Jun 14 | OLIVER @oliver31873217 F1 Live Highlights🎬 While the World Cup is in full swing, the F1 season is also entering a key stage in Europe. In this session, OLIVER broke down the championship picture through points gaps and the remaining calendar. Mercedes lead clearly in the Constructors’ race, while the Drivers’ title remains open. OLIVER has been involved in F1 content for years. His live streams are not just about following the race lap by lap, but about understanding team form and the championship storyline clearly. OLIVER will continue covering the F1 European Leg on BillionLive. #Billionlive# Beyond streaming 6月14日 OLIVER @oliver31873217 F1 直播切片来了🎬 世界杯正如火如荼，F1 赛场也进入欧洲赛季的关键阶段。 本期直播中，OLIVER 从积分差距和剩余赛程出发，分析了本赛季冠军格局。梅赛德斯在车队冠军上优势明显，车手冠军则仍有悬念。 OLIVER 长期深耕 F1 内容，看他的直播，不只是跟着比赛跑完一圈，而是能更清楚地理解车队状态和冠军线索。接下来的 F1 欧洲赛季，OLIVER 将继续在 BillionLive 陪大家关注完整赛季。 看直播，玩预测，就来 #Billionlive#

🚨SlowMist TI Alert🚨 💸 Loss: 140,180 USDT (140,180,175,562 tokens) 🔍 Root Cause: Missing access control in addUsers (0x4777ff62) function of PayrollDistribution. Anyone can register users for existing drop and set arbitrary totalAmount. 📌 Attacker: 0x90b147592191388e955401af43842e19faa87ee2 📌 Victim: 0xa184af4b1c01815a4b57422a3419e4fb78a96ee4 📌 Vulnerable Contract: 0xef2c77f3b9b8aaa067239bc6b4588bae26433494 Attacker registered exploit contract via addUsers in constructor, flash loaned USDT deposit, claimed oversized payroll from drop #3#. Powered by #SlowMist#.AI

# Practical and Useful Patterns with ADK Long-running tasks failing midway and restarting from scratch? That's a thing of the past! 💪 ADK's Resume Agents feature enables checkpoint-based resumption from the exact point of interruption. It supports HITL approval-pending flows too, dramatically improving agent reliability. ## 📌 Title Resume Agents — Checkpoint-Based Workflow Resumption ## 🔗 URL ## 🧩 Overview Resume Agents allows interrupted ADK workflows to continue from where they stopped rather than restarting entirely. The feature uses event logging and state preservation to track progress, enabling skipping of successful steps and seamless resumption of HITL (Human-in-the-Loop) approval-pending flows. ## 🛠 How to Use Enable resumability through `ResumabilityConfig`: Import `App` from `google.adk` and `ResumabilityConfig` from `google.adk.runtime`. Pass `resumability_config=ResumabilityConfig(is_resumable=True)` to the `App` constructor to enable checkpoint-based resumption. Also provide the `name` for the application and the `root_agent` instance. Resume by specifying the same `invocation_id`: To resume, call ` with the same `invocation_id` used during the original execution. ## 🏗 Practical Usage - **Sequential Agent**: Automatically identifies the next sub-agent to run on resume - **Loop Agent**: Continues from the last completed iteration - **Parallel Agent**: Re-executes only incomplete sub-agents - **HITL Approval Flow**: Workflows paused for human approval automatically resume after approval is granted - Custom agents extend `BaseAgentState` with checkpoints after each workflow step ## 💡 Use Cases - Recovery from failures in multi-hour data processing pipelines - Expense approval or contract review workflows requiring human sign-off - Continuing partially successful multi-step API integrations - Minimizing downtime during agent failures in production ## ⚠️ Caveats - Tools execute **at least once** and may run multiple times during resumption — ensure idempotency - Modifying workflow definitions between interruption and resume is not supported - Web UI and CLI resumption are not currently supported ## ✨ Resilient agents are a must for production workloads. Leverage Resume Agents to build workflows that gracefully survive failures! 🚀 #ADK# #AIAgent#

Atomic Machines CEO @jeffholden reveals his vision for a future where humanity could travel to another planet and build an entire civilization using just one machine: "Our mission is on-demand universal command of matter. Given a digital input, you can construct any stable configuration of atoms that quantum mechanics allows." "That's when we've cracked the code completely. That's when you can fly to another planet, and you can build civilization with one machine." "We have a very ambitious mission. The only thing more ambitious is Constructor Theory by David Deutsch."

🧵 Longbow (Robinhood Chain) — spot-oracle exploit, technical post-mortem + still-open advisory 1/ 🚨 Security advisory for @longbowlend The NOTHING market on Longbow was drained via spot-oracle price manipulation. The root cause is a design choice in the market's oracle — and as of Robinhood Chain block 55,530,002 it is still not fixed. Full on-chain breakdown 👇 #DeFiSecurity# 2/ The oracle. Market NOTHING (id 0x071fb8a9…f4b0be) is priced by 0x0F932e0fE68B0219820ffcB4C2B1906E29BedacC. Disassembling it: it reads a Uniswap v4 pool slot0 directly via extsload. No observe(), no TWAP. Longbow's own API labels its oracleType: "spot". 3/ Why that's fatal. Morpho Blue calls oracle.price() inside both borrow and liquidate. An instantaneous AMM spot price is movable within a single transaction, so the collateral valuation can be inflated and deflated atomically by the same caller. This is the textbook spot-oracle failure. 4/ The attack — tx 0x414b5b7c832b67dcd0c3f16907c8702ff794ce9dd0b749d0100e7549ba202d49 (a contract-creation whose constructor ran the whole thing atomically): ① pump the v4 pool ② supplyCollateral 20,599 NOTHING ③ borrow 24,691.89 USDG ④ dump NOTHING back into the pool 5/ ⑤ liquidate its own position, repaying only 914.45 USDG → Morpho returns all 20,599 NOTHING to the liquidator (= attacker) ⑥ sell the returned collateral ⑦ net 17,800.74 USDG to an EOA badDebtAssets written off: 23,777.45 USDG. 6/ Where the loss landed. The bad debt was socialized 100% onto the MonkeyHood / Partner VaultV2 0x19d55f7FE2d3962796F5825CbDae2dd493Be0986, which held 100% of that market's supply shares. The vault realized a ~95% write-down that has not recovered since. 7/ ⚠️ STILL OPEN — verified today at block 55,530,002: • oracle address unchanged (still the extsload/slot0 contract) • vault collateralToken cap still 50,000 USDG (not zeroed) • price() still live & manipulable • no remediation tx — only a 414 USDG adapter withdrawal since 8/ Fairness / scope: this is NOT a Morpho bug. @MorphoLabs markets are permissionless and behaving exactly as specified, and Morpho's own oracle guidance warns against raw AMM spot feeds. The vulnerable decision is Longbow's: a spot oracle wired to a live market with a non-zero cap. 9/ The rest of Longbow is not exposed to this vector — the other 54 markets use Uniswap V3 TWAP (e.g. PONS, backed by a deep pool w/ observationCardinality 20,000) or Chainlink feeds. NOTHING is the only market reading a raw spot price. But one open market is enough. 10/ Actionable asks for @longbowlend: 1️⃣ set the NOTHING collateralToken cap to 0 (stops new allocation immediately, no timelock) 2️⃣ retire/replace the oracle with a TWAP or Chainlink feed 3️⃣ audit every market's oracle bytecode for slot0/extsload vs observe()/latestRoundData 11/ cc curators & ecosystem for visibility: @SteakhouseFi @robinhoodcrypto @ponsdotfamily Read-only analysis, no funds touched, all reasoning reproduced on a mainnet fork. Reproducible IOCs above. #DeFi# #RobinhoodChain# #bow#

Why is GenFab building a factory that makes itself? @mattparlmer, founder and CEO of @genfabco: "We make manufacturing equipment that can make a lot of its own inputs, and we can use that manufacturing equipment to make increasingly sophisticated products." "The galaxy brain version of this is minimum viable von Neumann constructor. The more grounded version is: if a significant fraction of the final cost of a product is the depreciation of the capital equipment used to make it, then if you have drastically lower capital equipment costs than everybody else, you have an inherent advantage." "And if you can do that more and more, you have a compounding advantage."

# Practical and Useful Patterns with ADK ## 📚 Load Knowledge On-Demand with ADK Skills Stuffing all knowledge into your agent's instructions blows up token costs. ADK **Skills** let you load workflows and knowledge on-demand — only when relevant — saving tokens while extending capabilities! 🚀 ## 📌 Title Skills for Agents ## 🔗 URL ## 🧩 Overview A Skill is a self-contained unit of functionality that an ADK agent can use to perform a specific task. It packages instructions, references, assets, and scripts, loading them only when the agent needs them. Skills follow a 3-level architecture: - **L1 (Metadata)**: `SKILL.md` frontmatter enables skill discovery - **L2 (Instructions)**: Main instructions in the `SKILL.md` body - **L3 (Resources)**: Supporting materials in `references/`, `assets/`, `scripts/` By loading only when needed, Skills optimize context window usage and minimize token consumption. ## 🛠 How to Use **Directory structure:** ``` my_agent/ skills/ code_review/ SKILL.md # Required: metadata + instructions references/ CHECKLIST.md # Detailed review checklist assets/ template.json # Review output template scripts/ # Lint execution script ``` **Python integration:** Import `load_skill_from_dir` from `google.adk.skills` and `skill_toolset` from ` along with `pathlib`. Call `load_skill_from_dir()` with the path `pathlib.Path(__file__).parent / "skills" / "code_review"` to load the skill from its directory. Then create a `skill_toolset.SkillToolset(skills=[code_review_skill])` and pass it to the `Agent` constructor via the `tools` parameter. The agent is created with `model="gemini-flash-latest"` and `name="dev_assistant"`, gaining on-demand access to the skill through the toolset. ## 🏗 Practical Usage **Skills for a DevOps agent:** ``` skills/ code_review/ SKILL.md # "Code Review Checklist" references/ CHECKLIST.md # Detailed review criteria release/ SKILL.md # "Release Procedure" references/ PROCEDURE.md # Step-by-step release flow assets/ changelog.tmpl # CHANGELOG template incident/ SKILL.md # "Incident Response" references/ RUNBOOK.md # Incident response runbook scripts/ # Slack notification script ``` The agent loads `code_review` only when asked to review code, and `release` only when asked to deploy. No need to keep all skills loaded at all times, dramatically reducing token consumption. **Inline skills (TypeScript):** ```typescript const releaseSkill: Skill = { frontmatter: { name: 'release-procedure', description: 'Standard release procedure with checklist', }, instructions: "Follow the release checklist step by step...", resources: { references: { 'checklist.md': '1. Run tests\n2. Update version\n3. Create tag...', }, }, }; const skillTools = new SkillToolset([releaseSkill]); ``` ## 💡 Use Cases - 📋 **Code review checklists**: Load detailed review criteria only when reviews are requested - 🚀 **Release procedures**: Load step-by-step deployment guides and templates only at release time - 🔧 **Troubleshooting**: Load runbooks and notification scripts only during incidents - 📝 **Document authoring**: Load type-specific templates and guidelines per document type - 🎓 **Employee onboarding**: Load relevant knowledge base sections based on questions ## ⚠️ Caveats - Skills are experimental (Python v1.25.0+, TypeScript v0.6.1+, Go v1.2.0+) - `SKILL.md` is required; include `name` and `description` in frontmatter - Skill discovery accuracy depends on description quality — write clear descriptions - Large resource files impact token consumption; keep them minimal - Be mindful of script execution permissions and security ## ✨ Closing Skills implement "load knowledge only when needed" in an elegant way. Instead of cramming everything into instructions, modularize capabilities as Skills to keep token costs low while extending your agent's abilities infinitely. DevOps, customer support, education — the pattern applies everywhere! #ADK# #AIAgent#