An outside review found a way to drain the wallet of anyone using my AI trading tool. My test suite, at 100% coverage, never saw it.
Here's the bug, the fix, and the check I think every MCP server that holds a key should run. 🧵
- Sent USDC to the wrong address at 2am? Paste it. Nansen's labels say what that address IS — Binance deposit, your own wallet, a stranger, a burn/contract — and draft the ticket. One paste, one verdict, one copy button. Built for @nansen_ai Meridian · github.com/edycutjong/sen…00:00
- You got paid in a token you didn't want. Glidepath turns it into a dated sell calendar sized to ORGANIC demand — buyers who aren't Smart Money, funds, whales or exchanges (@nansen_ai labels) — and flags the days the pros are dumping. Plans, never trades. github.com/edycutjong/gli…00:00
- @CoinMarketCap's #1 Uniswap v2 pair on Ethereum: 66.2% of its volume was 3 wallets buying back what they just sold, in the same tx. 29 times in 3.6 h. Take the legs out: a real fill pays 15.5 bps, not 55. Keyless. #BuildwithCMC dorahacks.io/buidl/49021 youtu.be/BwikjIf19hQ
- "LP removed $21.3M" fired on UNI/WBTC. 2 min 12 s later the same wallet put 99.8% of it into UNI/WETH — one pool over. An agent that follows the wallet before you panic. Keyless on @CoinMarketCap's DEX API ↪ #BuildwithCMC dorahacks.io/buidl/49020 youtu.be/ED5h27Xi2V0
