Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

cryptoslate.com

Post reply on HN
Print view View original

291–300 of 577 posts

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#291

Post by raverbashing »

admax88q wrote: post #255
raverbashing wrote: post #62

Earlier quoted context omitted.

Yes, I agree. Most of the security of smart contracts should be in the VM. Things like self-asserting the results and only finishing the transaction if it actually passes a double-check. Or set value limits to each smart-contract (so even if there's a bug it will only operate on 0.00001 BTC for example).

If your smart contract can only process tiny amounts of money, then it's no useful.

That's not what I'm saying. But sure, if you think you can write smart contracts without bugs for all means don't set a limit.

I'm saying you should define a ceiling for your smart contract so in case of a bug, no transactions over that ceiling go forward.

So if you have a stupid bug that causes you to transfer 1BTC instead of 0.001BTC you don't lose all your money.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#292

Post by remram »

kybernetikos wrote: post #270
remram wrote: post #240

Earlier quoted context omitted.

In a very real way, those contracts are less smart than existing legal contracts. In the same way a "smart speaker" allows for interactive and sensitivity to its environment compared to a "dumb speaker", a "legal contract" allows for arguing and bugfixing and sensitivity to its environment compared to an block chain "contract". They should call them "strict contracts" or "inflexible contracts" or "software-enforced c…

> In a very real way, those contracts are less smart than existing legal contracts. It's more that they're just entirely separate things. Smart contracts are programmable money. Contracts are agreements between parties. The fact that you can use smart contracts to automatically take actions required by an actual contract is interesting and useful, but it's not enough to make the two comparable.

I'm not the one who decided to name them "smart contracts" instead of "programmable money". Not that I think the latter term makes sense...

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#293

Post by tptacek »

dcolkitt wrote: post #185
tptacek wrote: post #130

Earlier quoted context omitted.

It literally does not. The world runs advised by algorithms, but not governed by them. It's a fundamental difference. When algorithms in the real world create lose-lose outcomes, people override them, which is why when your credit card gets stolen you don't end up paying for stuff. You can bake that logic into a software contract, but if the design of your system is that the totality of software contracts are the fin…

You are aware that the vast majority of financial market trading is run by algorithms that govern not advise vast amounts of capital in an irreversible way. Sometime these algorithms break or are exploited. Often in spectacular disasters. Knight lost half a billion dollars in 30 seconds. Nobody reversed though, even though it was clear error. If you have a 401k I guarantee you that a significant amount of your money…

In a previous lifetime not so long ago, I was paid to find vulnerabilities in exchange infrastructure --- order routers, match engines, FIX gateways, all that stuff. When I was getting started, any interesting finding was super exciting. "This is a billion-dollar vulnerability! Suck it, Mark Dowd!"

Then I learned about out-trades. In reality, these heavily automated markets screw up (or, rather, customers of these markets screw up) somewhat regularly. Surprise: one of the reasons lots of humans work both at the exchanges and at companies that program directly to them is that mistakes happen, and are often resolved not by code but by hashing things out between cooperating blobs of electrified fat tissue. Gross, I know!

Obviously, there are big screwups where the rules coded into the algorithm are the last word. But those rules aren't always the final word, and, more importantly, the rules themselves are easily changed when the electric meat blobs want them to.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#294

Post by spiralx »

TameAntelope wrote: post #97
keymone wrote: post #67

Earlier quoted context omitted.

redeemable until it's not.

But given the monthly audits conducted, "it's not" is not very likely to happen at all. The auditor would have to be actively lying or misrepresenting for USDC and Gemini both for something like that to happen. Much more likely a smart contract somewhere fails than USDC/Gemini (the only two I know that do full audits to ensure 1:1 dollar backing, ignoring USDT). There just isn't much risk there, hence there not being…

There are no monthly audits. They have "attestations" which are not the same thing.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#295

Post by aqme28 »

pavel_lishin wrote: post #231
lazzlazzlazz wrote: post #164

There are more than $100b of stablecoins — 285x year-over-year growth — with a variety of very interesting and high-quality stablecoins proliferating. And of course, Hacker News focuses on some garbage project nobody in the space even followed. How is there no discussion about FRAX, Maker's DAI, USDC, CRV's 3pool token, Liquity's LUSD, and so many other interesting projects?

Because there's nothing interesting about them. They're just another variation on the same ol' "we peg our value to the dollar(*)!" pitch. The interesting stuff happens when they fail.

I think they way they peg their value to a dollar is interesting, because there are so many different strategies now.

Some are via reserve dollars, some via collateral based on an oracle, some via collateral not based on an oracle, some are tightly coupled, and some are a bit looser.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#296

Post by DanHulton »

Retric wrote: post #253
rawtxapp wrote: post #242

Earlier quoted context omitted.

The flip side of that is any smart contract that stood the test of time should be rock solid. For example, there are huge incentives to go ahead and hack a big contract like maker, compound, uniswap or aave, so you can bet that there's highly qualified people out there trying to hack them as we speak, yet after all this time, they are still working as intended. I have a lot more trust in that kind of product than in…

How many major bugs in software and especially cryptosystems went undisclosed for decades? The core issue is the inherent asymmetry where 1 person finding 1 bug can destabilize giant systems. Even if these systems where hundreds of years old that doesn’t actually mean much.

Yeah, the classic example is the original binary search algorithm. It had an overflow bug that went undetected for two decades: https://thebittheories.com/the-curious-case-of-binary-search...

It's an incredibly simple algorithm and still got missed. Smart contracts have no chance.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#297

Post by thebean11 »

sonicggg wrote: post #201
thebean11 wrote: post #95

Earlier quoted context omitted.

Who is "they"? Maker has nothing to do with USDC. USDC is a Coinbase product.

Your seem uninformed. Dai is backed by USDC.

The comment I replied to implied that Maker and USDC are connected beyond USDC being one of many collateral currencies for DAO, which I don't believe is the case, but feel free to correct me if I'm indeed uninformed.

edit: From someone above https://share.streamlit.io/tadzz/maker_dai_collateralization...

Each DAI is over collateralized, and backed by more ETH than USDC.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#298

Post by UIGYUIUYG »

ljm wrote: post #191
Barrin92 wrote: post #92

Earlier quoted context omitted.

I'm gonna be honest I don't know what the audience is for a product where you risk losing your entire life savings because you typed a wrong word in a smart contract rather than paying a middleman a fraction of a percent. It's almost like a sort of willful ignorance of division of labour and the concept of pooling risk.

Or where you do the equivalent of stuffing cash under your mattress by hiding the password to your cryptowallet inside a safe, or using one of the various incantations of writing your password on a post-it note. Sure, the vast potential of reward justifies the added risk. But I'm also not in the US, I'm not rabidly anti-government, and I don't want to store my money under my floorboards. Good, old-fashioned, regulate…

> by hiding the password to your cryptowallet inside a safe, or using one of the various incantations of writing your password on a post-it note.

This is the scariest bit about crypto by far and that I will not deny. This is why whilst I don't trust banks, they do have big safes with locked boxes in. Using these with shamir backups is what protects my assets, and worst case scenario my private key is also split in two and engraved in two seperate countries.

If it's ever at the point where I can't access any of these, there's bigger shit going on in the world.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#299

Post by jhickok »

ConcernedCoder wrote: post #229
lalaland1125 wrote: post #8

These incidents really illustrate the main flaw of smart contracts: a single bug in your code can lead to incredible losses. I simply don't think it's possible for human beings to write good enough software for smart contracts.

Can there ever be 'bug free' software? As a lifelong programmer, I'm starting to think that it's impossible to write perfect software free from bugs.

Technically, I don't see why it would be impossible. Seems like it is incredibly unlikely.

Re: SafeDollar ‘stablecoin’ drops to $0 following DeFi exploit on Polygon

#300

Post by loeg »

TameAntelope wrote: post #97
keymone wrote: post #67

Earlier quoted context omitted.

redeemable until it's not.

But given the monthly audits conducted, "it's not" is not very likely to happen at all. The auditor would have to be actively lying or misrepresenting for USDC and Gemini both for something like that to happen. Much more likely a smart contract somewhere fails than USDC/Gemini (the only two I know that do full audits to ensure 1:1 dollar backing, ignoring USDT). There just isn't much risk there, hence there not being…

> But given the monthly audits conducted, "it's not" is not very likely to happen at all. The auditor would have to be actively lying or misrepresenting for USDC and Gemini both for something like that to happen.

USDC has regular attestations, not audits. It's an important distinction.

Post reply on HN