News for hackers. Stuff that matters.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by mattwilsonn888 on Wednesday February 02, 2022 @09:26PM (#30187676)
This highlights an incentive issue and a paradigm issue in the blockchain space. There is a strong incentive to get new protocols up and running and even though users are technically responsible as they can audit the code, most users, of course, are not qualified to do so, and stand to make more from exploiting any vulnerabilities they find than they are pointing for them out.

The issue of paradigm is just how poorly suited EVM is as a smart contract language. It is too hard to manage the complexity of bytecode with memory managed on chain and in contract code. When small errors have huge consequences and there are no second chances, EVM is and should be pointed out to be one of the worst standards Ethereum has brought to crypto.

When it comes to high stakes programming and especially in a space where new programs are written quickly and often, its almost objectively obvious that functional styles with more guard rails is the better choice. Nothing running on chain needs an infinite loop or many other fancy features one typically expects from a programming language - restrictions and readability in smart contract code are more important to computational chains than seat-belts are to automobiles, but the network effect is slowing the space down.

Edit: Some people have pointed out this was an issue with Solana contracts, which run on Rust - so I was wrong to use this as an example for half of my point, but still believe the point stands. Even Rust IMO is not tied down enough for contract code, but the fact that it can happen on Rust which is loads better then EVM for bug catching I think proves the point a bit more if anything.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by narrator on Wednesday February 02, 2022 @09:53PM (#30187922)
I think the trippiest bit of cryptocurrency economics I have ever witnessed is how Ethereum and Ethereum Classic forked after the DAO hack and both chains were still worth considerable market caps. It blew my mind.

What matters is the order book. How many bid/asks are there on it. The contracts and debts outstanding in it. That's all there is. Everything else. Store of value. Whatever. Doesn't matter. Cryptocurrency is people persuading each other to do things in an organized fashion, believing there will be reciprocation at some later date.

I wish we had someone around who really understood currency at a deep level like F.A Hayek to write about crypto economics in a painfully cerebral careful way that avoids all handwaving. There is something very deep going on here that is entirely new or very old and never quite clearly elucidated.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by quickthrower2 on Wednesday February 02, 2022 @11:59PM (#30188897)
> persuading each other to do things in an organized fashion, believing there will be reciprocation at some later date.

Sounds like it has parallels to society in general. It is just that society with it’s deeds, titles, government issued promises to pay etc. has been around for a very long time, so has proven itself. But it is all based on faith.

For example borrow 1M tokens in exchange for a piece if paper that says you own some land, with confidence that you can earn more tokens (or get someone to rent the land for tokens) and that the legal system will give you continued access to that land and so on.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by dmoy on Thursday February 03, 2022 @12:16AM (#30188971)
Well - faith, taxes, guns, and a monopoly on legal violence.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by root_axis on Thursday February 03, 2022 @05:07AM (#30190689)
You can live on land or work land to create wealth. Trading crypto tokens does not create wealth, it's simply shifting around bits.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by mattwilsonn888 on Wednesday February 02, 2022 @10:39PM (#30188282)
Get rid of 'store of value,' 'decentralization,' 'smart contracts' and all that's left is a ledger. Its really not that complex or special - if that's what fascinates you then you can just as easily approach the topic from the examples of traditional credit or even the history of semi-arbitrary currencies.

If your implication is that the only thing backing crypto currencies is an expectation of reciprocation then you are mistaken. The qualities you want to hand waive away, and most importantly (though often trivialized), is the inability to roll back the chain which is a function of "consensus power." Consensus power simply quantifies the cost of rolling back x blocks. Bitcoin currently has the highest cost to roll back blocks and therefore the most assurance.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by RC_ITR on Wednesday February 02, 2022 @11:11PM (#30188553)
You’re saying things that are true but don’t really make sense.

The history of transactions has no importance to the value currency. A dollar that was stolen is just as valuable as any other because they are bearer bonds (like most currencies).

The whole Immutable thing is just translating the concept of a bearer bond to digital space, nothing to do with its intrinsic value.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by mattwilsonn888 on Thursday February 03, 2022 @12:18AM (#30188983)
What is "the value currency" supposed to mean?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by JumpCrisscross on Thursday February 03, 2022 @01:00AM (#30189208)
> What is "the value currency" supposed to mean?

People are willing to trade their labour and opportunity cost for entries on this ledger.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by nootropicat on Wednesday February 02, 2022 @11:31PM (#30188699)
>Bitcoin currently has the highest cost to roll back blocks and therefore the most assurance.

This is false. Ethereum has higher block rewards (in $) for over a year now. Bitcoin is the second biggest PoW network by mining expenditure.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by SmooL on Wednesday February 02, 2022 @11:42PM (#30188782)
The "cost to rollback blocks" is a cost in computational power (to run a 51% attack), _not_ the cost of the block rewards
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by jallen_dot_dev on Thursday February 03, 2022 @12:01AM (#30188909)
In theory a higher block reward will incentivize and allow for greater computational power to be thrown at it, thereby increasing the cost to attack it.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by nootropicat on Thursday February 03, 2022 @03:26AM (#30190052)
The only way to measure that is by looking at expense over longer timescales.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by tromp on Thursday February 03, 2022 @03:59AM (#30190297)
https://www.f2pool.com/coins shows Bitcoin on top in daily dollar issuance. Ethereum was on top a few months ago, but not for over a year.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by nootropicat on Thursday February 03, 2022 @09:19AM (#30192697)
That appears to not include fees.

https://bitinfocharts.com/

Ethereum ($38,451,803.7)

Bitcoin ($34,875,489.84)

Before EIP 1559 fees were much more important. Ethereum has higher rewards since about Q3 2020

edit: even worse, f2pool just multiplies the base reward (2 eth) - ignoring uncle rewards and fees, by the wrong number of blocks (based on 15 sec block time - it's actually 13.2s). Trash calculation.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by tromp on Thursday February 03, 2022 @10:25AM (#30193583)
Thanks for the correction. Is there a site providing historic graphs of daily miner revenue?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by yobbo on Thursday February 03, 2022 @07:44AM (#30191726)
> the only thing backing crypto currencies is an expectation

This is, however, true regardless. The value of cryptocurrencies are measured in USD, and it is expectations of this future valuation that backs up the current price.

The only way to make it more certain than expectations, would be by some sort of government decree.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by antocv on Thursday February 03, 2022 @03:49AM (#30190217)
"Bitcoin currently has the highest cost to roll back blocks and therefore the most assurance."

Bitcoin was rolled back at the cost of sending out emails several times.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by wnkrshm on Thursday February 03, 2022 @03:23AM (#30190033)
I was actually disgusted by the fork - it was a 'the emperor wears no clothes' moment: Instead of standing by the proposed system, the stakeholders instead chose to change the rules. This can happen again any time for whatever reason.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by antocv on Thursday February 03, 2022 @03:48AM (#30190204)
Happened to Bitcoin as well, the moment was the big block debate and UASF - the narrative from Bitcoin Core developers for years had been "miners hashrate 1 CPU 1 vote" (this is how they drove BitcoinNG out, the client by Andersen the person Satoshi left maintainership to). Then over a day decided to flip "well fuck the miners it is the users running node software which can activate a fork". No clothes.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by pjc50 on Thursday February 03, 2022 @04:50AM (#30190602)
> What matters is the order book. How many bid/asks are there on it. The contracts and debts outstanding in it

That's the central insight of https://en.wikipedia.org/wiki/Debt:_The_First_5000_Years . If you want a good picture of how money works, it's essential to look beyond the Austrians.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by RC_ITR on Wednesday February 02, 2022 @11:07PM (#30188534)
Is something new really going on here, or is this just standard asset speculation with the word “currency” incorrectly applied to it?

I mean, nearly nothing is priced in units of crypto and almost no GDP transactions pass through it…

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by atmb4u on Wednesday February 02, 2022 @10:20PM (#30188130)
Insightful comment. Do you have some books or resource recommendation to learn more on this topic?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by narrator on Wednesday February 02, 2022 @10:31PM (#30188224)
F.A Hayek wrote a book titled "The Denationalization of Money" in the 70s where he predicted that we'd have competing private currencies not tied to any government at some point. Reading Hayek is difficult because he writes in a very intellectually dense style with very long sentences that assume the reader is already familiar with a lot of technical jargon. Here's a more general introduction to some of his ideas on private currencies with footnotes pointing to the source material: https://mises.org/wire/will-cryptos-fulfill-hayeks-vision-pr...
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by throwawayForMe2 on Thursday February 03, 2022 @09:07AM (#30192542)
I was amazed that in the DAO hack everybody made money, even the victims! You ended up with coins on both chains, more value then you started with.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by ryan_lane on Thursday February 03, 2022 @07:23PM (#30201048)
The amount of ETH doubled immediately. That doesn't mean everyone made more money. It's more like a stock split.

It also shows that the number of tokens isn't limited. It can immediately be doubled with a fork, infinitely.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by xyst on Thursday February 03, 2022 @02:25AM (#30189700)
> What matters is the order book. How many bid/asks are there on it. The contracts and debts outstanding in it. That's all there is. Everything else. Store of value. Whatever. Doesn't matter. Cryptocurrency is people persuading each other to do things in an organized fashion, believing there will be reciprocation at some later date.

you just described options trading

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by danielvf on Wednesday February 02, 2022 @09:46PM (#30187846)
This was on the Solana side of a Solana to Ethereum bridge. The vulnerable code was written in rust, and living on the Solana side. Not an EVM issue or EVM code.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by seibelj on Wednesday February 02, 2022 @10:03PM (#30187992)
But Rust is memory safe! How can it ever have a bug? /s
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by secondaryacct on Wednesday February 02, 2022 @10:19PM (#30188123)
Did the cavemen finally rewind all of history to finally rediscover while we organized around justice, legislation and law enforcement or we're still waiting for a few more fortunes lost ?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by berberous on Wednesday February 02, 2022 @09:37PM (#30187768)
I think the exploit took place using Rust contracts on Solana.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by vkou on Wednesday February 02, 2022 @09:38PM (#30187775)
> most users, of course, are not qualified to do so, and stand to make more from exploiting any vulnerabilities they find than they are pointing for them out.

The incentives are even worse then that.

Participants who aren't active crooks are actively incentivized to not look for vulnerabilities, because the easiest way to make money in this space, but to sell to a bigger fool. The quality of the underlying 'investment' doesn't matter.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by danielvf on Wednesday February 02, 2022 @09:48PM (#30187872)
Crypto projects tend to be the best in the entire world about paying out bug bounties. The connection to dollars is really obvious. In the last three months there have million dollar plus bounties paid out.

Here's an article from today about a million dollar bounty paid out:

https://medium.com/immunefi/notional-double-counting-free-co...

Here's another whitehat save in the last two weeks of 480 million dollars:

https://media.dedaub.com/phantom-functions-and-the-billion-d...

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by riwsky on Wednesday February 02, 2022 @10:13PM (#30188066)
cue joke about cryptocurrencies being self-funding bug bounties
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by verdverm on Wednesday February 02, 2022 @09:56PM (#30187946)
Imagine how many other world problems we could have solved of cryptos were not a thing. No scams, rugpulls, or bounties.

All that money could have gone towards world hunger and climate change. Would that have been a better use of it for marginalized people?

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by PretzelPirate on Wednesday February 02, 2022 @10:32PM (#30188232)
Capital tends to get allocated where it can be the most product for its owner. The alternative to putting it into crypto would not have been to solve world hunger, climate change, or to create a more equitable world.

It’s like saying “think of all the ways we could have made the world better if people didn’t invest in Apple.”

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by creato on Thursday February 03, 2022 @12:51AM (#30189157)
It helps to realize the USD values of the amounts involved are mostly bullshit. Things like NFTs wouldn’t be worth a small fraction of what they supposedly are if people had to buy them with actual USD.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by astrange on Wednesday February 02, 2022 @11:04PM (#30188514)
Some things can't be solved with money. (Or rather, it would take infinite money to solve them in a given amount of time, but allow enough time and solving it is free.)
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by sokoloff on Thursday February 03, 2022 @05:08AM (#30190696)
Imagine how many people could be fed if people just stopped buying Starbucks… People have varied motivations but reward for self is a pretty common theme across them.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by tiborsaas on Thursday February 03, 2022 @03:34AM (#30190091)
What percentage you think that speculative wealth would be sitting in hedge funds if crypto was not a thing?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by can16358p on Thursday February 03, 2022 @02:28AM (#30189720)
Getting the corrupted governments and their money out of the equation (even if to only to some extent), solves more problems in the long run.

These days are the upfront prices we pay for a much bigger financial revolution that would be good for humanity in the long run.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by FireBeyond on Wednesday February 02, 2022 @10:00PM (#30187973)
All the energy saved...
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by 8note on Wednesday February 02, 2022 @11:24PM (#30188650)
were they actually paid in dollars, or some crypto that cant be exchanged into that many dollars?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by danielvf on Wednesday February 02, 2022 @11:30PM (#30188695)
Close enough to dollars, although one project did also give out a bonus of their own tokens on top of the promised reward.

Large projects tend to be pretty good about paying out as promised, and not in weird tokens.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by mattwilsonn888 on Wednesday February 02, 2022 @10:41PM (#30188298)
That's partially true in short term pump and dumps, but not for anything long term or with innovation. Investing in practical innovation and holding is still the easiest way to make money in crypto.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by vkou on Wednesday February 02, 2022 @10:46PM (#30188341)
Could you name five successful non-crypto products produced by this innovation? Could you name what sort of risk-adjusted returns they have produced?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by cuteboy19 on Thursday February 03, 2022 @12:28AM (#30189032)
Most crypto are pump and dumps, but there is also the bizarre practice of a community of bagholders continuing a project after it has already been dumped by the promoters
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by Hallucinaut on Thursday February 03, 2022 @05:28AM (#30190798)
Not altogether unprecedented though; the suicide cult Heaven's Gate had people stay around to maintain their website, etc. and apparently they still believe the Hale-Bopp comet was some portend of the end of times.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by nootropicat on Wednesday February 02, 2022 @11:28PM (#30188683)
Pretty much all recent bugs are logic errors which have nothing to do with the language. The actual bugs are often things like typos that use > instead of >=, lagging price oracles or using oracles that can be manipulated. You asserted that loops are 'insecure' but in reality dumb restrictions only force people to invent complex workarounds to obtain the same functionality, making everything less secure, not more. The absolute disaster of trying to make dexes work on Cardano is the best recent example. Their 'safe' utxo design is so limiting dexes like Sundae had to implement a trust-based sidechain just to be able to trade tokens, and it barely works.

After years of iteration, Solidity is now the safest smart contract language in existence. All common pitfalls are either well known or have been fixed. There are code analyzers. The problem with EVM isn't security, but the fact its word is 32 byte long which limits computational performance - but not that much really.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by pfraze on Thursday February 03, 2022 @12:23AM (#30189007)
Hard to be definitive about this kind of analysis, but it’s interesting to look at some surveys (https://medium.com/solidified/most-common-smart-contract-bug...).
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by krmmalik on Thursday February 03, 2022 @08:52AM (#30192352)
What about the DAML smart contract language? It's currently being used to digitalise the world's largest stock exchange (Hong Kong) and the Australian Securities exchange
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by vmception on Wednesday February 02, 2022 @10:18PM (#30188116)
exploit on Solana side, minted wrap ether and moved that over the bridge.

only the solana side was partially uncollateralized

fascinating hack actually

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by altspace on Wednesday February 02, 2022 @09:39PM (#30187786)
You’ll like stacks.co