Bitarray @bitarraydev

Happy to learn that the misleading #Polkadot Nakamoto Coefficient number is already removed from nakaflow.io

Wei Tang @sorpaas

4 months ago

How centralized is Polkadot? We found an address cluster, with master proxy "12iz6aJ", which controls 92-105 validators since at least Dec 2025. This brings the Nakamoto Coefficient of Polkadot to just 4. At this point, it is no more than a fancy Web2 database.

13 15 56 26K 7

We've spent the last two months building a new harness, and the core is finally close to complete. Can't wait to share with you more. Wouldn't it be great if the agent can modify its own harness environment live to make the space more comfortable for itself?

Rust packages, reimagined. github.com/pkgre/rust/

In light of the recent `arrayref` incident in Rust, it's probably a good idea to try to think about dependency security differently. And honestly, we kind of already have everything we need: custom registry. users.rust-lang.org/t/towards-bett…

You can now follow the design progress of @alley_os live! Announcing Palent Alley, an agent built on our private harness with an "autopilot loop". Our goal is a decentralized, untrusted, multi-agent workflow, able to scale to large amount of agents operated by different, potentially unsafe operators. Implementation is cheap, so right now, we still focus on design and our agent harness loop. We believe the design of our products should dictate the underlying infrastructure, not the other way around. Soon you'll also be able to participate in the design process yourself. Stay tuned! matrix.to/#/#alley:matri…

Yo #Polkadot, how's your hard cap doing?

Wei Tang @sorpaas

7 months ago

The hard cap upgrade of #Polkadot is exactly as predicted. Price action through monetary change almost never works. The main thing is -- now what? A few years down the road if hard cap does nothing and Polkadot has security or treasury issues due to it, will they just revert?

10 3 20 13K 0

Yep, we reconstructed the full timeline. W3F did not check the technical details at all before voting. Think about it -- the entity holding practical majority in #Polkadot, didn't bother to check whether the execution would be valid.

Wei Tang @sorpaas

2 months ago

The funniest thing of the day in Polkadot: * Community was against the referendum. (14M+ Nay) * W3F/Parity, using its 120M+ stakes, voted Aye anyway. * Didn't review the technical details at all. And now the execution failed. If W3F/Parity vouches for their insiders like this

2 4 12 6K 1

It takes only 4 operators to collude together to take over Polkadot.

The funniest thing of the day in Polkadot: * Community was against the referendum. (14M+ Nay) * W3F/Parity, using its 120M+ stakes, voted Aye anyway. * Didn't review the technical details at all. And now the execution failed. If W3F/Parity vouches for their insiders like this without checking, are their other votes safe? Are they even going to find out if someone "trusted" sneaks in stuff?

SO/DA zone @SO_DA_zone

2 months ago

Execution of @Polkadot Moderation Bounty top-up has failed

3 1 6 3K 0

Haha, are people still debating this? Nowadays you can even just give the identified addresses to any AI model of your choice, and it'll happily tell you why this is verified beyond doubt. Yes, I can tell you with certainty that Polkadot is a centralized network. I would coin this term Bagholder Distillation -- a cryptocurrency community's intelligence correlates negatively to how far the price has fallen from its pick.

Wei Tang @sorpaas

4 months ago

How centralized is Polkadot? We found an address cluster, with master proxy "12iz6aJ", which controls 92-105 validators since at least Dec 2025. This brings the Nakamoto Coefficient of Polkadot to just 4. At this point, it is no more than a fancy Web2 database.

13 15 56 26K 7

We managed to fetch the now private Bifrost codebase and analyze the exploit. It's amazing how simple it is. Loss on AssetHub is roughly comparable to the Hyperbridge hack. Same meta-lesson. That makes it twice within four months on Polkadot.

Now stated by Parity engineers in clear text. $JAMKB will live. $DOT will die.

Wei Tang @sorpaas

4 months ago

A interesting thing about $JAMKB is: if you know the architecture of Polkadot JAM and how everything is defined in Gray Paper, you'll understand why this is alerting and potentially damaging for $DOT. §4.6 defines "a token which is native to the system". One token. That token is

19 5 50 24K 8

Polkadot PVM is a good initial exploration work that proved building a fast single-pass recompiler is possible. But it's outdated, as we've found out: * You can be equally fast with standard RISC-V. PVM is unnecessary. * You even get 20% code size reduction switching from PVM to standard RISC-V, due to one of PVM's questionable design decisions. Standard RISC-V is all you need. There are no benefits of the custom PVM ISA at all. An widely accepted industry standard vs an ISA developed by an obscure team. Currently, our standard RISC-V recompiler ("Nub") is even faster (1.5x-2x), simply because of PolkaVM's unoptimized implementation.

Wei Tang @sorpaas

5 months ago

You don't need #Polkadot PVM. RISC-V is all you need.

3 8 34 4K 4

The direction of #Polkadot is not limited to JAM. JAR Chain, built on @alley_os, is an alternative direction. 1.5x-2x faster, more decentralized, more secure with its capability-based design. If DOTDAO wants, it can adopt this alternative direction. A fair way to conduct this is a carbon vote excluding only W3F addresses. No $JAMKB complications. No token launch. No extracting the community with treasury spending or fellowship salary.

Wei Tang @sorpaas

4 months ago

JAR Chain is a community fork of #Polkadot JAM. Our goal is a protocol that is 2x faster, more secure, and more flexible than even the end-form JAM. And of course, we didn't like the delays! 😉 Check out the comparison table between JAR Chain and JAM Chain.

6 14 59 16K 5

If you are frustrated with Polkadot JAM, we welcome you to the bright side: matrix.to/#/#alley:matri…

Wei Tang @sorpaas

6 months ago

The situation of JAM is so messed up, to the point that it feels funny. I mean, I never understood why anyone would participate in the first place. A long long risky time (already two years) for just $500k in total. Still, you have to respect their work, but not treating them

5 1 33 6K 4

Alley now has a Telegram group! t.me/alleyos

Newest benchmarks for @alley_os RISC-V engine "Nub". Standard RISC-V is all you need.

Wei Tang @sorpaas

3 months ago

We received some interests (actually from JAM implementers) that they want to consider replacing Polkadot's custom PVM instruction set with standard RISC-V. Our recommendations are currently still that you should consider writing a new one! There are a few recompiler codegen

2 5 15 3K 1

We received some interests (actually from JAM implementers) that they want to consider replacing Polkadot's custom PVM instruction set with standard RISC-V. Our recommendations are currently still that you should consider writing a new one! There are a few recompiler codegen things, of which, as soon as you take note, you'll easily go faster than PolkaVM. On the other hand, the 20% blob size reduction is something you don't need to do anything about and always get for free. While we're at it, we're also extracting the RISC-V execution engine in @alley_os to a standalone project called Nub. Still a lot of work to do, but you can take a look if you want to learn more about how we accomplished 2x performance compared with PolkaVM! github.com/alleyos/nub

As of July 2026, PolkaVM doesn't publish any security advisories. PolkaVM author claims it to be "unfinished" and "do not use in production", but advertises it as live in Polkadot Hub. This sometimes gives third-party teams a false sense of safety. Curious about what security advisories should have been there? We maintain an up-to-date list here: github.com/bitarray/secur…

No decentralization. No privacy. The governments only need to seize a single entity (and its affiliated orgs) to break #Polkadot. The capturing is what breaks the narrative from the reality. And it only takes a single threat of jail time before W3F/Parity pushes for an OpenGov proposal to deanonymize the most vulnerable populations on their platform. x.com/sorpaas/status…

Wei Tang @sorpaas

4 months ago

How centralized is Polkadot? We found an address cluster, with master proxy "12iz6aJ", which controls 92-105 validators since at least Dec 2025. This brings the Nakamoto Coefficient of Polkadot to just 4. At this point, it is no more than a fancy Web2 database.

13 15 56 26K 7