Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did I just lose half a million dollars?

reddit.com

Post reply on HN
Print view View original

681–690 of 837 posts

Re: Did I just lose half a million dollars?

#681

Post by rosndo »

user-the-name wrote: post #666
rosndo wrote: post #96

Earlier quoted context omitted.

How is it a bad example? Not everyone uses IBANs. And besides, big banks still have to deal with checksum-passing iban typos on a daily basis. IBANs only have two check digits.

> And besides, big banks still have to deal with checksum-passing iban typos on a daily basis. That's the thing - they can deal with it. There are fallbacks. In crypto, your money is just instantly destroyed.

You’re mistaken, they usually can’t deal with it.

They’ll ask the other bank if they’d like to return the money, and that bank will maybe ask the recipient if they’d like to return the money.

The recipient doesn’t want to return the money? You’re SOL. You can go to court, but they can trivially evade civil action by transferring the money overseas.

Re: Did I just lose half a million dollars?

#682

Post by omegalulw »

NelsonMinar wrote: post #383
capableweb wrote: post #228

Since no one seems to think about how this could have prevented, here is a simple way, which I've applied to lots of things in life, not just cryptocurrency transfers: - If you're making a transfer somewhere with a large amount, do a small transfer first and verify it's working. Confirm at the receiving end before moving big sums. - If you're calling a contract, try it with a small amount first. Verify the parameters…

Simpler way: use real financial instruments. Traditional financial systems have had solutions for errors like this for centuries.

Lol verifying with small amounts takes like 5 extra minutes, messing up and having to jump through hoops to fix your errors will take days, especially if you do it on weekends or holidays. And they may not be reversible easily, e.g. IIRC one bank accidently paid off the loan of one of their boderline-default customers to another bank and then couldnt get the money back.

Re: Did I just lose half a million dollars?

#683

Post by rich_sasha »

TheFreim wrote: post #584
CJefferson wrote: post #440

Earlier quoted context omitted.

If I tried to buy "Applr" instead of "Apple", then either: a) There is a company called "Applr", so I at least have something (a different stock) b) There is no comany called "Applr", so the trade is cancelled. This is like saying "You tried to be Applr, that doesn't exist, so you money just got blackholed".

> There is no comany called "Applr", so the trade is cancelled. I'm surprised there hasn't been something like this developed in the cryptocurrency space yet. Some sort of system where creating a wallet requires initialization before it can receive anything. Something like that would prevent most problems of typing in the wrong address because it would not be initialized.

These exist in some smart contracts.

The problem is that executing a line of code on chain is really expensive. Already quite optimised and stripped back code can cost 50-100 USD equivalent to do something fairly trivial, like swap one token for another.

Each of these checks increases the already high barrier to entry, and has little utility for the creators.

Re: Did I just lose half a million dollars?

#684

Post by mattdesl »

Adrox wrote: post #628
mattdesl wrote: post #183

Earlier quoted context omitted.

Interacting with a contract by sending it tokens (and having no idea what the outcome will be) is about as risky behaviour as you can imagine, and is quite a lot like using a low level API to circumvent the guardrails put in place by typical payment processors. Certainly client and wallet UX can be dramatically improved to mitigate these problems. And education more generally about the risks of interacting with smart…

So, you don’t recomend MetaMask to send tokens? Which wallets/services would you recomend to avoid this situation? Would binance not allow me to send WETH to that wallet? Would any decentralized/centralized wallet be safer? Please tell me which? Or should I not be sending tokens and just use coinbase and binance non-centralized features?

MetaMask is a wallet, the whole purpose is to send tokens (or to interact with a contract). All wallets basically enable this (ability to send tokens to any address in the network). Sending your tokens to a contract or invoking its methods without understanding what you are doing is extremely risky.

MetaMask also includes a "Swap" feature which is designed solely to swap one token (e.g. ETH) to another (e.g. WETH) and back. Others might suggest an exchange application such as Uniswap or OpenSea to wrap/unwrap.

MetaMask and other user-friendly wallets could take basic steps to recognize common patterns of mistakes (like sending tokens to a popular contract) and include additional warnings. Obviously there is still a huge risk to using crypto compared to just going to your bank and asking them to do financial transactions for you.

Re: Did I just lose half a million dollars?

#685

Post by thiagobbt »

throwawaysea wrote: post #343
ssiddharth wrote: post #5

In case you’re wondering what happened, from the thread: He sent ETH to the WETH contract, received WETH as expected. Then he wanted to do the reverse and sent WETH, but will not receive anything, because you're supposed to swap your WETH to ETH in exchanges like Uniswap, or call the "withdraw" function in the contract. For contracts that want to only work with ERC-20 tokens, you use WETH, which comes from a contract…

Can someone explain this in plain English for a newbie that isn’t familiar with these complicated crypto technologies?

Imagine there's a machine that you can deposit dollar bills and it registers in an internal database how much you have. The machine calls these stored values as wrapped dollar. You can withdraw your wrapped dollars back as dollar bills whenever you want.

This machine also allows you to send these wrapped dollars to other people - it just subtracts from your balance and adds to the other person's.

What this guy did is transferring his wrapped dollars to an address no one controls instead of withdrawing as he should. This address was the machine's address, but it's not programmed to handle the balance in it's own account and it runs code that can't be upgraded, so any values sent there are lost.

In this example dollar = ETH, wrapped dollar = WETH, machine = the WETH smart contract.

The real problem here was thinking a ETH transfer (dollar bill deposit in the example) works the same as a WETH transfer (database transaction in the example).

Re: Did I just lose half a million dollars?

#686

Post by [deleted] »

proto-n wrote: post #194
yumraj wrote: post #103

I understand ETH, but WTF is WETH?

Eth is the native token, WETH is an ERC20 token (token creted by a contract implementing the ERC20 interface). Many applications don't want to handle these separately, so they only accept ERC20 tokens. WETH is Eth wrapped in a token contract (can be warpped or unwrapped 1:1). Think of it as similar to Java's int vs Integer.

[deleted]

Re: Did I just lose half a million dollars?

#687

Post by SilasX »

asdfasgasdgasdg wrote: post #678
SilasX wrote: post #664

Earlier quoted context omitted.

Really? Access to the legal system doesn’t vary based on how pleb you are?

Normally you do not have to actually directly interact with the legal system to reverse a fraudulent bank transaction. The banks have internal policies to comply with the legal system, because the other outcome is more expensive for them.

Um, what? I did. Banks didn’t do anything when I got defrauded by wire except tell me they can’t do anything.

Re: Did I just lose half a million dollars?

#688

Post by guiambros »

fsh wrote: post #69
ssiddharth wrote: post #5

In case you’re wondering what happened, from the thread: He sent ETH to the WETH contract, received WETH as expected. Then he wanted to do the reverse and sent WETH, but will not receive anything, because you're supposed to swap your WETH to ETH in exchanges like Uniswap, or call the "withdraw" function in the contract. For contracts that want to only work with ERC-20 tokens, you use WETH, which comes from a contract…

I still don't get WETH. What is the purpose of exchanging ETH, which is a token on the Ethereum blockchain, for WETH, which is also a token on the Ethereum blockchain (with the same nominal value)?

ERC-20 is a token standard [1] that lives on top of Ethereum blockchain. It defines the API that any contract running on ethereum must implement in order to be considered ERC-20 compatible - e.g., transfer(), approve(), and so on. This is what gives tokens composability, and allow DeFi applications to build on top of each other.

As ERC-20 runs on top of ETH, it requires gas (paid in ETH) to execute the contract. But ETH itself is not ERC-20 compatible (after all, it's just the base layer; there's no "ETH contract"), so some folks came up with the idea of wrapping ETH into an ERC-20-compatible contract, thus giving birth to WETH.

The advantage is that now ETH (in the form of WETH) can now provide interoperability with the rest of the standardized tokens, including staking, lending, or anything else implemented via a contract. Pure non-wrapped ETH would never give you that; basically you can send your ETH to someone, and that's it.

Now, the weak link is that you're relying on the trustworthiness and the quality of the implementation of the contract, which - more often than not - is questionable. The WETH contract itself is pretty simple, with only 62 lines of code [3]. But one may argue it's overly simplistic, and they failed to implement basic safeguards, like sending WETH to itself, which is what caused OP to lose half a million dollars.

The other side of the argument is that WETh contract was simple by design. Every line of code in Solidity requires gas to execute, so adding even a basic checking to protect against what OP did would have increased the cost by millions of dollars in aggregate fees for everyone else, besides potentially introducing the risk of attacks or additional bugs.

Given that only ~250 WETH transactions[4] (out of 5,562,041 total tx), made the mistake OP did, one could argue that the design wasn't that bad. That's a 99.9955% success rate.

(to be clear: if I were the original WETH developer, I would have added the checking, in spite of costing a few additional bucks for everyone else. But I understand why someone may have thought otherwise. Besides, it was 2017; a lot has changed since then)

[1] https://ethereum.org/en/developers/docs/standards/tokens/erc...

[2] https://www.investopedia.com/news/what-erc20-and-what-does-i...

[3] https://etherscan.io/address/0xc02aaa39b223fe8d0a0e5c4f27ead...

[4] Mentioned in the reddit thread; have not confirmed myself.

Re: Did I just lose half a million dollars?

#689

Post by Sargos »

jasfi wrote: post #348

This is why people say the UI for crypto/Web 3 sucks.

This wasn't really a UI problem as this was someone manually calling functions meant only for software developers. No users would ever do this as they are using apps which abstract all of this away and you have to jump through a lot of hoops to get into this situation. Anyone can hurt themselves using tools they don't understand carelessly.

Re: Did I just lose half a million dollars?

#690

Post by birracerveza »

hughrr wrote: post #26
ssiddharth wrote: post #5

In case you’re wondering what happened, from the thread: He sent ETH to the WETH contract, received WETH as expected. Then he wanted to do the reverse and sent WETH, but will not receive anything, because you're supposed to swap your WETH to ETH in exchanges like Uniswap, or call the "withdraw" function in the contract. For contracts that want to only work with ERC-20 tokens, you use WETH, which comes from a contract…

The problem with crypto is despite your explanation, I have no idea what any of your post means. Not any of it.

How is you being unable (or unwilling) to understand an explanation of a domain you're unfamiliar with a problem with crypto?
Post reply on HN