The Beacon是由Treasure_DAO孵化的F2P动作类RPG游戏，游戏刚进入Settlement Launch，美术风格很漂亮。Treasure_DAO做了Arb上第一个nft交易市场-trove，但只针对其生态内的NFT，代币为$MAGIC。

Guide

注册

由下面链接进入注册完成后，点击PLAY即可进入游戏，可以免费玩，也可以选择Founding Character mint一个人物，这样在游戏内获得的nft就可以转移到钱包并在市场内交易（只限Rare以上的物品）。

https://app.thebeacon.gg/signin?referralCode=SSRLQJ

两个每日任务

从屋里出来之后有两个选择，分别对应两个任务。上面的是刷怪，下面的是答题。

1.刷怪

进入这个大胡子上面的洞口就可以开始刷怪了，关卡有时间限制，如果打怪时间不够的话，可以选择无视骷髅头，speed run来通关（左键为轻击，右键可以蓄力，空格可以闪现一段距离）。

通关后有三个洞口可以exit，三个位置都有宝箱，任选一个洞口进入就行了（每天只能刷一次）。

2.答题

靠近这个白头发npc点击对话进入答题，每天的问题会变，第一天的答案是（lux)，回答正确后也可以获得宝箱。

交易NFT

通过Founding Character mint人物后，可以在游戏内收集NFT，Rare等级以上的NFT可以通过profile里的inventory来withdraw。然后进入红色marketplace来交易。

点击my item就可以看到withdraw出来的nft了。

Physics is one of the most fundamental disciplines in all science. Throughout my undergraduate learning, I have devoted a tremendous amount of time and resources to mastering knowledge in physics and achieving excellent academic performance even in subjects with a deep learning curve like Advanced Mathematics, Quantum Mechanics, and Solid State Physics. Meanwhile, during my undergraduate study, I was awarded multiple scholarships for my excellent performances in class as well as in my extracurricular activities, for example, under the guidance of my mentor in university, my team and I completed two Innovation and Entrepreneurship Projects, research into the hydrogen energy, which is one of the most significant researches in the field of physics and chemistry. I spent the first two years of my college accomplishing the Self-Supporting Nickel Cobalt Phosphide Electrode project and another two years on the project of HER&OER Bi-Function Selenide Stainless Steel/Pt Electrode. For an undergraduate student, scientific research could be overwhelming and time-consuming in many cases but it could also be extremely rewarding and transforming. Over the years, I have managed to balance my academic pursuit and my research without compromising my scientific research. My hard work eventually paid off when my research paper and my research results were accepted by the publisher and my intellectual properties (patents in my case) were registered and protected. In addition to my research endeavor, I was particularly interested in all sorts of competitions and contests, for example, the Mathematical Modeling Competitions held by my university, which I took part in with my classmate as a team and we won some prizes, and the Go Tournament organized by Suzhou Chess Club where I represented my university and won the third place when competing with players from other universities. These rewarding learning experiences and academic research have transformed me into a more resilient and strong individual that is ready to embark on a new journey and embrace new challenges.

Information Technology is a complementary field to physics and my growing passion and enthusiasm for blockchain have driven me to pursue more and go beyond my limit. Reading, researching, and investing in blockchains are not enough for me and I am eager to be part of the community behind the fascinating crypto world, an actual creator of the system. I am fully aware I need to acquire more knowledge about cryptography, cyber security, computing, and more. Even though I am lacking programming or coding skills, I formed a team with my friends who major in computer science, and we were going to take part in the hackathon sponsored by the Chinese biggest public chain - Conflux. Nowadays, blockchain-powered online games are booming around the world and we could take advantage of this growing market. Therefore, I have proposed to build a bridge tool, which will make transferring NFTs (non-fungible tokens) from chain A to chain B possible. Cross-chain NFTs mean cross-chain assets, which, in my opinion, will increase among different chains. The idea was bold, especially for an undergraduate student, but we tried, very hard, and we failed to submit our work before the deadline. Failures are the mother of success. What we have all together worked on in this project has proven to be valuable to all of us. Ever since that, I have dedicated my efforts to explore the world of cryptocurrency by applying to be a mod of masknetwork and supporting. Moreover, I participated in the translation project of whitepapers for some projects, which has deepened my understanding of blockchain including terms like Decentralized Automatic Organization (DAO), decentralized finance (Defi), Web3.0, Soulbound Tokens, and I tested quite a few decentralized application (Dapps) with brilliant notions. I absorbed knowledge very quickly and I am learning to prepare for an opportunity to study computing courses.

Finally, I am extremely grateful for the opportunities to learn more about quantitative trading and DeFi arbitrage. I will devote enormous efforts to the summer intern. With vigor and enthusiasm for blockchain, I believe I will be a valuable addition to Binance.

Seeing hackers exploited liquidity of ETH, BTC by manipulating liquidity of altcoins, we realized that we can replay this trick on Impermax Finance abandoned pool for learning and fun. However, it's harder to make collateral on Impermax than on other platforms and $IMX as a multi-chain token imposes risk of cross-chain arbitrage bots. However, our ignorance of a detail of Twap interval made us lose massive profits.

History

Liquidity manipulation has been leaving shadow on ethereum darkforest, which usually exploit lending protocol by flash loan. In many cases, hackers would play pump and dump game on some alt coins which have low liquidity. And take advantage of oracle, borrowing tokens with higher liquidity by using alt coin as collateral. This kind attack never ends, naming a few: Mango Markets, Venus Protocol, Cream Finance(multiple times). [1]

The core of price manipulation is Oracle, and SBF stressed the significance of it in Mango crisis. [2] According to $MNGO price on its own platform, hackers succeeded in draining the whole platform in 5min, which means the oracle of Mango Market is too sensitive and vulnerable to short-term volatility. However, most Cexs and dApps employed TWAP, EWMA and IMF Factors to prevent chaos caused by short-term liquidity manipulation.

Our Plan

Inspired by these ever-existing crises and combined with past experience during Ve War(Solidly by AC), me and my partner decided to replay this trick on $IMX of Impermax Finance. [3] I have to clarify there is an Intrinsic difference between our plan and past hack behavior that $IMX had been abandoned due to private key leak. Thus, it no longer has anything to do with Impermax Finance or its users, so whatever we did is free of legal risk. [4]

Due to the borrowing mechanism of Impermax Finance, it's much harder to manipulate the price of $IMX compared to Mango attack. Firstly, $IMX is a multi-chain token and yes, we can pump it on a single chain and drain another high liquidity token in pool, but some cross-chained bots would bridge $IMX from other chains with a cheaper price, dumping on our pump liquidity. So, we have to keep $IMX in a much higher price in all 6 chains(Ethereum, Polygon, Arbitrum, Avalanche, Moonriver and Fantom). Moreover, to borrow a token in Impermax Finance, we have to provide liquidity on dex and mint collateral with LP tokens instead of depositing single token as collateral. [5] Therefore, the higher we pull the price, the more profits we can grab, but of course this means bigger risks. The last problem is the old holder dump. Although $IMX is forgotten by most users, some holders still probably notice the instant pump and dump on our liquidity. We can only choose Saturday to implement our plan when most traders might enjoy their lives off-chain. Apart from that, we just pray for luck.

The key step is to let the oracle send pumped price to the pool of IMX/ETH, and we made an overconfident mistake on UniswapV2 TWAP mechanism. [6] Considering most protocols took 30min as interval, we assumed Impermax Finance was no exception. It turned out to be 60min interval. After 30min of pumping, we were unable to borrow $ETH from the lending pool. It was a torturous phase, since we have to take any potential risk of old holder dumping. If we don't, then the previous 30min pump is nonsense. Murphy's Law says "if it can go wrong, it will.” The dumps we had been worried about still happened during the second 30min. Dozens of dollars $IMX was not a big deal before the pump, but now they are worth hundreds of dollars and we have to take all of them. So in the end, all the profits made from liquidity manipulation go back to dumpers.

On-Chain Info

• 0x8a8f37ec4545b102d1766c608ceeda06a35296a67b7d020d92a368c5e5ada14f: At Oct-29-2022 06:38:35 PM +UTC, we started to pull the price with multiple transactions,making price raise from 0.0012 to 0.035.

• 0xe3aeaebce992a1ad5a48b9441ad4293c002ff749ebe40a29a9b6bbf1ed93a095: At Oct-29-2022 07:09:35 AM +UTC, we successfully borrowed eth out of the lending pool, but this amount is much less than we expected, which means UniswapV2 Oracle didn't feed the latest price to the pool. Then we were aware that IMX/ETH takes 60min as Twap interval.

• 0xc2c96e86835288be9150d791ee40747b4049513f75bd54a08c66c069df28cc2c: At Oct-29-2022 07:40:47 AM +UTC, IMX/ETH got the price updated and we drained the remaining eth.

• 0x783955d0ea656e5c13f596a8b4943f9a658474af00be5fc5462369e14c7eebda, 0x4b8c6fe566d474de28b187ebd2c41f4fa53df866a0f42410f31f29e4c35484ba: Between Oct-29-2022 06:52:40 and 07:43:06 AM +UTC, Polygon and Avalanche whales dumped their bags to our liquidity and we were trying to drain the pool from Arbitrum at that time.

• 0xde358d5eff7eea7a26b94dd687533422f4ebde02b48a8b016608c2cbcd3373af: At Oct-29-2022 08:35:59 PM +UTC, after draining all eth from multiple chains, we dumped $IMX collected from pumping. The game ended.

Summary

Many protocols are vulnerable to liquidity manipulation, and it's hard to locate the problem until the exploit actually happens. The most efficient way is probably using Twap with longer interval, which is also the lesson we learnt from the implementation. I wouldn't say our whole play is a failure although we didn't get the profits we expected. Draining IMX/ETH abandoned pools from multi-chains by liquidity manipulation is really an alpha move. Still, we need to pay more attention to protocol Twap rules and on-chain holder info in the future.

Reference

[1] REKT leaderboard, https://rekt.news/leaderboard/.

[2] SBF tweets, https://twitter.com/SBF_FTX/status/1580170215304089600.

[3] Andre Cronje medium, https://andrecronje.medium.com/solidly-feature-updates-and-launch- date-97be7e50e282.

[4] Impermax Finance statement, https://www.impermax.finance/post/imx-incident-post-mortem-and-recovery-plan.

[5] Impermax Finance lending mechanism, https://docs.impermax.finance/protocol/lending-pools-and-collateral.

[6] UniswapV2 Oracle explanation, https://docs.uniswap.org/protocol/V2/concepts/core-concepts/oracles.

A replay attack is a kind of man-in-the-middle attack (simple version) in which an attacker sniffs messages being sent on a channel to intercept them and resend them under the cloak of authentic messages. What makes the replay attack particularly harmful is that the attacker does not even need to decrypt the message they resend but can still fool the receiver into thinking that the received message is legitimate.

Replay Attack On Chain

Financial institutions are often targets of replay attacks because attackers use it to copy transactions and take money directly out of unsuspecting accounts. While In the blockchain, replay attacks have great potential for disruption. This is because blockchain ledgers often undergo protocol changes or upgrades. Also known as a hard fork, this occurs when an existing ledger is split into two parts, one using an older version of the software and the other using a newer version. Usually, a hard fork is done to upgrade the ledger. However, a hard fork can also be initiated to form a new cryptocurrency.

During such a hard fork, malicious entities will use replay attacks to infiltrate the blockchain ledger. Any transactions made by people with valid access prior to the hard fork will also be valid on the updated system. This means that transactions made during the hard fork bypass blockchain security by replicating the transaction and transferring the same number of units on the attacker's account. Signed transactions are then validated on the old legacy system and the upgraded version as the upgraded blockchain nodes are unable to identify which chain the compromised transaction is for.

A Simple Scenario

• You create a transaction that says “send 3 coins from my wallet to address Y.” You sign it, and you broadcast it to the BT2 network. The transaction circulates the BT2 network and is eventually confirmed, transferring 3 BT2 coins to address Y.

• But somewhere along the line, somebody out there sees your transaction data, copies it, and re-uploads it to the BT1 network. Since there is no replay protection, the transaction is valid on the BT1 network as well.

• The result is that not only are your 3 BT2 coins sent to address Y but so are your 3 BT1 coins! Except that those end up on address Y on the BT1 chain.

Potential replay attack on merge

One week before the merge event, Coinbase team member has proposed the potential replay attack and requested EthW team to make a change of chain id. It seemed that they intentionally to delay this change after the merge, which is extremely risky for users in mainnet. Although they did change the chain id before merge, but it’s really unprofessional to overlook this issue. That is probably why coinbase still did not list EthW and Binance only supports converting (selling). In conclusion, large scale replay attack chaos didn’t happen on chain, but some arbitrage strategies can implement on sepecific contracts by replaying transcation. Your funds on mainnet is SAFU.

Application On Merge

Replay attack implemented during merge is actually not the attack in chain scale, but targeted at sepecific protocol (Cross-chain bridge). As both EthW (10001) and EthFair (513100) have expoited different chain id from mainnet. However, some cross-bridge didn’t take notice of the forked contracts on EthW and EthFair chain (I personally think they really don’t care about this), and for assets (ether) crossed from mainnet to other evm chains, the original assets locked in the contract. So these contract got airdrop from EthW and EthFair as well, so getting these abandoned airdrops is attackers mutual goal. Top 2 victims are Omni Bridge and Polygon Bridge.

This attack is pretty simple to conduct, but the main point is owning large amount of ether. Every cross-chain operation consumed approximately 5$ (Ignoring the gas on EthW and EthFair), and the profit = $EthW + $EthF - 5$. Considering the price of EthW and EthF is currently 6$ and 0.7$ respectively, this is also the game for whales. Anyway, let’s try to excute the attack in detail (take polygon bridge and ethw as an example).

Steps

• Bridge eth from Evm-Chain to Ethereum;

• Record hex of mainnet claim (exit) transaction;

  https://etherscan.io/tx/0xd9c9615cc85dacf0b9a38a07d53595d70b4d113a87190b591ddaae0419b38794

• Replay the hex data on fork chain (use metamask or on back-end);

  https://www.oklink.com/en/ethw/tx/0x5f2f45bffe8933fceaa8d7e2f1055acd151a69bb236004e74c88b6c7ef8636ed

• Done, you should get extra EthW from bridge contract if there still have any left, lol.

Conclusion

Replay attack is an old friend of blockchain, this first happened in ETC fork in 2016, repeating in BCH and BSV fork in 2018 and mutated in EthW fork in 2022. Usually attack implemented on maninnet to manipulate assets on it, but this time replay made profits by duplicating transaction on fork chain. Anon, we gotta Live and Learn.

Monero和Tornado cash的局限 数据安全是永恒的话题，保护用户隐私是P2P公司最基本的责任。以去中心化为核心的区块链不乏有很多尝试，最著名的就是Monero，但由于其不支持智能合约，用户想获得隐私的保护需要将资金换成XMR再进行交易，这样的设计使得Monero始终无法得到大范围应用。而在盗币事件中频繁出现的Tornado cash，在dApp层级实现个人的财富转移和存储隐私，但随着NFT头像、社交账号绑定、mirror文章等的流行，使得doxing的发生更为频繁，Tornado cash这种程度的隐私保护远远不能满足大部分人的需求。

Oasis的分层解决方案 区块链主要分为网络、应用、共识这三层。出于不同的目的，各个公链针对这三层进行优化。市场呼唤针对应用层的加密方案，以满足各种金融环境下的隐私保护需求。现行的Oasis从共识层分离出ParaTime层负责执行交易，每个ParaTime可独立并行执行交易互不影响。其对于ParaTime提供了一种TEE（可信执行环境）的安全计算技术。TEE 充当在机密 ParaTime 中执行智能合约的假设黑匣子。加密数据与智能合约一起进入黑匣子，数据被解密，由智能合约处理，然后在发送出 TEE 之前进行加密。此过程确保数据保持机密，并且永远不会泄露给节点运营商或应用程序开发人员共识。但之前由于高APR和EVM compatible而吸引了大量关注的Emerald Mainnet并没有集成这项功能，即将推出的Sapphire将呈现EVM的TEE。 [Image]

Iron Fish的隐私保护 而Iron Fish从底层设计上就考虑到隐私保护，分别在这三层使用了不同的策略来协同保障链上用户隐私。Iron Fish 网络层支持带有 WebSockets 的 WebRTC，使所有用户无需其他设置要求即可轻松建立真正的 P2P 连接。Iron Fish节点首要目标是在未来的迭代中，使直接在浏览器中运行一个完整的节点变的可能。我们的关注点是降低进入门槛，让任何拥有计算机的人都可以加入Iron Fish的网络。

Networking 虽然其他一些网络层要求用户为其路由器设置端口转发以解决 NAT(Network Address Translation)问题，但我们在设计实现时侧重于可访问性，将WebRTC和WebSockets组合用于我们的传输层。他们使用大量技术来帮助节点建立直接通信。换句话说，Iron Fish节点实现开箱即用，无论是在 CLI 环境中，还是直接在浏览器中。这使得任何人都可以轻松使用 Iron Fish，无论技术能力如何。 当一个节点第一次启动时，它需要知道它可以连接到的至少一个其他节点（称为引导节点），它将把它介绍给网络中的更多对等点。与引导节点的初始连接通过 WebSocket 进行，所有后续对等连接都使用 WebRTC。本节将准确描述节点如何相互连接以形成支持 Iron Fish 协议的网络，从新节点如何启动开始。 新节点启动 当一个新节点启动时，会发生以下情况：

1. 新节点从提供的列表中随机选择一个引导节点，并打开到它的 WebSocket 连接。如果用户在此步骤中有想要连接的特定节点，他们可以使用配置文件或命令行来指定他们自己首选的引导节点。引导节点将其身份发送给新节点。

2. 引导节点向新节点广播对等列表。

3. 使用该列表，新节点决定连接到哪些对等方。

4. 与节点连接的每个新对等方重复第 3 步，直到建立最大连接数（最多 50 个）。

5. 为了最大化我们网络的强度并防止网络碎片化，节点将优先连接到相对较少的已知对等点当前连接的对等点。 这些操作对于搭建节点的用户来说是无感的，只需要启动节点，接着就会按照上述顺序自动连接到引导节点，然后快速连接到许多其他节点。 通信 消息是要在对等点之间共享的一条信息的商定格式。根据情况，有以下几种类型的消息和它们与节点交互的方式： 内部消息类型

• 身份：一个对等点可以向另一个对等点识别自己的消息

• 信号：用于在两个对等点之间发出实时通信 (RTC) 会话信号的消息

• Peer List：包含此节点当前连接的对等点列表的消息

• 无法满足请求：出现问题时的错误消息 路由方式类型

• Gossip protocol：这些消息到达网络中的每个节点。当一个节点收到一条Gossip消息时，它会验证该消息并将其转发给其他连接的节点。这用于将区块链的更改传播到网络中的所有节点。

• Fire and Forget：这些消息是指向一个特定的已连接的对等体（不可能向一个你没有连接的对等体发送消息），不期望从对等体得到响应或接收确认。当你不需要确保数据被正确接收时，这很有用。

• 直接 RPC：在这里，一个消息请求被发送到一个特定的连接对等体，并且系统期望一个响应。远程过程调用(RPC) 由两个部分组成：一个用于请求，一个用于响应。这用作 Global RPC 的支持层。

• 全局 RPC：这些消息不发送给特定的对等方。如果没有得到响应，或者响应无效，网络库将选择一个对等点来发送消息并与另一个对等点重试（最多指定的有限数量）。选择算法是随机的，并加权以偏爱已知更有可能响应已注册消息类型的对等方。 Gossip protocol举例 当一个新节点上线并与对等点连接时，对等点会传达其直接对等点的列表。 假设我们当前的网络由一个新的节点 A 组成，连接到节点 B 和 C。C 本身连接到节点 D 和 E。D 本身连接到 F 和 G。从视觉上看，这看起来像下图： [Image] 节点只知道他们的直接邻居，以及他们邻居的邻居。节点 A 将不知道 D 和 E 之外的节点。 节点 A 现在可以决定连接到一些对等点，并将存储每个节点对等点列表的副本。

Storage Iron Fish存储的数据主要分为两部分：notes和nullifiers。当nullifiers附加的note被使用后，nullifiers就会显示出来，两者数量上呈线性关系，所以被存在两个大小相同的默克尔树中。但两者加密所用的哈希函数不同，前者是Pedersen hash，后者是blake3。与交易无关的notes和nullifiers不会被接受，并成为链上的一部分。 note默克尔树的组成部分： This content is only supported in a Feishu Docs 交易示意 [Image] 为了确保隐私，花费描述在零知识证明（特别是zk-SNARK Groth16 Sapling）的帮助下使用了一个note，而不会透露使用了哪个note。输出描述同样创建了一个加密的note，同时存在一个零知识证明的验证，证明新创建的note是正确的。这些证明的流程设计取自 Sapling原始工具，这些工具又是使用bellman线路工具构建的。 存储实现原理 由于我们知道在浏览器中运行Iron Fish的完整实现，要比在NodeJS终端环境中运行它更具挑战性，所以我们首先关注的是这个问题。对于想要在浏览器中使用数据库的应用程序来说，最强大的数据库选择是IndexedDB。不幸的是，NodeJS并没有相应的IndexedDB实现，所以我们选择了LevelDB作为我们的NodeJS实现。 为了防止不得不为两个不同的数据库采用两种不同的存储实现，我们对Iron Fish的实现有一个基于LevelUp的数据存储和数据库访问的通用抽象层。这个抽象层处理了底层数据库的具体实现，并暴露了一个通用层，可以在浏览器和NodeJS环境中使用，提供了一个简单的数据存储无关的API。 [Image] 简单来说，存储层是其底层数据存储的一个API--它可以从模式中创建存储，并通过所有正常的键值存储操作（如GET、PUT、DEL和HAS）对它们进行操作。

Consensus 共识层负责Iron Fish网络的交易验证，它设定了节点接受传入区块的规则。这些规则隐含地迫使节点按照这些规则构建区块，否则该区块将不会被网络中的其他节点接受。 如果一个区块的header和body都是有效的，它就会被接受。在高层次上验证区块header，可以确认该区块背后有足够的工作量，具体方法是检查其哈希值是否低于目标值，以及节点是否通过正确地将该区块中的所有事务应用于两个全局数据结构（notes和nullifiers），并提供两个由此过程产生的Merkle根来执行正确的状态转换。类似地，验证区块主体来确认该区块中的所有交易都是有效的。 坚持PoW 铁鱼在对PoS和PoW的优缺点全面分析后，认为PoW系统整体上更安全，更容易理解攻击媒介，有更好的途径实现平等和公平的去中心化，虽然PoS往往带来更好的用户体验和更短的交易时间，但对于Layer-1新公链来说，仍然不是个好选择。 交易验证过程 Block Header Iron Fish区块块头包括以下几个部分：

• 序列

• 前一个块的哈希

• NoteCommitment

• nullifierCommitment

• 目标

• 时间戳

• 矿工费

• 随机性 验证时遵循以下规则：

1. 当前块头的序列必须比前一个块中的序列（例如区块数）多一个，并且前一个块必须是具有previousBlockHash的那个，且previousBlockHash必须对应于一个有效的现有块；

2. 当区块Body中的事务被应用于两个全局数据结构（Merkle Tree of Notes和Merkle Tree of Nullifiers）之后，这两个树的结果，即Merkle树根必须对应于区块头中的noteCommitment和nullifierCommitment；

3. 通过使用本区块的时间戳、前一区块的时间戳和前一区块的目标公式，来检查目标；

4. 当前区块的时间戳必须晚于前一个区块的时间戳，并有15秒的容忍度（这意味着对于一个进入的最新区块，其时间戳与当前区块被检查的时间相比，可以有15秒的偏差）。 Block Body 验证区块块体包括验证区块中的所有交易，这可以并行进行，因为每个交易应该是独立有效的。对于其中的每一笔交易，验证者必须做以下几项检查：

5. 根据Spend描述中的公共参数验证所有的零知识证明；

6. 根据输出描述中的公共参数验证所有的零知识证明；

7. 检查交易余额；

8. 检查Spend描述中的每个签名是否签署了交易哈希值；

9. 检查所有Spend交易中的根锚（rt）是否是验证者Merkle树上有效的前树根；

10. 检查花销描述中的nullifiers是否在过去被揭示过。

Iron Fish未来计划 Iron Fish的初始版本为任何人都可以可靠地、低门槛地进行的私人交易奠定了基础。接下来的更新迭代包括：

• 自定义资产

• 对于稳定币和多条Layer-2的功能性支持

• 对移动和网页端更丰富的支持

融资情况和其他信息 Iron Fish 由微软和 Airbnb 的前软件工程师 Elena Nadolinski 于 2018 年创立。 Iron Fish总融资27.7M（而Tornado Cash的market cap有39M），资方包括Sequoia、Arrington XRP、A16z等。 Iron Fish Token总量约为0.25B，初始供应量约4.2M。主网启动后第一年内，每个区块奖励20枚，随后每一年的区块奖励都将根据衰减函数递减。在主网启动前的激励测试网阶段，Iron Fish准备了总量42万枚的Token用于奖励用户。方式主要靠累计积分，积分可根据激励测试网挖矿、寻找 bug 或在 Github 中修改批注（Pull Request）等方式获得。每个获得积分的类别每周累计积分上限为 1000 分。同时，每开采一个区块累计100分，这意味着每周激励测试网挖矿获得积分上限为10个区块。

无独有偶，ethOS在2021年底就提出了建立一套基于以太坊网络的移动操作系统，已经进入了Beta阶段，现在支持Pixel3、Pixel3xl和Pixel5a这三个型号的手机。ethOS作为一个开源的非盈利项目极具Decentralized精神，他们相信一个去中心化的网络不会出现在一个中心化的操作系统中[2]。ethOS将开发出原生dApps、0%平台手续费、加密小部件、基于本地的Light Node、Crypto Native的支付方式和ENS的集成、去中心化聊天、手机拍摄照片可直接铸造为NFT…..

虽然还处于Beta阶段，很多功能不完善，但能以低成本体验到以Ethereum网络为基础的移动设备还是令人兴奋。下面是以Pixel3为例的使用教程及体验：

1.准备工作

进行刷机的设备需要升级到Android 12并确保boot loader处于unlock状态，这个网上教程很多就不展开了。然后对于Pixel3的话，只有欧版是可以解锁boot loader的，如果想体验请注意版本。解锁了boot loader的设备会有这样的提示：

2. 用ethOS的web installer进行刷机

浏览器进入web installer网站，点击start进入刷机模式的选择，如果是谷歌原生系统或者其他rom选择clean install，如果是旧版本的ethOS选择update。

接着按照提示，重启手机并按住“音量-“，直到出现红色警告或者绿色的安卓机器人 ，这就进入了boot loader模式，然后连接电脑点击connect进行下一步操作。

等待下载的过程中，手机会多次重启，确保数据线连接正常。当看到下面这个页面代表刷入ethOS成功！

3.上手体验ethOS

ethOS第一次启动设置完语言进入系统后，不像大部分系统一样出现desktop，而是metamask的页面，体现出ethOS对于crypto的重视。

ethOS 19.1系统默认安装了Firefox、MetaMask和LightNode，前两个大家都耳熟能详，重点讲一下最后一个。以太坊LightNode作为ethOS的内置功能，让人眼前一亮。为了辅助理解Local LightNode的作用，需要与FullNode和ArchiveNode类比：

• 全节点（Full Node）是拥有完整区块链帐本资料的节点，存储了Block Header和Body，具备独立验证的能力来确认交易的有效性。

• 轻节点（Light Node）仅储存了区块标头Block Header，没有储存Body。当需要验证交易时会向邻近的全节点发起相关信息请求以进行验证。

• 归档节点（Archive Node）即在全节点基础之上多储存了每个区块高度的状态（State）快照，供检索相关用途。

如图，轻节点在占用空间和同步时间上与其他两种相比都有明显优势[]。拥有一个Local LightNode意味着向去中心化更进一步，最直观的体验就是无需信任第三方rpc，如Infura、Alchemy、QuickNode等。本机MetaMask的交易可通过轻节点进行验证，在第三方节点宕机时仍能不受影响地进行交易。当然，第三方中心化rpc同时出现问题的概率很小，但作为一个Crypto natives，本着“Don’t trust, verify”的精神，也要建立一个轻节点以备不时之需。

Local LightNode的正常运行需要FullNode的帮助，FullNode在LightNode的App中被称为peers，下图的状态就代表本地LightNode已经找到一个FullNode来下载交易相关信息。

当本地LightNode找到peers时，就可以继续进行MetaMask的节点配置了。在MetaMask中添加网络，按照下图提示填入相关信息即可使用本地LightNode确认自己的交易。

4.存在问题

• 由于为LightNode提供帮助对于FullNode来讲并没有什么奖励，所以现在的本地LightNode很难找到peers来下载邻近全节点的信息。ethOS团队已经联系了Nimbus client，有望在未来解决这个问题。

• 当前ethOS的Web3入口高度依赖MetaMask，需要在MetaMask的App内完成相关交易，急需一个dApp store来安全地下载多种dApp以丰富使用体验。当然，dApp store的建立需要众多开发者的支持，团队在努力推广中。

• 相关配套App与谷歌原生Android系统还有较大差距，需要通过长期更新迭代来完善。

5.系统优势

• 首个较为完善的内置以太坊LightNode的操作系统，团队Roadmap明确，未来可期。

• ethOS属于轻量化系统，在耗电量优化方面做的不错，续航有优势。

• 团队已经开发出OTA升级，后续无需连接电脑刷入新版本ethOS，直接在设置内更新即可。

ethOS相关信息

Website：ethereumphone.org

Whitepaper：https://uploads-ssl.webflow.com/629fb11c1f7b33984fa82350/62c3645d62a39f7693e2c93f_whitepaper.pdf

Twitter： https://twitter.com/EthereumPhone

Discord：https://discord.gg/FtVvK7B2KT

Reference

[1] https://github.com/solana-mobile/solana-mobile-stack-sdk

[2] https://www.ethereumphone.org/

[3] https://www.tuoluo.cn/article/detail-48998.html

[4] https://ethereumphone.notion.site/Use-Your-ethOS-Light-Node-with-Your-Metamask-Wallet-9c117dfbc0d2472cb9e1a2cdbc8fab9e

由于移动设备系统层级的Web 3相关资料比较少，很多产品都处于beta阶段，所以可供本篇研究报告参考的内容不多，如果有描述不准确或错误的地方，还望大家予以批评指导。

It’s a patent about a

preparation method of high-efficiency water electrolysis stainless steel/Pt single-atom bifunctional composite electrode.

Not released yet, maybe in 2023,who knows and who cares?

Just write down this short note as a boring reminder.

Not probably nothing, it’s literarily nothing.

To be continue……