Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DeFi protocol BadgerDAO exploited for $120M in front-end attack

theblockcrypto.com

Post reply on HN
Print view View original

61–70 of 151 posts

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#61

Post by root_axis »

deweller wrote: post #15

It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key. What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was stil…

> It is important to note that this was not a smart contract exploit.

I disagree that this is an important detail. Even though the smart contract code wasn't exploited directly (this time), this type of massive theft is only possible because the smart contract ecosystem thrives on a lack of accountability.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#62

Post by throwaway248329 »

legutierr wrote: post #51
throwaway248329 wrote: post #6

Earlier quoted context omitted.

Regulations in DeFi would do nothing but turning it into traditional, permissioned finance but on blockchain. Nobody wants that.

Not true! A lot of code written for financial applications, and a lot of the complexity in those systems, is there just to synchronize, reconcile and settle between the independent data silos maintained by the various entities involved in a transaction. Blockchains can do a lot to eliminate that complexity. Also, there are interesting advantages to the transaction authorization model that blockchains have whereby a m…

Traditional finance did settling just fine before. The only reason they are getting into blockchain now, is that it's a real alternative that people prefer to the banks.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#63

Post by i_like_waiting »

k__ wrote: post #30
codethief wrote: post #18

Earlier quoted context omitted.

Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say: > Is it possible to compromise the protocol and find out information about depositors? -- No, Tornado Cash is a decentralized protocol based on zero knowledge proofs. Its smart contracts are immutable, have no admins, and the proofs are based on strong cryptography. Only the user possessing the Note is able to link deposit and w…

If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain. It might not be evidence that A and B are your addresses, but strong implications. So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.

If I am not mistaken, the mixer has function to define how much you want to get out and on which address so 123 in from address 1, 100 out to address 2, 10 out to address 3, 13 out to address 4, if there is 1000 transactions daily, it gets a bit messy to match input and output. Only real issue would be if you deposit 10k ETH to pool with 100ETH, then it would be hard to go unnoticed

Edit: HN destroyed formatting

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#64

Post by [deleted] »

Nextgrid wrote: post #36
throwaway248329 wrote: post #17

Earlier quoted context omitted.

Not DAOs, but users can examine the transaction that they are prompted to sign and make sure that it is interacting with the right smart contract.

That technically just moves the problem one step further. How are users supposed to learn what is the right smart contract to begin with?

[deleted]

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#65

Post by root_axis »

throwaway248329 wrote: post #59
root_axis wrote: post #55

Earlier quoted context omitted.

> Especially when it's advertised as "consume at your own risk". Yet alcohol is highly regulated, much more so than baby milk.

But does it make "perfect sense" to regulate it? No. Especially not when there is a large group of population who disagrees to those regulations.

There is always large opposition to regulations of any kind petty much by definition.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#67

Post by throwaway248329 »

root_axis wrote: post #65
throwaway248329 wrote: post #59

Earlier quoted context omitted.

But does it make "perfect sense" to regulate it? No. Especially not when there is a large group of population who disagrees to those regulations.

There is always large opposition to regulations of any kind petty much by definition.

"There is always large opposition to restrictions of freedom".

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#68

Post by cblconfederate »

deweller wrote: post #15

It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key. What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was stil…

Maybe don't put it behind cloudflare?

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#69

Post by hungryforcodes »

ceejayoz wrote: post #40
hungryforcodes wrote: post #7

Earlier quoted context omitted.

Or just put in what you can afford to loose. No hand holding from regulators needed.

"The future of finance" or "so unsafe you should only put play money in". Pick one.

DAOs are totally experimental and the future of finance is pluralistic, so reductionism is doing it a disservice.

Rockets: "The future of space travel" or "so unsafe you could die on launch". Pick one.

If you don't like DAOs or any experimental finance -- which I think is a totally sane thing to do -- then just don't use them. That's why traditional financial structures like banks exist.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#70

Post by throwaway248329 »

root_axis wrote: post #61
deweller wrote: post #15

It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key. What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was stil…

> It is important to note that this was not a smart contract exploit. I disagree that this is an important detail. Even though the smart contract code wasn't exploited directly (this time), this type of massive theft is only possible because the smart contract ecosystem thrives on a lack of accountability.

Smart contract ecosystem thrives despite lack of accountability.
Post reply on HN