Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The bug which lost more than $600M in various cryptocurrencies a few hours ago

twitter.com

Post reply on HN
Print view View original

51–60 of 126 posts

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#51

Post by 1998v2 »

yunohn wrote: post #38
crypt1d wrote: post #27

Earlier quoted context omitted.

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

Do you have some sources for this claim? Or just a belief?

Here are some examples I'm aware of, I haven't personally verified these.

Uniswap: https://uniswap.org/audit.html

Sushi Swap: https://github.com/peckshield/publications/blob/master/audit...

Alpaca Finance (high complexity in my opinion): https://docs.alpacafinance.org/transparency

A lot of projects provide their source and you can verify that what you're interacting with matches the source.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#52

Post by whitepaint »

yunohn wrote: post #48
whitepaint wrote: post #42

Earlier quoted context omitted.

High quality protocols like PoolTogether for example have this: https://docs.pooltogether.com/security/audits-and-testing

Most people have never heard of PoolTogether, so I’m not sure if your definition of “first tier” and “high quality” is objective. Regardless, this quote from your link stands out: “it should never be expected that 100% of the deployed code has been formally audited.”

It has $175 M locked in the protocol, it is also featured on https://ethereum.org/en/dapps/, and is one of the oldest DeFI projects. By my definition, it is both "first tier" and "high quality". We can of course have the philosophical debate of objectivity and if such thing even exists, not sure if it's needed here though.

The audits of this protocol is also continuous.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#53

Post by crypt1d »

yunohn wrote: post #38
crypt1d wrote: post #27

Earlier quoted context omitted.

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

Do you have some sources for this claim? Or just a belief?

Not sure what you mean by source, but its fairly easy to find out if any official audits were done as this is always announced and documented by the involved parties (for example, I couldn't find any detailed audit info for Poly). It's not like the audit is mandated by law, its initiated by the SC owners to put the investors at ease. A lot of companies like Certik, Consensys, ZK Labs, etc. provide auditing services for this purpose explicitly.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#54

Post by fny »

crypt1d wrote: post #45
uncomputation wrote: post #35

Earlier quoted context omitted.

It’s very hard to take this claim seriously in this thread, which details a huge (and somewhat obvious) security vulnerability in a currency worth at least $600m (an amount anyone would assume is “first-tier”).

Yeah I can understand that. Once you dive into crypto however, you quickly realize that $600m is just not that much money (especially not if we are talking about digital assets valued at current ticker price). And that lots of money isn't necessarily the right measure of quality of the project.

Lol, even 1% of $600M is $6M. That's a lot of money. You'd have to have garbage liquidity to only get back 1%.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#55

Post by Taek »

yarcob wrote: post #49
Taek wrote: post #36

Earlier quoted context omitted.

The appeal for irreversibility is the complete removal of counterparty risk. It's a sharp edge and you need to be structured/careful, but for certain types of transactions, the cost of being careful is 100x cheaper than the cost of finding and using a trustworthy counterparty. A strong example of where the irreversibility of crypto is very useful is in the online sale of expensive electronic goods. Especially for thi…

This just moves the risk from the vendor to the consumer. I assume that most chargebacks happen for purchases made with stolen credit cards. So the chargeback just returns the money to the rightful owner. If the consumer used bitcoin, and someone stole their credentials to buy something, then they would have no way to get their money back.

The chargeback returning the money to the rightful owner doesn't help the merchant who shipped $6,000 of hardware to some stranger. Certain types of electronic sales simply can't be done online because of the high rates of fraud. When you add crypto, these sales become possible.

Yes, they become possible at the cost of putting the counterparty risk onto the consumer, but that's better than the sale being entirely non-viable.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#56

Post by christkv »

crypt1d wrote: post #45
uncomputation wrote: post #35

Earlier quoted context omitted.

It’s very hard to take this claim seriously in this thread, which details a huge (and somewhat obvious) security vulnerability in a currency worth at least $600m (an amount anyone would assume is “first-tier”).

Yeah I can understand that. Once you dive into crypto however, you quickly realize that $600m is just not that much money (especially not if we are talking about digital assets valued at current ticker price). And that lots of money isn't necessarily the right measure of quality of the project.

It’s valued at 600 million that does not mean it can be liquidated for 600 million.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#57

Post by mrtksn »

lawn wrote: post #32
mrtksn wrote: post #14

Cryptocurrencies are fascinating but the irreversibility is not a feature but a bug. I don't get the appeal for irreversibility. A legitimate trade always occurs between willing partners, why would you be so afraid that the transaction would be cancelled? The only legitimate use that comes to my mind are complex financial instruments where things mostly happens with an assumption that the underlaying assets are very…

> A legitimate trade always occurs between willing partners Charge back fraud (also called friendly fraud) is a big problem in commerce, where the buyer will buy something, receive it and then cancel the payment. The merchant will often have to swallow the cost.

But that is an illegitimate trade and cuts BOTH WAYS. When the buyer is fraudulent the merchant swallows the cost AND when the merchant is fraudulent the buyer swallows the cost.

That's actually why credit cards come with protection against fraudulent merchants and you need a good enough credit score to actually get a credit card. On top of that, payment processors run fraud detection systems that block suspicious actions.

Irreversibility turns the trade into a competition over who is the better fraud. The only thing that the crypto guarantees is that the winner keeps the prize.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#58

Post by cesarb »

et2o wrote: post #24
londons_explore wrote: post #20

"Check the first 4 bytes of" should be banned in crypto code. Either I want something to match, in which case check it all, or I don't care if it matches, in which case don't check at all. Why would you ever check 4 bytes? To me it smells like a way to prevent fuzzers stumbling on a deliberate loophole.

This is perhaps the most confusing element of it all, to me. I can hardly imagine a legitimate reason to do this. Defeats entirely the purpose of a hash.

If I understood it correctly, the purpose of this hash is just to shorten the method signature (name+types) to a 4 byte identifier. Unless a contract has thousands of methods, the chance of collision is very low (and the compiler could detect any collision, since it can see all methods). The "legitimate reason" for shortening the method signature is probably just to save space; bytes on distributed blockchain transactions are expensive.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#59

Post by kevingadd »

hjorthjort wrote: post #47
55555 wrote: post #23

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a)…

That's what you hire auditors for.

An auditor has the same incentive to become a bad actor for profit

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#60

Post by exo762 »

jokoon wrote: post #19

I'm having a great laugh every time I hear about crypto-stuff goofs. Who thought an amazing new P2P invention would improve the image of normal money and traditional banks?

> Who thought an amazing new P2P invention would improve the image of normal money and traditional banks?

Shady stuff that happens in the banking system usually happens behind the closed doors and we don't hear about it for years, if ever. Crypto/DeFi is new and exciting - it gets a lot of attention from press. It is still way easier for me to trust code than to trust people. Call it a character trait / flaw if you want.

Post reply on HN