded startup, buidling the next #DeFi unicorn with the likes of @danrobinson , @gakonst and myself. All roles are fully remote. DM now!
4
12
39
@alcueca
alcueca
9 months
I collated my review of @LiquityProtocol as a long-form article. As one of the most forked codebases, and the #3 crypto-backed stablecoin by TVL, there is plenty to learn.
5
7
38
@alcueca
alcueca
2 years
Too often, those on a multisig have a really hard time reviewing what it is that they are signing. DAO voters don't fare much better. They should be able to know with detail the effects of a proposal, without help from others. Read now:
2
13
38
@alcueca
alcueca
11 months
Many of you might have heard the story of how I became known as a solidity developer and founder. I like to tell it, because it's who I am. It's about failing a lot, and using your failures to help other people along.
6
2
36
@alcueca
alcueca
2 years
I find it really interesting that at @yield we arrived at a very similar liquidations model as Euler, but from the complete opposite starting conditions. A thread 👇.
@eulerfinance
Euler Labs🛢️🇬🇧
2 years
1/21 If a protocol is liquidating a $100m borrow from Celsius or Alameda or whoever... The last thing it ought to do is give away $5-15m collateral to liquidators/validators. Yet this is exactly what happens on a lot of lending protocols today.
6
26
204
1
12
38
@alcueca
alcueca
3 years
time unfolds, today black lotus, at the junction measures, patiently @SurrealsNFT
Tweet media one
3
2
36
@alcueca
alcueca
4 years
WETH10 is an update on your favourite Ether wrapper and brings a bunch of new features: - Off-chain approvals using ERC2612. 👍 - transferAndCall, to avoid using approvals altogether. 🤝 - depositTo and withdrawFrom functions for reduced gas cost. 🤑 - Flash Minting ⚡️
1
5
33
@alcueca
alcueca
3 years
And that I don't know how to embed gifs properly on twitter really shows I'm not lying about being a boomer.
1
0
35
@alcueca
alcueca
1 year
🚨 Security Researchers: Please use AI in your bug reports and contest sumissions* 🚨 * to make your writing readable. 🧵
5
1
35
@alcueca
alcueca
8 months
For a while now I’ve been working on a project to make it easier to use flash loans. It started as ERC7399, and it is ready for you to use. If you are building a protocol that needs to take flash loans from many sources in many chains, go on reading. A
Tweet media one
Tweet media two
1
2
32
@alcueca
alcueca
11 months
Since I announced that I'm looking for advisory roles, I've got a few inquiries about how to build lending protocols. I studied the majors in my last article: MakerDAO, Yield, Compound, Aave and Euler. But I missed some, Liquity and Ajna at least, who else is worth studying?
10
0
33
@alcueca
alcueca
2 years
Working on something new 😎
Tweet media one
1
1
32
@alcueca
alcueca
3 years
@gakonst When I became senior enough to write the senior level tutorials, also became too busy to write them. I'd be very keen on writing a few with what we've learnt a @yield Oracles, CDPs, liquidations, staking, AMMs, routers...
0
0
32
@alcueca
alcueca
2 years
@jtriley_eth You can, but should you?
2
0
33
@alcueca
alcueca
1 year
I would like to send a special thank you to all the users that tried out @yield expecting an airdrop. You were our largest and more consistent user group, and helped iron out lots of bugs. Sorry we never got to release a token. For that we needed organic growth.
@notsofast
notsofast
1 year
@alcueca it seems that no matter what, people are going to farm and sybil anywhere they *might expect* an airdrop not your fault!
0
0
1
2
2
31
@alcueca
alcueca
4 years
As a smart contracts developer, the Week in Ethereum News is the best resource to get the signal between all the noise. 📣 Welcome back @evan_van_ness !
1
4
32
@alcueca
alcueca
3 years
ERC4626 is intended to ease the integration between yield producers and yield aggregators. Everyone should win. Please read the proposed spec, and give us your feedback. Let's make this work.
@joeysantoro_eth
Joey Santoro 💚🦇🔊
3 years
The ERC-4626 Tokenized Vault Standard is ready for final review 😎 Get your giga chad brains churning on how this standard will revolutionize DeFi 🧠 Be sure to share any proposed changes on the thread: Here is a summary of the proposed design 👇
5
30
147
0
4
29
@alcueca
alcueca
9 months
The Euler hack was very tough on @yield . Same as @eulerfinance , we didn't know if we would come out of it, but unlike them, we could do nothing. We could just wait. We understood the silence from their team, though. We knew they were trying their best. We waited, and considered
@euler_mab
Michael Bentley
9 months
2023 was a year full of twists and turns (to put it politely) for the Euler community. I can’t think of a better way to say goodbye to it than by telling the story of how it played out. I warn you now, It’s a lengthy story. So strap in. See my War and Peace blog post below. It
Tweet media one
14
37
272
0
1
30
@alcueca
alcueca
10 months
I hate liquidations, all my homies hate liquidations. Can we build a lending app without liquidations? Kind of. Let's check one out, @TimeswapLabs . 1/7
Tweet media one
6
3
31
@alcueca
alcueca
2 years
The @devtooligan journey in crypto should be an inspiration for all of us. In a year and a half he went from a TradFi career to nothing less than @trailofbits . A progression that reminds me of @transmissions11 , without the luxury of being able to code at recess.
@devtooligan
devtooligan (independent arc)
2 years
Exciting news! 😁 Today I start my journey as a Security Engineer with @TrailOfBits . I feel honored to join a team that I’ve long respected and admired. I'm thrilled to pursue my passion of making our ecosystem safer and more secure.
89
13
606
2
2
30
@alcueca
alcueca
4 years
As an inaugural transaction,  @r_ross_campbell refunded me the gas costs using the new `depositTo` feature. Send ether, and have it appear as WETH10 in someone else's address. History in the making.
Tweet media one
2
1
27
@alcueca
alcueca
3 years
@TheHashmasks 🤝GLICPIXXXVER002 h/t @BokkyPooBah
3
4
27
@alcueca
alcueca
1 year
@trufflesuite I started my journey in Ethereum using truffle, as so many others. Thank you for giving me that chance ❤️
0
0
30
@alcueca
alcueca
4 years
The real treasure is the friends we made along the way. Check the WETH10 repo for everyone that participated. @ross @dmihal @wighawag @moodysalem and  @k06a made outstanding contributions 🤗
5
2
28
@alcueca
alcueca
2 years
Congratulations to @devtooligan in shipping this monster of a feature. It took about nine months, included a migration to foundry, exotic math, and a whitehat hack. It's a story to tell.
@yield
Yield Protocol
2 years
YieldSpaceTV, our next generation AMM, is now live with December borrowing. This upgrade improves the capital efficiency of liquidity providers (LPs) by placing assets into money market protocols when they are not being used, improving returns! more 👇.
1
7
37
4
5
28
@alcueca
alcueca
3 years
Happy birthday @TheHashmasks 🎉
Tweet media one
0
1
28
@alcueca
alcueca
3 years
@gakonst Very inspirational, but not very realistic. In a startup you don't do what you are best at, you do what needs to be done. I'm best at cranking code, but I'm needed at building a team. Hence I must delegate what I'm best at, and do what no one else can.
1
0
28
@alcueca
alcueca
3 years
Does anyone have any experience here doing on-chain tests of governance changes? I remember USDC including tests in their v1 to v2 migration, so that the migration would revert if the tests fail, but I haven't seen anything else since. Are we breaking new ground here?
Tweet media one
11
3
27
@alcueca
alcueca
4 years
If you are building an application that needs to wrap Ether into an ERC20, please consider WETH10. With it you should be able to make transactions cheaper for your users.
4
1
27
@alcueca
alcueca
11 months
DeFi lending might look the same as five years ago. You post some collateral, you borrow some assets. @MakerDAO , @CompoundFinance and @Aave still dominate. That's true, and it's not. And what has changed and what has not is very interesting.
1
2
29
@alcueca
alcueca
1 year
Does anyone maintain a list of ERC3156 flash loan lenders? If not, let me know of the lenders that you know and I'll start a list here:
0
3
28
@alcueca
alcueca
1 year
I was a notorious hater of the diamond pattern. Too complex, I thought. Then I checked out @eulerfinance , and I saw the diamond pattern can be implemented in simple ways. @mudgen 's mistake, imho, was to make the pattern an EIP. There was no need to try to force a standard.
@makemake_kbo
makemake
1 year
If the diamond proxy pattern has a million haters I am one of them If the diamond proxy pattern has a thousand haters I am one of them If the diamond proxy pattern has no haters that means that I am no longer on this earth RT if youre a real diamond proxy hater
7
11
67
9
0
25
@alcueca
alcueca
4 years
1/ Have you ever wondered about how to build gas-less tokens? A thread, an article, a repo 👇
5
6
25
@alcueca
alcueca
4 years
Deploying a contract to mainnet now costs about $1 per line of code.
5
1
27
@alcueca
alcueca
3 years
For quite a while I thought that stETH stood for Saint ETH. 😇
@yield
Yield Protocol
3 years
STETH as collateral on @Yield V2 is coming soon 🔥🔥🔥 You will be able to borrow DAI / USDC at a fixed rate against staked interest bearing Eth @LidoFinance DAI / USDC can be swapped for more STETH, increasing your yield! 💸💸💸
1
3
27
3
3
25
@alcueca
alcueca
3 years
Slides from a recent talk to Gitcoin Kernel. At @yield we aim to get the most out of our audits, and this is the policy we have developed and follow. Follow people like @corpetty , @tinchoabbate , @joranhonig and @0xRajeev to learn more about how auditors do their job.
2
0
24
@alcueca
alcueca
4 years
I'm drafting a new standard to chain calls between smart contracts, aiming to supersede ERC667 and give ERC777 a run for its money. If anyone would like to help, please DM me.
Tweet media one
4
8
26
@alcueca
alcueca
1 year
If you are building a price oracle, read this article first. It's the reason ERC4626 got the convert functions. By building oracle APIs this way, you'll save yourself development effort and make less errors.
2
6
24
@alcueca
alcueca
4 years
At @yield , we are working hard to make fixed-rate products cheap and convenient. The YieldSpace v2 pools can do pretty cool stuff for a handful ✊ of GWei 💵 Stay tuned.
Tweet media one
0
5
25
@alcueca
alcueca
3 years
With @yield , you can already borrow 100K USDC at a 2.21% fixed rate, if you keep it for 6 months 🚀
Tweet media one
1
4
23