The bug which lost more than $600M in various cryptocurrencies a few hours ago

Post by bko » Thu, Aug 12, 2021, 12:31 PM UTC

55555 wrote: post #23

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a)…

Post by yunohn » Thu, Aug 12, 2021, 12:33 PM UTC

whitepaint wrote: post #52

yunohn wrote: post #48

Earlier quoted context omitted.

Most people have never heard of PoolTogether, so I’m not sure if your definition of “first tier” and “high quality” is objective. Regardless, this quote from your link stands out: “it should never be expected that 100% of the deployed code has been formally audited.”

It has $175 M locked in the protocol, it is also featured on https://ethereum.org/en/dapps/ , and is one of the oldest DeFI projects. By my definition, it is both "first tier" and "high quality". We can of course have the philosophical debate of objectivity and if such thing even exists, not sure if it's needed here though. The audits of this protocol is also continuous.

Post by barrkel » Thu, Aug 12, 2021, 12:34 PM UTC

Taek wrote: post #55

yarcob wrote: post #49

Earlier quoted context omitted.

This just moves the risk from the vendor to the consumer. I assume that most chargebacks happen for purchases made with stolen credit cards. So the chargeback just returns the money to the rightful owner. If the consumer used bitcoin, and someone stole their credentials to buy something, then they would have no way to get their money back.

The chargeback returning the money to the rightful owner doesn't help the merchant who shipped $6,000 of hardware to some stranger. Certain types of electronic sales simply can't be done online because of the high rates of fraud. When you add crypto, these sales become possible. Yes, they become possible at the cost of putting the counterparty risk onto the consumer, but that's better than the sale being entirely non…

Post by crypt1d » Thu, Aug 12, 2021, 12:37 PM UTC

bko wrote: post #70

crypt1d wrote: post #27

Earlier quoted context omitted.

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

As this space evolves, I think there will be insurance and basic best practice safety measures. Also considering that almost all blockchains are open by design, it's no trivial task to liquidate a large sum of stolen tokens. So its not exactly a straight path from writing a script at Starbucks to making hundreds of millions of dollars.

Post by whitepaint » Thu, Aug 12, 2021, 12:41 PM UTC

yunohn wrote: post #73

whitepaint wrote: post #52

Earlier quoted context omitted.

It has $175 M locked in the protocol, it is also featured on https://ethereum.org/en/dapps/ , and is one of the oldest DeFI projects. By my definition, it is both "first tier" and "high quality". We can of course have the philosophical debate of objectivity and if such thing even exists, not sure if it's needed here though. The audits of this protocol is also continuous.

175M$ is like 1/4th of the hack that this thread is discussing. Also, they specifically state that not everything is audited? Nowhere do they mention continuous audits.