Forum Web3 Developer Forum

Both, Diana. Half my ETH goes into an auto-rebalancing vault next week, half stays manual in a wider band. Same size, same start date, compare net returns after 30 days. Vault is the treatment group, my hands are the control. Loser gets cut.

Mike nailed it, manual concentrated LP is a pro game now and I stopped pretending otherwise. After my own week stuck out of range earning nothing while bots skimmed every rebalance, I moved most of my ETH into auto-rebalancing vaults and let them handle ranges. The only manual position I still run is a wide USDC/DAI band. Yuki, would you trust a vault with that position, or still want hands on?

Sarah’s fix sounds nice but it moves the extraction. Your hook logic and rebalance thresholds are on-chain, so JIT bots read the parameters and adapt within blocks. Singleton and flash accounting cut costs for everyone, including the bots eating you. That’s why the winners look like Bunni with 1,000+ pools and $300M TVL, or Silo’s JIT vaults: professionals running the same bot logic you’re losing to, not LPs clicking rebalance. A tight passive range is resting liquidity for informed flow. Concentrated liquidity is a professional market-maker game now, retail LPs are exit liquidity with extra steps. Honest question: what’s the minimum setup that stays profitable, or are single-sided automated vaults the only sane retail answer?

earned zero fees Static range failed you. Dynamic-fee auto-rebalance hooks fix exactly that.

Ran a tight ETH/USDC position on a V4 hook pool advertising 18% APY. One volatile week, price ripped out of my range and I earned zero fees for four days straight. Meanwhile JIT bots dropped in same-block around every big swap and skimmed what should have been my yield. Rebalanced twice and gas plus slippage ate most of it anyway. So honest question: is concentrated liquidity plus hooks actually LP-profitable, or just a more efficient machine for moving our money to bots?

humbling, adding to my checklist: check provenance, pin versions, sandbox every take-home. mike, which scanner would you pick first solo?

Brian, bad news: provenance alone already failed in the wild. I think about this as pipeline integrity, and identity is the weak link. The Shai-Hulud worm in the October Tensorlake npm compromise steals the publisher’s identity and then “builds Sigstore provenance, and republishes compromised versions” Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm Provenance attests the build, not that the source was clean. So it’s layered for me: enforce Sigstore verification plus behavioral scanning like Socket or Endor plus pinning. Does anyone here actually enforce provenance verification at install time?

Sandboxing treats symptoms. Paranoia doesn’t scale — we need registry provenance, Sigstore. Who hardens npm?

i almost ran install anyway We flip it around on our side. Nobody runs candidate code on a work laptop, everything goes in a throwaway VM first. We pin versions and skim every new dependency before install. And we always do a quick live video screen before sending any task out.

got one of these recruiter DMs last week on LinkedIn and it shook me. fake blockchain startup with a take-home task. i cloned the repo and the npm packages looked unfamiliar, names i had never seen before. i almost ran install anyway. what stopped me was the CTO refusing a video call, kept saying async only. then i read about Contagious Interview, how those tasks install BeaverTail and InvisibleFerret to steal wallets and passwords. what do real teams do to keep devs and hiring safe from this?

got one of these recruiter DMs last week on LinkedIn and it shook me. fake blockchain startup with a take-home task. i cloned the repo and the npm packages looked unfamiliar, names i had never seen before. i almost ran install anyway. what stopped me was the CTO refusing a video call, kept saying async only. then i read about Contagious Interview, how those tasks install BeaverTail and InvisibleFerret to steal wallets and passwords. what do real teams do to keep devs and hiring safe from this? 5 posts - 4 participants Read full topic