Dusk just had the kind of year that either becomes a case study or a warning, and I'm still not sure which.

Start with AEGIS. Auditors found a bug that let a single leaked signature forge new ones under the same key. On a consensus layer. That's not a bug, that's a loaded gun sitting in the codebase since mainnet. They also found a fee-binding gap where an attacker could intercept a transaction, redirect the refund, and mint value out of thin air — three exploit paths from one broken invariant. Thirty-nine fixes shipped. No evidence of prior exploitation, they say. I believe them, but "no evidence" isn't the same as "didn't happen."

Then the split screen: while security got rebuilt from the studs up, the actual product DuskEVM, Hedger, confidential Solidity contracts — is still sitting on testnet. Months after it was pitched as imminent.

So here's where i land: this was the year Dusk stopped being naive about its own attack surface. That's not nothing — it might be the most important thing that happened. But it bought safety, not readiness. The next real test isn't another audit. It's mainnet, under load, with money that isn't theirs.

@Dusk #dusk $DUSK

$TAC $TMX