Did I just lose half a million dollars? • Hacker News Board

Re: Did I just lose half a million dollars?

#381

Post by nickjj » Sun, Jan 30, 2022, 2:43 PM UTC

Here's an unrelated but related question:

How do you store your wallet / private keys where you would be comfortable storing an amount of money that's important to you?

It feels like a bunch of consumer grade options we have are kind of flaky:

    Flash drives are extremely undependable. I've had a few fail to read after sitting in a closet for a year.

    SSDs can supposedly have data loss pretty quickly if left unpowered (days to months).

    DVDs have decent lasting power (I have some CDs that still work after 15 years) but this makes me nervous because it's so susceptible to damage.

    HDDs also make me think what would happen if it's not powered on for 5-10+ years (it's mechanical, does it use some type of oil internally to keep friction down?).

    Putting it on the cloud seems risky, even with encryption at rest and now we need to backup the encryption keys.

    I guess tape is still our best bet?

I would also think if you have a decent amount of crypto you'd likely want to have 3 backups in your apartment along with 3 offsite backups, perhaps lock boxes in a few different banks in different towns (or even hundreds of miles apart).

Basically it still feels like a huge pain in the butt to keep digital currency secure and available. The more backups you have, the more risk you have around being compromised but the less backups you have the more susceptible you are to data loss and losing everything.

Re: Did I just lose half a million dollars?

#382

Post by HWR_14 » Sun, Jan 30, 2022, 2:43 PM UTC

wbl wrote: post #281

capableweb wrote: post #231

Earlier quoted context omitted.

It's not really edge bases, it's how contracts works, and how this contract works. There is nothing magical here. It's a bit like avoiding the checksums that IBAN has, and then complaining that IBAN is broken. Most people interact with WETH via UIs, but for some reason this user chose not to, and got severely burned because of it. Things that require expertise usually requires one to know acronyms and how things work…

If this happened at a bank everyone involved would fix it and have a nice laugh the next day.

If this happened at a bank, you would be told you submitted the wrong form to withdraw foreign currency from your account (closest analog I can think of) and be given the correct form before it even started getting processed.

Re: Did I just lose half a million dollars?

#383

Post by NelsonMinar » Sun, Jan 30, 2022, 2:44 PM UTC

capableweb wrote: post #228

Since no one seems to think about how this could have prevented, here is a simple way, which I've applied to lots of things in life, not just cryptocurrency transfers: - If you're making a transfer somewhere with a large amount, do a small transfer first and verify it's working. Confirm at the receiving end before moving big sums. - If you're calling a contract, try it with a small amount first. Verify the parameters…

Simpler way: use real financial instruments. Traditional financial systems have had solutions for errors like this for centuries.

Re: Did I just lose half a million dollars?

#384

Post by NelsonMinar » Sun, Jan 30, 2022, 2:44 PM UTC

ddoice wrote: post #276

rwmj wrote: post #131

Earlier quoted context omitted.

> I was not investing, one of my contractors unilaterally decided to pay me in crypto. Why didn't you tell him that you wanted to be paid in real money?

Yup, their response was crypto or nothing

I hope you weren't involved in helping someone launder money.

Re: Did I just lose half a million dollars?

#385

Post by sgt » Sun, Jan 30, 2022, 2:46 PM UTC

kuhewa wrote: post #259

khazhoux wrote: post #77

Earlier quoted context omitted.

Do we really think women with grandchildren can’t understand Android phones?

Yeah i reckon some 80 year old grandmothers struggle with some Android functions.

I have seen real proof of this. The only reason "regular" people buy Android is to save money, but it becomes a support issue for their children and grandchildren. I've made sure my entire family is on iPhone. My mom could never figure out the bottom three buttons on Android. iOS makes more sense to her.

Re: Did I just lose half a million dollars?

#386

Post by e12e » Sun, Jan 30, 2022, 2:47 PM UTC

t8e56vd4ih wrote: post #237

noduerme wrote: post #41

Earlier quoted context omitted.

Wait. I'm not letting anyone off the hook for not knowing the above if they put $5 into something, let alone $500k. But even as a coder and someone who was deeply involved in crypto at one point (2011) I find it hard to make heads or tails of wtf this means. All I hear are a lot of acronyms and bizarre edge cases upon edge cases. It sounds like those arguments you'd hear between kids in junior high over magic cards o…

"Any sufficiently advanced technology is indistinguishable from magic." but yes, I find myself thinking the same with many things. especially when the disciples seem irritatingly proud of their "knowledge" which actually is just a collection of arbitrary and anti intuitive rules.

Perhaps it's time to coin (sorry) a new phrase:

"Any sufficiently advanced smart contract system is indistinguishable from Magic the Gathering (tm)."

Re: Did I just lose half a million dollars?

#387

Post by sanderjd » Sun, Jan 30, 2022, 2:47 PM UTC

dTal wrote: post #375

sanderjd wrote: post #371

Earlier quoted context omitted.

Right you are. I just edited to differentiate from this other general problem with the nomenclature in the space. I actually think this one leads to less confusion though, because the people who are familiar with "crypto" vis cryptography universally have enough expertise to differentiate it from "crypto" vis cryptocurrency. Whereas I would estimate that at least 99% of people who have heard of both Bitcoin and Ether…

The next time I get cornered by a coinhead - a worryingly common occurrence in real life lately - I'm going to say "Oh, I love crypto! My bank uses it so I can access my account from anywhere. It's great!"

hahaha yeah you can claim a different definition of "crypto" depending on whether you're talking to an anarchist or an institutionalist.

Re: Did I just lose half a million dollars?

#388

Post by danielvf » Sun, Jan 30, 2022, 2:47 PM UTC

ssiddharth wrote: post #5

In case you’re wondering what happened, from the thread: He sent ETH to the WETH contract, received WETH as expected. Then he wanted to do the reverse and sent WETH, but will not receive anything, because you're supposed to swap your WETH to ETH in exchanges like Uniswap, or call the "withdraw" function in the contract. For contracts that want to only work with ERC-20 tokens, you use WETH, which comes from a contract…

Here is background on this for a developer-but-not-crypto-developer.

The Ethereum blockchain has its own money that is built right into "OS" of the blockchain. It's called ETH. Any time one program calls another, the actual function call itself can send ETH along with it. In fact, to transfer ETH from your account, you just make a function call to another account with no parameters, ignore return values, and transfer some ETH along with it.

Now it soon became apparent that this scheme left a bit to be desired:

First developers wanted to create their own moneys. ETH is hardcoded into the system, no one else can use that mechanism.

Secondly, funds can only be sent, never pulled. It turns out that it is really convenient to have funds pulled by trusted programs. It allows funds to be moved when you are not online. For example, you could make an offer to purchase something, and if the seller accepts, the money can be transferred to seller, and the whatever can be transferred to the buyer in the same atomic transaction. This also allows trusted programs to do the math for you using live market conditions.

Lastly, it's a giant security pain to actually have to call someone else's code, and give them the ability to execute right in the middle of the your code, any time code wants to transfer money. (This exact vulnerability lead to the first big hack on Ethereum.)

After a period of experimentation with people making their own money programs, the ERC20 standard was born. This standard is just a very small set of methods calls that a program has respond to in order to count as money. This isn't baked into the OS, it's just a standardized API interface between programs.

So you can call "transfer(...)" to move money, and you can call "balanceOf(...)" to find out how much money someone has etc. It works reasonably well.

The biggest ERC20 you have probably heard of is USDT / Tether. It actualy slightly predates the standardization, and so slightly doesn't match the behavior of everything else. This makes all programs that want to move money have to use a function that checks if the money is acting like USDT or acting like everything else.

Now the ecosystem has two kinds of money: ETH that works at the OS level, and everything else that works as a standard program. And these two have different security properties, and different ways of calling them. It's a pain to securely support both of them because the entire architecture of your code for working with them entirely different. And then there's the matter of not being able to pull ETH, which people often need.

So people decided to make a program that "wrapped" up ETH into and let others treat it as an ERC20 program. It's called wETH. You send the wETH program some ETH, it holds it, and it internally stores that you now have an amount of wETH to match the ETH you sent in. You can then spend it like any ERC20. Anyone can then ask the wETH program reduce the amount of wETH they hold, and give them back a matching amount of ETH.

Most new big blockchain programs, DeFi/NFT/Multichain bridges have switched over to only using ERC20's and requiring users to wrap ETH into wETH to use them. There's even talk/grumbling that the Ethereum blockchain should just provide a special interface allows someone to treat their ETH balance as ERC20.

Re: Did I just lose half a million dollars?

#389

Post by giaour » Sun, Jan 30, 2022, 2:47 PM UTC

capableweb wrote: post #331

zkldi wrote: post #316

Earlier quoted context omitted.

So your definition for "valid action" is just that the eth network lets them do it? They clearly didn't want to burn £500k, and that is now irrecoverable, alongside 260 other people who made the same mistake, on a smart contract that forgoes validation for gas fees. How is this not invalid?

> So your definition for "valid action" is just that the eth network lets them do it? Yes, this is indeed the definition for "valid", that the protocol allows them to do it. It was a valid action, but not the action the user actually wanted to perform. There are two ways of avoiding these scenarios: A) use UIs and don't interact with the protocol without safeguards, as the UI will prevent you from making mistakes (th…

As far as I can tell, no one has argued that transaction validation for this specific smart contract should be built into wallets. You're arguing with a straw man.

The point I see made instead is that the smart contract should not be coded to behave as it does. If a financial product at a retail bank set a pile of cash on fire when you used it incorrectly, regulators would swoop in and make the industry add some safety features, even if that safety came at the cost of convenience.

Re: Did I just lose half a million dollars?

#390

Post by sp332 » Sun, Jan 30, 2022, 2:47 PM UTC

posterboy wrote: post #135

Gigachad wrote: post #59

Earlier quoted context omitted.

265 people made a mistake which deleted their money. How is crypto still so broken at a fundamental level after over a decade of work.

I've lost bills before, forgot to check change, that was all on me.

At least in that case someone actually got the money. In this case there was a valid transaction to a valid address that no one owns and no one can access.