News for hackers. Stuff that matters.

676234e117

Dan Olson's tone and bias is grating.

> Why is the art of NFTs just so dang ugly? -- The folks who are steering all of this, the guys who are in charge, or the guys who go out and make something like Bored Ape Yacht club, like they're just hollow inside. They don't understand art. They don't understand culture. They don't watch television. They don't watch movies. They don't read books. They don't read comics.

A comment like reveals the interviewer and interviewee have not looked very far into the NFT art space. Like seeing a Jeff Koons Balloon Dog sale and saying that all art is hollow, and all artists have no culture. The highest selling art does not represent all art.

Re:Nomad drained of $150m due to a coding mistake on Wednesday August 03, 2022 @12:24PM (#32333750)
Have you ever purchased art or collectibles? It does not entitle you to IP rights or transfer any IP rights to you.

Loans and DeFi - see Uniswap issuing ERC721 Liquidity Pool tokens.

User accounts - exact same mechanism as ENS, but different namespace specific to a protocol. See Lens protocol for example.

Re:Nomad drained of $150m due to a coding mistake on Wednesday August 03, 2022 @11:43AM (#32333250)
> How EXACTLY does NFT "hold custody" of anything not living fully on on the blockchain already?

I am not suggesting it does. I am suggesting it allows you to hold ownership of an asset on the blockchain. At this point it means ENS, art, collectibles, loans, stablecoin positions, user accounts, and other assets that can be defined digitally and on chain.

At some point in the future, property laws might change to recognize crypto tokens as their own asset class, which would make possible things like having some claim of ownership over a gold bar based on holding a NFT. Many investors today hold gold in their portfolio without it physically being transferred to them. Instead, ownership of the assets is recorded on some ledger, which could be a public ledger.

Mattereum is working in this space, trying to tokenize gold bullion, wine[1], and recently real estate[2] with legal warranty, but I would not put much stock in this idea until there is more clarity from lawmakers.

[1] https://www.businesswire.com/news/home/20220624005079/en/IG-...

[2] https://www.businesswire.com/news/home/20220731005030/en/Mat...

With a NFT of a GIF, you don't need to pay to see the content. People are not buying these tokens to see the content, because it is free for everybody to see.

What Pearson is suggesting is a different model: that you have to buy the NFT to see the content. This will lead to piracy, as most people will not be buying the textbooks for the token, but for the file it points to.

> Why would people want to pay royalties to an artist, and not to an author? I would actually agree with you, but I think people don't want to pay royalties full stop.

People usually are happy to pay and see royalties going to content creators, and if Pearson set up the smart contract to split royalties across the dozens of editors and designers that had a hand in making the book it would be a fantastic use of the blockchain. But this article suggests that Pearson as the distributor will be reaping the most rewards, not the authors of the textbooks.

Sales volume has plunged from its early hype, but daily trades and activity remains higher than ever. In some corners of the market sales and royalties are still generating significant revenue for many artists, where prior to NFTs they did not have many options for monetizing their digital art.

Beyond monetization it has also spawned new digital art communities, meetups and conferences, exhibitions and art galleries, magazines and critical publications, and is generally continuing to garner interest within the traditional art world.

Re:Nomad drained of $150m due to a coding mistake on Wednesday August 03, 2022 @10:25AM (#32332123)
If you are asking "how does NFT hold custody" of a digital record then I assume you have never looked at how NFTs work at a technical level. If you know code, you can look at the ERC721 spec yourself.

A practical example of an application on top of this is namespace aliases that are held non custodially by the users through an ERC721 contract - see ENS. The user's private key gives them access to a record within a smart contract, allowing them to update some state or transfer ownership of the data object.

I am a NFT proponent and this idea seems very broken.

The royalty model is working fine in NFT art world because people are not paying to see the GIF or PNG, it is already free to download it in high resolution. Anybody can right click and share it but nobody cares, if anything it can increase the value to have it replicated and shared. And also because most people buying art are willing to honor the royalty if it goes back to the original creator.

But people buy ebooks because they want to see the content, and they do not want to pay royalties back to Pearson. Especially students, they will just circumvent the payment and share the DRM free ebook and find ways of using blockchain contract wrappers to avoid royalties.

I do think there is probably a viable model for digital content like ebooks that involves crypto payments but this isn't it.

Re:Nomad drained of $150m due to a coding mistake on Wednesday August 03, 2022 @05:42AM (#32329576)
Nothing stops tech companies from building crypto wallets or services that hold custody over users funds, a lot of them are already doing that. Building a new blockchain where they fully control the network and its features is harder.
Re:Nomad drained of $150m due to a coding mistake on Wednesday August 03, 2022 @05:20AM (#32329446)
- ERC20 stablecoins are not a paper IOU but ok.

- all these protocols are beta software, less than a few years old. Uniswap as one of the oldest is probably also the most secure.

- NFT: ability to hold custody over a digital record without relying on a single private company's servers to uphold that. But I expect you will move the goalposts...

- Cryptography: take a minute to look at developments in ZKP, MPC, new signature schemes. Many uses outside of pure blockchain[1].

- BigCorp: because they can extract value from it. If 5% of Shopify or PayPal users want to use crypto payments, the company can support that method and charge rent on it. Or they can ignore crypto, and let another company absorb the potential revenue. But because they like profit, this is why we see Shopify, Stripe, and PayPal all integrating crypto currency.

[1] https://blog.cloudflare.com/introducing-zero-knowledge-proof...

It appears this is mostly targeting specific hot wallet software that may have some compromised downstream signing library, since the wallets are closed source it is difficult for the community to get to the root of the problem.

Storing value on closed source hot wallets is generally not a good idea.

Re:Nomad drained of $150m due to a coding mistake on Wednesday August 03, 2022 @04:38AM (#32329149)
In the current electronic fiat system, a few companies control both the gates and the network. Crypto at the moment decentralizes the control of the network, which is already a step forward.

Crypto can also be used to decentralize control of the gates, such as allowing goods services and taxes to be paid in USDC and DAI, so that there is less need to use a CEX. But there are regulatory and technical barriers that prevent this from happening right now. The people who want blockchain adoption ideally would like to see those barriers to be overcome.

Re:Nomad drained of $150m due to a coding mistake on Wednesday August 03, 2022 @03:44AM (#32328770)
Facebook already tried this, it was called Libra.
Re:Nomad drained of $150m due to a coding mistake on Wednesday August 03, 2022 @03:42AM (#32328750)
> Every time the merge is delayed, price drops

You are conflating "people losing tokens" with "people losing the USD value of their tokens." It is very likely that the market becomes unpredictable before and after the merge, value of ETH may plummet or skyrocket, and holders of ETH should be prepared for that.

> The bomb is an embarrassment because every time it gets pushed out, that is essentially the minimum amount of time before the merge can happen.

That is not how the bomb works. It is a soft deadline. If the developers feel the merge is ready, they can initiate it before the bomb occurs, and miners will immediately be forced to transition their hardware to other PoW networks. If the developers do not feel the merge is ready, and the bomb is fast approaching, they can delay the bomb by another month or even a year and it will not have an impact on the timing of when they actually decide to initiate the merge.

If the worst that can happen is "embarrassment" for having to delay the merge again to fix a critical bug, I think you are overblowing this. The developers will happily delay the merge until all the bugs are fixed, and the users are happy to have this happen as they would rather wait for a working merge than rush toward a broken one.

> How. I want a detailed plan. So far, I haven't seen it.

Every time the protocol rules change, developers are activating a fork by coming to consensus on the new rules - all client software must coordinate code updates to match the new rules. Eth core developers and client teams have been doing this regularly over the years, and especially during the approach to the merge. They can coordinate a revert or fork, just as they have coordinated the past several forks[1], to fix these issues.

It is fine to imagine a hypothetical failure case for the merge but this does not mean "it cannot be fixed." It might be messy, the value may drop, coordinating the fix may take some hours or days, and it is even possible the chain stops producing blocks for some short while if it is very catastrophic. Users still holding ETH going into the merge should be prepared for these situations, it is probably the most significant development in crypto currency and DLT since the Bitcoin genesis block.

[1] https://ethereum.org/en/history/

Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @06:53PM (#32325323)
It may never meet the impact of the web but held to that standard, maybe no technology ever will.

The killer application is Ethereum and the ideas it has spawned, including new global financial instruments like stablecoins, decentralized exchanges, NFTs.. and cryptography like zk-STARKs and MPC.

With PoS and privacy enabled rollups this technology can certainly disrupt and compete with today’s popular payment processors in the next few years.

But yes, the most successful consumer applications will probably be boring, like PayPal or Apple or Stripe adding blockchain based mechanisms under the hood.

Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @06:38PM (#32325181)
By “loss” do you mean that of the exploiters losing tokens because the community decided not to follow the hacked chain?

The goal of all the shadow forks and merge testnets is to find the different edge cases and failure states to answer those questions of “what is the failure plan?” If mainnet merge somehow does not succeed despite these tests and all clients fail to produce blocks, the merge can just be delayed until the bugs are resolved. If mainnet merge succeeds but later a bug emerges, users can coordinate a change to revert the lost funds.

Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @06:36PM (#32325157)
If you want more details you can always read the Gasper paper[1], the spec[2], or client code.

It is complex to somebody not familiar with consensus and blockchain execution, but you might say that about any modern engineering. PoW is undoubtedly simpler but also exponentially more environmentally destructive.

[1] https://arxiv.org/abs/2003.03052

[2] https://github.com/ethereum/consensus-specs/blob/dev/specs/p...

Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @03:13PM (#32323024)
I agree with your point that PoS is more complex and has a wider attack net than PoW, but I don’t agree that users will not be able to coordinate on a new fork in case of a protocol failure. The worst that may happen is that another hard fork emerges, where the majority of the ecosystem follows a single chain with the bug reverted, and some group of outliers such as disgruntled BTC miners or people who profited immensely from the bug decide to try their luck with a smaller fork. And that is fine... users are free to decide what fork to follow, and they can run client software that chooses a different chain.
Re:The endless search for a crypto use case on Tuesday August 02, 2022 @01:29PM (#32321745)
Maybe it is just 1 recipient. Which I think is still a fine display of the value of a decentralized payment option.
Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @01:26PM (#32321690)
The article is not really presenting any strong arguments aside from literal hand waving the "<complexity>". The same hand waves could be made for PoW. See the last time it made discussion[1].

The article suggests that two chains can simultaneously exist but that would invalidate the protocol, which will always choose one using LMD GHOST. You can read more about it here[2].

[1] https://news.ycombinator.com/item?id=27235668

[2] https://eth2book.info/altair/part2/consensus

Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @12:43PM (#32321029)
If you look beyond the most vocal proponents you will see a range of opinions.

I do think it will, over the next 10-20 years, completely revolutionize how we think about digital assets and digital currency. For the average user it might not be any different than paying with Apple Pay. But there will be other novel applications and companies that emerge from this space much like what occurred in the years after the dot com boom.

Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @12:40PM (#32320979)
What you are describing is a protocol-level bug, rather than smart contract bug. The merge has already occurred successfully a number of times on test networks, so it seems unlikely at this point. But if a catastrophic failure were to occur on mainnet, clients would just revert or fork to a working state.

The reason you cannot just roll back a smart contract exploit like Nomad's is that it is very hard to build consensus across the entire protocol unless it is something that affects many users. The only time this happened was with the DAO which held something like 15% of all Ethers at the time, and so it affected the entire network. Compare this to Nomad which held something like 0.1% of Eth's total circulating supply.

Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @12:25PM (#32320765)
This might be surprising, but not every crypto user is a pure libertarian, or believes that code is law. A significant amount of funds extracted from this exploit were from whitehat hackers who took the funds and plan to return them, to avoid them being taken by malicious actors.
Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @12:19PM (#32320668)
Interesting analogy. Is this exploit a Hindenburg or a steam train wreck?

It is probably both. The model of allowing governance updates from a contract owner on a bridge or rollup is not sustainable and will have to change to mitigate these kinds of risks. Whether that means crypto networks as a whole will inevitably be replaced by a central banking system is harder to agree with.

Re:Nomad drained of $150m due to a coding mistake on Tuesday August 02, 2022 @12:15PM (#32320625)
It is important that users come to better understand the different risk profiles between:

1. Owning ETH with a non-custodial wallet.

2. Owning ETH on a CEX.

3. Depositing ETH into a smart contract to receive a wrapped asset. This includes rollups and L2s.

The majority of major crypto hacks[1] are in the 3rd group, and almost all of these hacks are related to protocol updates and governance. Either: the developers update their code, and accidentally push a bug, or one address or a group of addresses are allow-listed some privileged actions in the contract and that can become a weak point.

Proxying and governance isn't the only way to design contracts. Two examples counter to this that are more robust are WETH ($6B) [2] and ETH2 Deposit ($20B) [3] which cannot be attacked in this way. If users wanted a new feature from the WETH contract, they would have to manually migrate over to the new address. Eventually we might see this kind of design be applied to bridges and rollups.

[1] https://rekt.news/leaderboard/

[2] https://etherscan.io/address/0xc02aaa39b223fe8d0a0e5c4f27ead...

[3] https://etherscan.io/address/0x00000000219ab540356cbb839cbe0...

Re:Nomad Bridge Drained of Nearly $200M in Exploit on Tuesday August 02, 2022 @05:49AM (#32316804)
It is important that users come to better understand the different risk profiles between:

1. Owning ETH with a non-custodial wallet.

2. Owning ETH on a CEX.

3. Depositing ETH into a smart contract to receive a wrapped asset. This includes rollups and L2s.

The majority of major crypto hacks[1] are in the 3rd group, and almost all of these hacks are related to protocol updates and governance. Either: the developers update their code, and accidentally push a bug, or one address or a group of addresses are allow-listed some privileged actions in the contract and that can become a weak point.

Proxying and governance isn't the only way to design contracts. Two examples counter to this that are more robust are WETH ($6B) [2] and ETH2 Deposit ($20B) [3] which cannot be attacked in this way. If users wanted a new feature from the WETH contract, they would have to manually migrate over to the new address. Eventually we might see this kind of design be applied to bridges and rollups.

[1] https://rekt.news/leaderboard/

[2] https://etherscan.io/address/0xc02aaa39b223fe8d0a0e5c4f27ead...

[3] https://etherscan.io/address/0x00000000219ab540356cbb839cbe0...

Re:In defense of cryptocurrency on Friday June 10, 2022 @09:59AM (#31694332)
The article hints at some of these at the end of the article, but here's a few things maybe:

- the option for non-custodial and semi-custodial ownership of things like digital assets, from currency to domain names to other types of online property. most of our digital assets today are custodial, owned by companies seeking to gain profit and create moats. maybe some users would like another option, despite the additional risk of having to maintain their own private keys.

- fast settlement times for worldwide payments that do not require routing through a centralized intermediary that will skim a significant percentage off the top of each trade. fees paid in a PoS system can be redistributed to all participants in the network through burning + staking and delegation, which is a very different way of handling payment processor fees than what we have now

- a network of financial applications and systems that is permissionless, so that anybody can fork an existing tool or deploy their own tool without going through regulatory hurdles and roadblocks based on an archaic tightly permissioned boys-club financial system

- smart contract functionality like a 0% fee crowdfund contract that can support hundreds of thousands of participants, settle instantly, and even provide shares as tokens back to donors in case some future rewards should be distributed back to early investors

- generally better payment systems that use new cryptographic primitives rather than pencil signatures on paper, insecure card numbers and 4-digit PINs, constant privacy invasive systems