SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon • Hacker News Board

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#281

Post by EGreg » Mon, Jun 28, 2021, 7:27 PM UTC

rawtxapp wrote: post #242

lalaland1125 wrote: post #8

These incidents really illustrate the main flaw of smart contracts: a single bug in your code can lead to incredible losses. I simply don't think it's possible for human beings to write good enough software for smart contracts.

The flip side of that is any smart contract that stood the test of time should be rock solid. For example, there are huge incentives to go ahead and hack a big contract like maker, compound, uniswap or aave, so you can bet that there's highly qualified people out there trying to hack them as we speak, yet after all this time, they are still working as intended. I have a lot more trust in that kind of product than in…

I would trust things with formal proofs a lot more

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#282

Post by Retric » Mon, Jun 28, 2021, 7:27 PM UTC

zionic wrote: post #260

Retric wrote: post #253

Earlier quoted context omitted.

How many major bugs in software and especially cryptosystems went undisclosed for decades? The core issue is the inherent asymmetry where 1 person finding 1 bug can destabilize giant systems. Even if these systems where hundreds of years old that doesn’t actually mean much.

By this logic most e-commerce is a mistake as well, since a serious flaw in the linux kernel could take down most web servers.

Credit card transactions are reversible, that means such flaws can be considered a cost of doing business rather than permanently destroying anything.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#283

Post by pinky1417 » Mon, Jun 28, 2021, 7:27 PM UTC

leifg wrote: post #25

fasteddie31003 wrote: post #10

Earlier quoted context omitted.

How is that different from a traditional contract written by a lawyer? A single word could leave a huge unexpected hole in a traditional contract.

Regular written contracts are not automatically enforced. Not a lawyer here but I’m guessing. Not all legal loopholes automatically deprive you of all your savings. Intentional loop holes only go so far before consumer protection or other entities overwrite it. And if both parties are in agreement and in good standing you can figure out a way to find a reasonable compromise.

Indeed, contracts can be invalidated if they're abusive. For example, there's a doctrine in contract law called unconscionability. If you buy an airline ticket to Boston, the captain can't say upon landing "Welcome to Boston! You can pay $10,000 to deplane or we'll take you back to where you departed." Or let's say that, when you agree to the terms for a e-commerce site, buried deep in the terms is a clause saying the site gets half the money in your bank account. Sure, both parties might've technically agreed to the contract, but the contract probably isn't enforceable.

*Not a lawyer either, but I've read some introductory contract law stuff. All I know is this: you don't want to rely on the courts to save you, since they generally err on the side of the literal contract, but I don't spend much time worrying about accidentally agreeing to a contract that will sell myself into slavery.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#284

Post by EGreg » Mon, Jun 28, 2021, 7:27 PM UTC

intrasight wrote: post #52

mrec wrote: post #18

Earlier quoted context omitted.

I've seen them described as "self-funding bug bounties".

When I think about it in those terms... Why not fund bug bounties that way?

Because the payout would be too large

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#285

Post by doesnotexist » Mon, Jun 28, 2021, 7:27 PM UTC

rawtxapp wrote: post #264

uncomputation wrote: post #258

Earlier quoted context omitted.

Considering there are still new bugs found in chip designs, operating systems, and compilers that have been around 4 times as long as any cryptocurrency I have literally no idea why you would feel safe in “smart contracts.” At least if my bank account is hacked, I have a solid legal standing for compensation and I have good reason to believe centralized financial institutions will keep extensive documentation and log…

The bugs found in smart contracts equal large sums of money right away unlike 0-days in OSes or other systems where the link is much more indirect. For example, if you find a 0-day on Windows, sure you might sell it for 7-8 figures on the black market, if you found a bug on maker (or any of the big contracts), you could walk away with billions of dollars in a practically untraceable way.

https://en.wikipedia.org/wiki/Market_for_zero-day_exploits#M... The wikipedia entry on this is a bit misleading or misinformed. As there are multiple above ground buyers for 0-days that have no interest in making it difficult for people to sell to them.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#286

Post by spiralx » Mon, Jun 28, 2021, 7:27 PM UTC

graeme wrote: post #183

Jhsto wrote: post #168

Earlier quoted context omitted.

Despite the low liquidity on the exchange, the market cap of the token was supposedly $250M: https://twitter.com/Mudit__Gupta/status/1409463917290557440?...

How did they have a marketcap of $250M as a stablecoin when they had 1000x less in reserves?

Because market cap is nonsense, if I create FooCoin with 1,000,000 tokens and sell one for $250, it has a market cap of $250M despite only ever having $250 in real money involved.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#287

Post by falcor84 » Mon, Jun 28, 2021, 7:28 PM UTC

lisper wrote: post #262

whatshisface wrote: post #230

Earlier quoted context omitted.

We can do better than pinky swearing. Each lawyer gets mining fees when they enforce a contract fairly. "Fairly" is defined by consensus, where each lawyer is forced to predict the consensus before voting in a private ballot that is only revealed when the rewards are issued. Lawyers who predict the consensus get rewarded. If you start it off with people who are trying to be fair then predicting fairness will lead to…

That's actually a pretty good idea. I had a similar idea to discourage the gaming of upvotes on sites like HN and Reddit: make each upvote cost a point, but then you get a point for everyone who upvotes after you, divided by the number of votes the item had at the time you upvoted (or something like that). So people who upvote popular stories early, i.e. people who successfully predict what people will like, get rewa…

But why would we want to encourage such groupthink and discourage dissent?

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#288

Post by teawrecks » Mon, Jun 28, 2021, 7:28 PM UTC

LudwigNagasena wrote: post #167

Barrin92 wrote: post #92

Earlier quoted context omitted.

I'm gonna be honest I don't know what the audience is for a product where you risk losing your entire life savings because you typed a wrong word in a smart contract rather than paying a middleman a fraction of a percent. It's almost like a sort of willful ignorance of division of labour and the concept of pooling risk.

The audience is the people who don’t want to deal with the government for whatever reasons, the most obvious one is doing something illegal like buying drugs or costly like sending money overseas in developing countries.

First world citizens like to complain about how little they trust their govts, but I find it very telling when those same citizens can only see crypto as a benefit to nefarious actors. It's like complaining about Facebook and continuing to use Instagram.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#289

Post by rawtxapp » Mon, Jun 28, 2021, 7:28 PM UTC

intrasight wrote: post #52

mrec wrote: post #18

Earlier quoted context omitted.

I've seen them described as "self-funding bug bounties".

When I think about it in those terms... Why not fund bug bounties that way?

They are called ransomwares and people aren't very happy with that method.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#290

Post by Symbiote » Mon, Jun 28, 2021, 7:28 PM UTC

ConcernedCoder wrote: post #229

lalaland1125 wrote: post #8

These incidents really illustrate the main flaw of smart contracts: a single bug in your code can lead to incredible losses. I simply don't think it's possible for human beings to write good enough software for smart contracts.

Can there ever be 'bug free' software? As a lifelong programmer, I'm starting to think that it's impossible to write perfect software free from bugs.

In some cases, yes. See Software Verification [1] for some pointers.

It's massively more expensive, so you'll see it used in aerospace, railway signalling, some vehicles (trains, components of some cars), power generation and distribution, industrial processes.

Sometimes also in consumer products that have long warranties and are extremely expensive to recall/repair, like washing machines.

Just yesterday was a post on a formally-verified C compiler, used by Airbus (and others) [2]

[1] https://en.wikipedia.org/wiki/Software_verification

[2] https://news.ycombinator.com/item?id=27648735