News for hackers. Stuff that matters.
Re:Smart Contract Security Field Guide by csumtin on Wednesday July 26, 2023 @05:25PM (#36885272)
Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank.

You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

Re:Smart Contract Security Field Guide by csumtin on Wednesday July 26, 2023 @05:29PM (#36885334)
Explanation: bankA -> bankB -> bankC.

bankC creates a secret number, hashes it and sends it to bankA. bankA sends money to bankB locked to hash. bankB can't get money until they have that secret number. bankB sends money to bankC locked to hash. bankC reveals secret number to bankB to unlock that money. bankB does the same with bankA.

Tada, we eliminated the risk of bankB running away with money. This is the lightning network

Re:Smart Contract Security Field Guide by csumtin on Wednesday July 26, 2023 @06:55PM (#36886283)
I realise that this might seem a bit niche but we can use this to create a payment network(like visa). This system is better as the nodes in the network don't need to trust each other.

Cast your mind back to 2008 and hopefully this means that one bank falling over doesn't bring down the whole system.

Re:Smart Contract Security Field Guide by JumpCrisscross on Wednesday July 26, 2023 @07:08PM (#36886409)
> we eliminated the risk of bankB running away with money

This isn't a real risk with correspondent banks. Instead, it's counterparty risk: bankB failing while it holds the funds in transfer. That risk can be mitigated with smart contracts, but it's not eliminated. (Correspondent banks also take a portion of the client bank's fraud and AML risk.)

Re:Smart Contract Security Field Guide by csumtin on Wednesday July 26, 2023 @07:45PM (#36886750)
I think the bank failing risk is eliminated, if it fails the forwarded payment is unlocked so bankA gets their money back.
Re:Smart Contract Security Field Guide by JumpCrisscross on Wednesday July 26, 2023 @08:05PM (#36886939)
> think the bank failing risk is eliminated, if it fails the forwarded payment is unlocked so bankA gets their money back

Bank failing in this context would be the bridge (EDIT: contract) gets hacked. Hence mitigated, but not eliminated.

Re:Smart Contract Security Field Guide by csumtin on Wednesday July 26, 2023 @08:23PM (#36887108)
If bankB is hacked, bankA still gets their money back or the payment is sent to bankC. So I still think the counterparty risk is eliminated between bankA and bankB
Re:Smart Contract Security Field Guide by JumpCrisscross on Wednesday July 26, 2023 @08:25PM (#36887133)
> counterparty risk is eliminated between bankA and bankB

Correct, but in its place is a new systemic risk with a real-world nonzero probability: the contract itself getting hacked. There isn't analogy for this in modern banking since the equivalent issue would either (a) get rolled back or (b) fold into the bank failing envelope. (There is analogy in pre-modern banking, though it largely revolved around debasement and invasion.)

Re:Smart Contract Security Field Guide by csumtin on Wednesday July 26, 2023 @09:28PM (#36887693)
True although I'm not talking about Ethereum smart contracts, I'm talking about Bitcoin ones which are very limited and not Turing complete. The lightning smart contract is like 20 lines and has been live since 2018, I feel the probability of the contract getting hacked is very low(famous last words!) https://github.com/lightning/bolts/blob/master/03-transactio...
Re:Smart Contract Security Field Guide by trompetenaccoun on Wednesday July 26, 2023 @09:11PM (#36887551)
Fair but LN is not a smart contract. Bitcoin can't do smart contracts the way a chain like Ethereum does, it's functionality is very limited.
Re:Smart Contract Security Field Guide by csumtin on Wednesday July 26, 2023 @09:24PM (#36887660)
I'd argue it is a smart contract :) just not a Turing complete one
Re:Smart Contract Security Field Guide by karpierz on Wednesday July 26, 2023 @05:28PM (#36885327)
How exactly does the Spanish bank get the USD that the American bank sent without trusting a third party?
Re:Smart Contract Security Field Guide by brobinson on Wednesday July 26, 2023 @06:03PM (#36885779)
You don't need to trust when you can verify. The source code for the intermediary bank (smart contract) would be available for everyone to read.
Re:Smart Contract Security Field Guide by karpierz on Wednesday July 26, 2023 @06:22PM (#36886017)
I'm not talking about code.

The goal of the transaction is for the Spanish bank to have access to USD. In the example given, the Spanish bank would then have to take the crypto it got and trust an exchange to give it USD in exchange for the crypto.

How do you get USD to the Spanish bank without trusting a third party?

Re:Smart Contract Security Field Guide by csumtin on Wednesday July 26, 2023 @06:45PM (#36886203)
USD doesn't have smart contract abilities so yes you are correct about trusting a third party to exchange crypto to USD. You could use a stablecoin but that requires you to trust the stable coin backing.
Re:Smart Contract Security Field Guide by TimJRobinson on Thursday July 27, 2023 @06:33PM (#36901027)
There are many USD stablecoins they can use: https://www.coingecko.com/en/categories/stablecoins. The top two are the most liquid but are also centralized, many of the others are fully decentralized.
Re:Smart Contract Security Field Guide by chrisco255 on Wednesday July 26, 2023 @06:49PM (#36886228)
They may be willing to accept trusting the dollar-backed token issuer. In the case of USDC, it's Circle. But there's nothing stopping JPMorgan, BoA, Wells Fargo, Western Union, etc implementing their own dollar backed tokens, and I suspect we'll see more and more of that as regulatory clarity settles.

Maybe the Fed themselves will issue tokens in this way. It's also entirely possible to construct a permissioned, yet decentralized exchange of tokens among whitelisted parties.

Either way USD is never sent trustlessly.

Re:Smart Contract Security Field Guide by theamk on Wednesday July 26, 2023 @07:39PM (#36886696)
* * *
Re:Smart Contract Security Field Guide by chrisco255 on Thursday July 27, 2023 @10:58AM (#36894595)
There are hundreds of use cases for it. We are discussing one in particular which is for international settlement of USD backed tokens with limited trust assumptions necessary. Because we are talking about USD and not BTC or ETH, there is ALWAYS an intermediary involved in any transaction that is not paper cash in hand.

The sender and receiver still benefit from a permissionless, automated, international, instant transfer of funds with a cryptographically certified audit trail. The blockchain runs 24/7 and has no downtime. A token can be fully programmed and fine tuned for whatever parameters need to be checked to authorize a transfer. Those rules are transparent and auditable to everyone involved.

The transfer goes through within seconds and the cost of the transfer does not scale with the value of the transfer.