Tommaso De Ponti

2025

14/10/2025

User Space Interface Side Channel Attacks on TEEs: From Inferring Secrets To Censorship 📗

Also posted at https://x.com/heytdep/status/1978172938206802036. Last week I posted a thread on how [wiretap.fail](https://wiretap.fail/) works and how it affects web3 products that ar...

04/09/2025

TEEs <> Stellar Data Workflows: a PoC 📗

As promised in the last [writeup](https://heytdep.github.io/post/38/post.html), here are some updates on leveraging TEEs for complex blockchain data workflows, specifically on the Stella...

04/09/2025

TEEs for Trustless Complex Data Workflows For Blockchain Apps 📗

We're used to having two options when building complex data infrastructures for blockchain based apps: 1. Run the whole data flow, including blockchain clients, locally and have our use...

17/08/2025

Sandboxed Quote Generation, Leveraging Report Data and Dynamically Supporting Multiple Applications Within The Same TDX VM 📗

An interesting aspect of the new dstack research directions shared in San Francisco was the evolution of how the virtualization layout of trusted domains looks. If we are already virtua...

14/08/2025

Personal thoughts on Key Management Services <> Trusted Execution Environments and Exploring Possible Alternatives 📗

During SBC I had the plasure of seeing the Phala team's talk about Phala Cloud's current dstack implementation and what's in for the future; exciting stuff. Part of the current (and fut...

26/07/2025

Building Blocks For Tplus Consensus 📘

**How Tplus's First Releases Will Deal with Consensus** As any TEE-based technology that cares about security and safety at tplus we've been exploring different approaches to tackle bot...

How Do Leader Based Consensus Mechanisms Look Like on TEEs? 📘

...

06/06/2025

Diving into Leader Rotation Mechanisms for TEE Backed Clusters 📗

One common approach for applications that are based on TEEs is to gain performance by committing state through a single peer (leader peer), but relying on a fallback path in case the lea...

17/05/2025

[Draft] Imagining a Decentralized Cloud Computation Infrastructure: blockchains, TEEs and CR 📘

> Disclaimer: this post aims to start an open discussion by bringing in some sparse concepts. Won't introduct decentralized systems and why they're crucial, but right now there's one m...

03/04/2025

Understanding Helios and Exploring Light Clients' Affinity to TEEs 📗

Decentralized TEE-based applications that interface with blockchains need to plug in a trusted source of data for said blockchains. One approach is to run full nodes within a TEE, but an...

30/01/2025

[Draft] Designing a TEE App Resistant to Hacked Chips 📘

TEEs are awesome, but they can be compromised and in itself pose a challenge around availability that also greatly impacts security (NB: this last connection to security will be clearer ...

[Draft] Towards a More Modular Dstack Implementation 📘

...

27/02/2025

Running Helios Clients on GCP TDX TEE For Attestable Data 📗

Assuming the reader already knows what [Helios](https://github.com/a16z/helios) is, I explore how to run a Helios light client within a Trusted Execution Environment to attest over netwo...

22/02/2025

Understanding vTPM+TDX Attestation and Quoting Through the TSM ABI 📗

This article is aimed at anyone that wants to understand how the vTPM<>TDX combined attestation works. Additionally, I talk a bit about using the ABI exposed by the Trusted Security Modu...

30/01/2025

Stellar And MeV: Deep Dive into Optimal Tx Ordering, Censorhip, and Eclipse MeV copy 📗

In this article I expand a bit more about my new MeV + node behavior verification proposal by demistifying the PoW-based hashing attack vector for optimal ordering.
MeV has alwa...

2024

11/12/2024

The First Modular Confidential VM Network Implementation is Here 📗

I've recently been introduced to the world of trusted execution environments (TEEs), mainly around the topic of confidential virtual machines (CVM). Dstack is pretty much the only design...

06/11/2024

Guest Level Opt In Reentrancy On The Soroban Virtual Machine? 📗

TLDR I just opened a core PR to add opt-in reentrancy to Soroban. Calling all developers to discuss this! # Back Story and Proposal I kind of always gave for granted that Soroban would...

05/11/2024

One Step Closer To DeFi: New Horizons and Why I Started Adding Protocol Utilities In Zephyr copy 📗

Soroban needs to grow, let's accelerate that. # Preamble I think that anyone who is in the Soroban ecosystem right now notices that we're undergoing a stagnant situation. The tech is g...

04/11/2024

My Meridian 2024 Talks Recap 📗

TLDR this is the recap of my two Meridian talks. #Meridian2024 was actually the first Meridian I could attend, but the wait for meeting irl the folks I worked with for the last years wa...

15/10/2024

Meridian 2024 SVM Talk Technical References 📗

If you've made it to this post, it likely means that you are interested in the more technical aspect of my [Meridian 2024](https://meridian.stellar.org) talk about the soroban virtual ma...

19/08/2024

Proposing a Safe On Chain Actions Standard through Smart Wallets 📗

In a [recent post](https://blog.xycloo.com/blog/blend-bot-with-zephyr-and-smart-accounts), XyclooLabs showed a proof-of-concept for using smart accounts for on-chain actions deployed on ...

2023

22/09/2023

Going through Stellar Mainnet whole History with rs ingest copy 📗

For those who do not know it, I've been working on a rust crate that allows for custom ingestion from a stellar core captive process. The crate is [rs-ingest](https://github.com/xycloo/r...

2/10/2023

Update 1: Soroban Zig sdk 📗

I recently started learning Zig and as commitment to learning this language, which seems ergonomic and pretty close to Rust in terms of syntax, I started building a soroban SDK for it. ...

Jan 16, 2023

Testing the first working version of Soroban Analyzer 📗

Hey there! It's been a couple of months since I wrote here. But I'm back with an interesting hands-on article about using [Soroban Analyzer](https://github.com/xycloo/soroban-analyzer)...

2022

events()

Playing with Soroban events 📗

handle in the environment that allows us to publish events. In this post we'll explore how to publish events, why a contract would publish one, and how to read...

Rock paper scissors betting smart contract 📗

...

Soroban advanced auth on the CLI 📗

...

Now Also Markdown Here 📘

...

Soroban commit reveal hashing scheme 📗

...

Soroban Dutch Auction Smart Contract 📗

...

Soroban CLI basics: deployment and playing with invocations 📗

...

Soroban offices game smart contract 📗

...

Lottery smart contract with Soroban 📗

...

Vault smart contract with Soroban 📗

...

RustWASM: receive js (nested) arrays as parameters 📗

...

Personal notes on Elliptic curve pairings 📘

...

Zokrates+Rust+WASM: personal notes on verifying zokrates built proofs with rustwasm 📘

...

Rust: Groth16 Proof Verification From Scratch 📘

...

Rust: wasm with no std allocator 📗

...

How I built this blog 📗

...