DeFi protocol BadgerDAO exploited for $120M in front-end attack • Hacker News Board

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#91

Post by okwubodu » Thu, Dec 02, 2021, 2:08 PM UTC

generalizations wrote: post #85

norswap wrote: post #33

Earlier quoted context omitted.

It's a coin mixer: you deposit ETH into a common pool shared with a bunch of other people, and you get back (off-chain) a code that can be used to redeem your deposit at a later date. Since there is no link between the code and the sender on-chain, nobody knows which contributor to the pool withdrew. So if there are N deposits then later N withdrawals, the only thing you know is that each withdrawal matches one of th…

> the only thing you know is that each withdrawal matches one of the deposits, but not which one. If there were e.g. three deposits for 5.542, 3.799, and 10.4322 ETH, and someone withdrew 3.799 ETH, then it seems like you'd know which deposit they made. Best case, you wait long enough and maybe someone else deposits 3.799 ETH.

It only lets you use fixed multiples for this reason (0.1, 1, 10, etc.). You can reasonably narrow it down as the amounts get higher, though.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#92

Post by [deleted] » Thu, Dec 02, 2021, 2:10 PM UTC

generalizations wrote: post #85

norswap wrote: post #33

Earlier quoted context omitted.

It's a coin mixer: you deposit ETH into a common pool shared with a bunch of other people, and you get back (off-chain) a code that can be used to redeem your deposit at a later date. Since there is no link between the code and the sender on-chain, nobody knows which contributor to the pool withdrew. So if there are N deposits then later N withdrawals, the only thing you know is that each withdrawal matches one of th…

> the only thing you know is that each withdrawal matches one of the deposits, but not which one. If there were e.g. three deposits for 5.542, 3.799, and 10.4322 ETH, and someone withdrew 3.799 ETH, then it seems like you'd know which deposit they made. Best case, you wait long enough and maybe someone else deposits 3.799 ETH.

[deleted]

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#93

Post by exdsq » Thu, Dec 02, 2021, 2:10 PM UTC

drran wrote: post #50

ianpurton wrote: post #34

Earlier quoted context omitted.

This is effectively a supply chain attack. To defend against it you need to secure the supply chain all the way from build to deployment. So a quick solution would be to run a job that checks your site every minute or so and compares the javascript against known hash values. Shut the site down if a hash has changed.

AFAIK, cryptocurrency companies are not looking for security experts at all. Users money are free, while company money isn't.

You’re wrong. Every crypto company I’ve worked with has spent significant amounts on security consultants, audits, test nets, and bug bounties.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#94

Post by root_axis » Thu, Dec 02, 2021, 2:13 PM UTC

throwaway248329 wrote: post #78

root_axis wrote: post #72

Earlier quoted context omitted.

That's a very poor rhetorical tactic since that sentiment could be applied to literally any law, since all laws restrict freedom.

Not every law is a restriction of freedom. My freedom ends where yours begins. Sadly, some people are more than happy to force their worldview on others, "for their own sake".

What is an example of a law that does not restrict freedom?

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#95

Post by pjc50 » Thu, Dec 02, 2021, 2:16 PM UTC

Grustaf wrote: post #47

Nextgrid wrote: post #35

Earlier quoted context omitted.

I don't understand how these mixer services work with regards to law enforcement. Wouldn't the any outputs of such laundering services be considered dirty to begin with, regardless of whether or not the supposed inputs were clean originally? If anything, I'd expect the output of such a service to be even worse than most inputs, as the money will be mixed with all the inputs, some of which would be associated with hor…

Isn't that a bit like saying cash is dirty? I don't think we are under obligation to keep our funds traceable? Perhaps we are getting closer to that point though.

UK: Unexplained Wealth Order https://www.stpaulschambers.com/what-are-unexplained-wealth-...

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#96

Post by gumby » Thu, Dec 02, 2021, 2:16 PM UTC

ceejayoz wrote: post #53

Grustaf wrote: post #47

Earlier quoted context omitted.

Isn't that a bit like saying cash is dirty? I don't think we are under obligation to keep our funds traceable? Perhaps we are getting closer to that point though.

> I don't think we are under obligation to keep our funds traceable? Oh, you do. Not being able to prove the source of your funds puts you at serious risk of asset forfeiture.

Oh, once you’re talking about asset forfeiture, even an ironclad provenance doesn’t help.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#97

Post by koolba » Thu, Dec 02, 2021, 2:17 PM UTC

Nextgrid wrote: post #36

throwaway248329 wrote: post #17

Earlier quoted context omitted.

Not DAOs, but users can examine the transaction that they are prompted to sign and make sure that it is interacting with the right smart contract.

That technically just moves the problem one step further. How are users supposed to learn what is the right smart contract to begin with?

> How are users supposed to learn what is the right smart contract to begin with?

That's the definition of due diligence. It's not one thing and the specifics of what's involved vary depending upon the investment. At the end of the day, the onus is upon the user to determine if it's a fraud.

Being difficult or down right impossible for a non-technical person to audit a contract address or the contract code itself isn't a license for users to ignore that risk. It means they're accepting it in its entirety. Or they can defer to a trusted third party to make that determination for them. But even then, they're still on the hook for trusting that third party.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#98

Post by pjc50 » Thu, Dec 02, 2021, 2:18 PM UTC

garbagetime wrote: post #77

ceejayoz wrote: post #39

Earlier quoted context omitted.

There are entirely legal, legitimate things one might do while still wanting to have some privacy about it. Buying porn, for example, might be something you're fine with but not really want tied to your known address.

Even things like buying houses (and I have heard of people buying houses with ETH). People generally like privacy when it comes to medium and large purchases, regardless of what it is that they are purchasing.

It would be illegal to anonymously buy property in the UK. https://www.gov.uk/government/publications/how-to-buy-a-home...

> People generally like privacy when it comes to medium and large purchases

The "war on money laundering" goes against this.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#99

Post by kisamoto » Thu, Dec 02, 2021, 2:18 PM UTC

Can someone ELI5 DAOs please? Ideally without the buzzwords and more focused on the value they create and how.

I'm a software engineer but the idea of a "smart" contract working as an "organisation", none of which can be undone when there is an error seems like it has massive risk attached and little to no benefit.

It doesn't seem "decentralized" as there are still organised parties to write and deploy code and the tokens that inevitably belong with each DAO are usually majority held by the creators.

Currently I like the __idea__ of a DAO but see them massively overhyped and unable to describe or prove their actual value.

Please change my view.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#100

Post by acdha » Thu, Dec 02, 2021, 2:19 PM UTC

Grustaf wrote: post #47

Nextgrid wrote: post #35

Earlier quoted context omitted.

I don't understand how these mixer services work with regards to law enforcement. Wouldn't the any outputs of such laundering services be considered dirty to begin with, regardless of whether or not the supposed inputs were clean originally? If anything, I'd expect the output of such a service to be even worse than most inputs, as the money will be mixed with all the inputs, some of which would be associated with hor…

Isn't that a bit like saying cash is dirty? I don't think we are under obligation to keep our funds traceable? Perhaps we are getting closer to that point though.

You're still required to keep records for things like tax purposes. More importantly, however, this is a service specifically designed to launder money which is going to look like a public declaration of intent to law enforcement types.

Since this costs money to use, most people are not going to use it unless they're trying to hide something so the big risk I'd worry about is similar to the risks of running a Tor exit node in your house. What happens when someone else using that service is investigated for some serious crime? Anyone who has transactions going to or from that pool is going to be under suspicion and it's really hard to _prove_ that you weren't knowingly helping them launder money when you have a public log of transactions involving the target.