Apart from that, you are practically saying "hey there are hackers out there, stop building tools".
- satisfying multiple hard requirements,
- yields low rewards, and
- can be easily and quickly mitigated by project owners.
Full answer:
---
What you describe is actually not possible for a number of reasons.
In order for an attack on a Merge to earn project to have success, an attacker needs to obtain:
- Access as owner / maintainer to the Github repo, and
- The private keys of the wallets of enough safe owners to autonomously execute transactions. The general rule for multisigs is, the higher the quorum, the higher the safety.
In absence of both conditions, project maintainers have plenty of time to get control of the situation, and the attacker couldn't do anything. In fact, even if a Github account is compromised and fake PRs are merged to give themselves fat rewards, nothing happens until multisig owners actually execute the malicious transactions.
But, even though extremely improbable, let's assume an attacker manages to do that and the worst possible scenario happens. What then?
Due to how slicers are designed, the attacker wouldn't be able to get money received until that point out of the slicer, but only what has been received after he gained control. The Slice protocol has been designed to safeguard against these kind of attacks and malicious usage.
On the contrary, to mitigate an attack, project owners just need to reinitialize MTE for their repo with a new slicer and multisig, distribute ownership to contributors as it was before the attack, and redirect any new income and donations to the new slicer. This is technically trivial and can be done in minutes.
>Due to how slicers are designed, the attacker wouldn't be able to get money received until that point out of the slicer,
How does a normal person get money out of a slicer? That's how the hacker will.
>On the contrary, to mitigate an attack, project owners just need to reinitialize MTE for their repo with a new slicer and multisig,
You're saying that you foresee people starting a new pot of money to be stolen in the immediate aftermath of their old MTE money being stolen?
It basically says "here's a pointer to a pot of money, smash up this git repo to get it". What's more likely to happen, contributors spend a tonne of effort contributing to open source for a tiny share of the money in the wallet? Or hackers break into your github account, open an issue, allocating all the money in the wallet to it, merge the PR and sign off on draining the wallet?
I know what I'd bet on.