Well said. This goes hand-in-hand with the victim blaming that goes on in cryptocurrency circles. Any time a story like this appears, defenders come out of the woodwork to insist that it's the victim's fault for doing something or not doing something else. Even the linked Twitter thread is full of replies from people suggesting that the author was "asking for it".
Crypto seems to appeal to people who like to think that they are smarter than the average person and therefore will succeed by self-managing their finances right down to the private keys. Adding smart contracts to the mix basically opens up a can of worms that makes it unrealistic to actually control every detail of your money unless you strictly limit each contract to a separate wallet and only transfer funds into that wallet before activating the contract. That's honestly a good strategy if you're sitting on $100mm+ in cryptocurrency and the transaction fees are negligible (as was the case with the Twitter user). However, when transaction fees are $10/each or more, the average crypto user isn't actually doing anything of the sort. They're clicking the buttons and hoping for the best.
I've been calling them Dunning Krugerrands for this reason, and I suggest others do as well.
1) Spend more tokens than the amount you approved. 2) Spend any other tokens besides the specific type that you approved. (E.g. can’t steal your NFT or USDC) 3) Spend tokens at any other wallet address even if you own those other addresses (and creating a new address for a specific purpose is trivially easy)
In addition the only approve() technology is already being replaced with the modern EIP-2612 standard. (USDC already implements it.) In this workflow instead of pre-approving a contract, you sign a specific transaction-specific message. With EIP-2612 you know exactly how much you’re spending on each transaction and there’s zero after the fact risk.
I'm glad the standard for approval of control of wallets is being deprecated for one with more granularity and security, and I hope it solves this problem.
But that is how it works. The idea that I have a wallet as an extension in my web browser, and people can deliver me any transaction they like, with a "yes" button decorated however they like in the form of a web app, it absolutely does mean that I need to know how to read solidity to be safe and that I must audit every transaction I'm interested in signing. And an engineer would take that for granted, but if that's the standard UX, again, this isn't ready for grandma, not even close.
What ethereum should've done was be a little more slow moving with adding features and maintain mist so that a standard UI feature set could be expected by users.
I have seen contracts approve your entire supply though without mentioning it. That would allow the contract to come back at any time, with no user action, to take more coins out.
Just be wary of "Approving" contracts before using them on DeFi apps. That first approval confirmation is the most important as you're basically handing them that much coin and trusting them to give it all back.
Also this guy seems rather green in term of internet scams,
> Scammers are getting smarter. Before now, the best scam I've really encountered is basically "hi this is tech support please share your private key so we can help"
No, for the same reason you don't check the code on every website you visit, if you want to be even more secure then just stick to blue chips like aave, curve, etc you can see how much is sitting in popular defi contracts here: https://www.defipulse.com/
You also don't give an ethereum contract full access to your wallet, you need to approve access to however much you want the contract to have access first then you get a second prompt to allow the contract to run.
You're talking like one accidental misclick and all your money is gone.
If you're super duper paranoid you might want to look at something like argent wallet (https://www.argent.xyz/) which lets you do common trades, defi, staking etc from within the app so you don't have to worry about random contracts and there's no seed phrase so no need to worry about that either.
This went on way longer than i expected
This is literally happening right now all over the place. Just go to any reddit cryptocurrency sub and do a search for "free token scam." People are finding free tokens in their wallets, trying to spend them and having their wallets emptied.
I don't check code on every website I visit because websites can't just empty my life savings with no recourse.
Ignorance is unbecoming.
When you stop worrying about that, and can actually start to deploy advanced technology for your advanced users.
You can weight your argument however you want, all technology will fail some class of user. Me, I’ve been playing with this and various tech for a decade now and the sky is the limit for where this can go.
At least Chrome tracks malicious websites.
By comparison, there seem to be no checks in place to prevent writing an ethereym contract that drains a victim’s wallet.
Who said it needed to be a real bank?
> At least Chrome tracks malicious websites.
That's not TCP/IP, the chrome equivalent would be on Trustwallet, argent, metamask etc to implement.
This isn't Ethereum's job.
It's an L2's job. Whichever ones you choose to engage with. But, they'll all be interoperable.
This shit isn't ready for the mainstream, and some of these architectural decisions are indicative of engineers who are in over their heads (but that's almost all code nowadays, even mine).
They build a mechanism that enables me, at the click of a button, to give away control of my fortune, and they designed the system so that anyone can design whatever interface they like to get you to sign any transaction they like. It's laughable. I'm in disbelief. And this is web3? No thanks, I think I'll stick with bitcoin or whatever, keep it simple. At least I can tell what a bitcoin transaction does without having to learn a programming language.