DAOUSDT
DAO Maker / Tether USD
cryptoComposite

Then you figured it out late. At the latest DAO fork should have already told you that code as never law. Or really, realizing how much ETH had been left to founders and investors, even earlier than that. It started as a plutocracy, just like Urbit.

> Honestly, if as a dev your contract depended on fixed values of gas to work, then you either did a poor job, or you assumed Ethereum to be an ossified chain when it clearly is not and wont be in the near future. This is how I'd write contracts now but for example I remember after the DAO hack when people were just learning about reentrancy it was considered best practice to use `transfer()` so you don't send enough gas to do anything move the ETH and write a log entry. Solidity devs put this call in the contract for that reason and we were recommended to use it. It's been deprecated a long time people are still using the contracts I deployed from that era. Also IIUC these changes do things that aren't just shuffling constants around, for example `gasleft()` will no longer tell you how much gas you've got left (since glamsterdam complexified it and splits it into multiple budgets). It's one thing to know that the gas price of a particular call might change but it's another to anticipate how the chain might rewrite the entire concept of gas from underneath you.

# Key Points Discussed * The ETC Grants DAO’s [**Code is Law creative challenge**](https://x.com/ETCGrantsDao/status/2111102365801787745) wrapped up, with winners picked by engagement and prizes from 5 ETC down to 2 ETC. Kevin is reusing some of the entries for u/eth_classic. * Kevin published his first [ethereumclassic.org](http://ethereumclassic.org) post, [**Run Your Own ETC Node, Part 1: Build core-geth from Source**](https://ethereumclassic.org/blog/2026-10-15-run-your-own-etc-node-part-1-build-core-geth-from-source), the first of a three-part beginner series. Diego explained why building from source guards against supply-chain attacks, and how the stable [Argos v1.12.23](https://github.com/etclabscore/core-geth/releases/tag/v1.12.23) release differs from `master`. * There is no new core-geth release yet. The unreleased v1.12.24-unstable on `master` is mostly a [Go toolchain update](https://github.com/etclabscore/core-geth/pull/702), with no consensus changes. A pool’s [`miner_getWorkFor` pull request](https://github.com/etclabscore/core-geth/pull/704), which lets one node hand out work for any coinbase, is under review. * Back from [TOKEN2049](https://classix.dev/reflections-on-token2049), Istora and Diego covered [Justin Drake’s “bunker mode”](https://x.com/drakefjustin/status/2107837081313505768) warning that AI-assisted mathematics could break ECDSA before Q-Day. Diego explained moving funds to fresh, never-signed addresses, and Istora urged holders not to panic and to migrate methodically. * Using the new BigQuery dataset, Istora shared [how much ETC sits behind exposed public keys](https://classix.dev/etc-key-exposure), with the DAO hacker’s 3.36 million ETC the most exposed balance. Because proof of work is hash-based, only ETC’s execution layer would need to migrate, which the group saw as a strong position compared with proof-of-stake chains, and hash-based signatures as the likely long-term path. * [ETC is back in Google BigQuery](https://classix.dev/etc-in-bigquery). Kevin uses it for network stats, which show activity and hashrate rising since an August low, and used it with [btcrecover](https://github.com/3rdIteration/btcrecover) to recover a seed phrase with missing words. * Alex of [ETCMC v2](https://www.etcmc.xyz/) joined his first call. He said he was approached to run the alternative client and refused, and called the [rogue core-geth release](https://classix.dev/260916-rogue-core-geth-release) a “heist”. Istora said no miners have adopted it. * There will be an [**Ethereum Classic meetup in Mumbai**](https://luma.com/flt0wvtq) on 2 November, after the [Ethereum Cypherpunk Congress](https://congress.web3privacy.info/) and before Devcon. * Kevin asked about TOKEN2049 takeaways: [preconfirmations](https://forum.zcashcommunity.com/t/private-preconfs-above-and-beyond-25s/57653) for instant merchant payments on proof of work, native rather than bridged stablecoins, talks with [Fireblocks](https://www.fireblocks.com/) about supporting ETC, and trustless ZK bridges. Teasers for next call: ETCHD, and something related to OpenTimestamps on ETC. **Join the community calls! These calls are integral to the project and the more people that join the better! We've changed the times to fit more people during the N.A. times. So please join!** 😃

Short answer: not really. With 4 of the 5 needed signatures sitting at one company, the actual security model was "trust Sky Mavis plus one extra key", and the leftover DAO allowlist quietly turned it into just "trust Sky Mavis". Counting validators tells you a lot less than counting independent organizations and how many of them would have to be compromised at once. It also wasn't a one-off. Harmony's Horizon bridge lost about $100M in June 2022 with a 2-of-5 multisig, and that one was pinned on Lazarus too. Same pattern: a small signer set, with keys on machines a phishing campaign can reach. Ronin's own fix afterwards was raising the threshold from 5 of 9 to 8 of 11, which helps, but the part of your write-up that stands out more is the monitoring 🔍 Six days without anyone noticing 173,600 ETH leave is worse than the multisig math. When I look at a bridge now I check three things: how many separate entities hold signing keys, whether large withdrawals have a delay or rate limit, and whether temporary permissions like that allowlist ever get reviewed after they're granted.