Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attacking an Ethereum L2 with Unbridled Optimism

saurik.com

Post reply on HN
Print view View original

121–130 of 156 posts

Re: Attacking an Ethereum L2 with Unbridled Optimism

#121

Post by baby »

Ar-Curunir wrote: post #107
baby wrote: post #102

Earlier quoted context omitted.

I just spent 20min to look for that debate between some of the big players: * the optimistic side: https://medium.com/offchainlabs/optimistic-rollups-the-prese... * the zk side: https://blog.polygon.technology/zk-and-the-future-of-ethereu... On one hand you have a complicated protocol that doesn't really use cryptography and that has the user (you) monitor the blockchain for a week to make sure their transfer was pro…

As a zkSNARK cryptographer, efficient cryptographic proofs are incredibly complex pieces of technology that still have a ways to go before they can match the speed of native execution. Both approaches have pros and cons.

Good thing we’re not competing with native execution, and instead with the slow ethereum computer.

Re: Attacking an Ethereum L2 with Unbridled Optimism

#122

Post by 8note »

jeffalbertson wrote: post #39
SubiculumCode wrote: post #19

Earlier quoted context omitted.

Same with Polygon their Ethereum L2+Sidechaining scaling solutions. Polygon is quickly building a reputation for solid secure code, mostly because their team kicks ass and is proactive.

I mean they just disclosed a 1.6mil hack 40days ago. I like polygon and unfortunately feel like hacks/stolen funds are part of the maturing process for blockchain projects but im not yet ready to say they are building a reputation for solid secure code.

I think it's worth noting that that was an exploit as opposed to a hack or a scam.

In this case, the code securely gave the money to people in a way the owners didn't expect

Re: Attacking an Ethereum L2 with Unbridled Optimism

#123

Post by mattdesl »

rvz wrote: post #110
iskander wrote: post #75

Earlier quoted context omitted.

Infura is a single RPC endpoint, the underlying network it talks with has 5k-6k clients: https://www.ethernodes.org/?synced=1 You can choose one of ~20 different free RPC endpoints: https://ethereumnodes.com/ This doesn't include private or paid RPCs or just running your own.

Well on the same site ethernodes.org, the majority of Ethereum nodes are running on AWS at 45% [0]. Due to this announcement from AWS [1], it is going to become even more centralized. So the claim of 'extremely decentralized network' is somewhat of a myth and a falsehood. [0] https://ethernodes.org/networkType/Hosting [1] https://aws.amazon.com/about-aws/whats-new/2021/03/announcin...

Correction: according to your link, only 28% of Eth nodes are running on AWS (1579 of 5632 - click "Network Types").

However, many of these are not mining nodes that secure the network (and therefore security of the blockchain), but instead are nodes run by dApp/web3 developers to handle things like indexing NFTs and the current state inside a smart contract.[1] It is easy to spin up a geth node for a task like this—and by default mining is not enabled. I haven't seen any stats on the total number of mining nodes and their network types.

I agree that too much of the traffic is going through AWS, and I suspect all of these stats will need to be re-examined after the PoS Merge.

[1] https://www.reddit.com/r/ethereum/comments/ksdu11/how_can_et...

Re: Attacking an Ethereum L2 with Unbridled Optimism

#124

Post by 8note »

vmception wrote: post #15
saurik wrote: post #8

Earlier quoted context omitted.

> ...because many people still don't understand that this is analogous and convertible to money in your bank account especially at these convenient amounts... FWIW this project doesn't have its own token (this L2 uses ETH as its currency just like the base layer), so the bug bounty payout is denominated in actual USD.

Whether they paid in ETH priced in USD, or a stablecoin, or a USD wire to your bank account, many people aren't aware that getting paid in this space is that lucrative and that liquid and that simple.

The Dan olsen analysis is very clear about how lucrative and liquid it is, and where those come from. Ethics wise, that liquidity comes from the scams and you're part and parcel to them by participating

Re: Attacking an Ethereum L2 with Unbridled Optimism

#125

Post by lhl »

iskander wrote: post #5

This is a concerning aspect of Ethereum's strategy to push scaling to layer-2 networks: Ethereum is a heavily audited and tested protocol that runs an extremely decentralized network of diverse clients. L2s can be...an AWS instance running arbitrary buggy code. Much of the confidence in the "base layer" that people using Ethereum currently experience will be significantly undermined if mundane transactions wend in an…

For those interested in the specific risks of various L2s as they stand, L2Beat has the best overview: https://l2beat.com/?view=risk

While the various L2s are all pretty bleeding edge, the current state/alternative [1] is that a majority of the TVL is being bridged to alternate L1s, where the bridges are also extreme weaknesses [2]. There was the recent $320M Wormhole hack [3], the last record white-hat payout ($2M bounty on $850M at risk with the Polygon Bridge) [4][5], and $2.2B sits on Avalanche's Bridge [6] which is an EOA that is secured by literally 4 SGX machines. [7]

[1] https://defillama.com/chains

[2] https://old.reddit.com/r/ethereum/comments/rwojtk/ama_we_are...

[3] https://wormholecrypto.medium.com/wormhole-incident-report-0...

[4] https://medium.com/immunefi/polygon-double-spend-bug-fix-pos...

[5] https://gerhard-wagner.medium.com/double-spending-bug-in-pol...

[6] https://app.uniwhales.io/avalanche/bridge-tracker

[7] https://medium.com/avalancheavax/avalanche-bridge-secure-cro...

Re: Attacking an Ethereum L2 with Unbridled Optimism

#126

Post by yokem55 »

rvz wrote: post #110
iskander wrote: post #75

Earlier quoted context omitted.

Infura is a single RPC endpoint, the underlying network it talks with has 5k-6k clients: https://www.ethernodes.org/?synced=1 You can choose one of ~20 different free RPC endpoints: https://ethereumnodes.com/ This doesn't include private or paid RPCs or just running your own.

Well on the same site ethernodes.org, the majority of Ethereum nodes are running on AWS at 45% [0]. Due to this announcement from AWS [1], it is going to become even more centralized. So the claim of 'extremely decentralized network' is somewhat of a myth and a falsehood. [0] https://ethernodes.org/networkType/Hosting [1] https://aws.amazon.com/about-aws/whats-new/2021/03/announcin...

Ethernodes is known to be inaccurate [0] and is missing a lot of nodes because they can't index nodes that are maxed out on peers or are behind NAT and can't accept incoming connections from nodes they haven't connected to first. I know this for a fact because my own personal node (been online for over a year now) is not indexed on ethernodes, nor are 70% of the peers my node has. Only 2 out of my 15 peers are AWS IP addresses.

As a general rule - its very difficult to get anything close to an authoritative census of a decentralized peer to peer protocol.

[0] https://nttr.stream/peter_szilagyi/status/146057566700382617...

Re: Attacking an Ethereum L2 with Unbridled Optimism

#127

Post by lhl »

sophrocyne wrote: post #50
teempai wrote: post #46

Earlier quoted context omitted.

Ethereum actually has almost no client diversity. The vast majority of nodes run the geth client (go). Regarding the security aspects of L2s: they will of course not be anywhere near as robust as ethereum itself, but over time they’ll get better. However, they also don’t need to be as robust as ethereum given they effectively benchmark against the ethereum chain so while things could go wrong, the amount of damage wi…

For those interested in data supporting diversity comment (~82% geth) - https://www.ethernodes.org/ Re: GP comment - From a "trust" perspective, there is a distinct difference to call out between the integrity of data on the platform, and the trustworthiness of the platform itself (i.e., the ability for centralized control of all data) In an instance where an L2 is compromised, the potential impact is limited to the…

execution node (ETH 1.0) diversity is important, but actually more important moving forward is the consensus (beacon chain, fka Ethereum 2.0) diversity. The crawled data here shows that Prysm has almost 2/3s of that: https://migalabs.es/crawler/dashboard

For a good recent/up-to-date summary of the differences, why it matters: https://ethereum.org/ms/developers/docs/nodes-and-clients/cl...

And here's a good reference site as well promoting better client diversity before the merge: https://clientdiversity.org/

Re: Attacking an Ethereum L2 with Unbridled Optimism

#128

Post by lhl »

rawtxapp wrote: post #57
kristofferR wrote: post #55

Earlier quoted context omitted.

The discussion here used to be way more thoughtful, it's only been bad the last year or so. I think the degradation of crypto discourse here was mostly a knee-jerk reaction to NFTs. "NFTs are stupid, so all crypto is stupid, because NFTs are crypto" - that was likely the thought process behind all the toxicity seen here.

I would disagree, in my experience HN has been pretty anti-crypto for a long time, starting with Bitcoin's announcement thread [1]. Personally, I think people are just tired, as a proponent I'm tired of arguing the same stuff over and over again, I can imagine the other side of that too. At this point, time will decide who's right and wrong, I think that what anyone of us thinks doesn't really matter in the grand sch…

Over the past few years, my personal experience/perception is there's been less and less people with a technical grounding in crypto/blockchain who bother to engage on HN (on CT, it's often dismissively referenced as "the orange site") because not only is there such a strong anti-crypto attitude, but usually it's based on pretty shallow or often wrong comprehension of the tech/mechanisms.

I agree that it's pretty pointless to argue though. Even when blatant misinformation gets cleared up, or clear examples of how the tech is actually being used are outlined, most of the conversations then end up at "well, I don't see the value of it so it still must be useless." ¯\_(ツ)_/¯

Re: Attacking an Ethereum L2 with Unbridled Optimism

#129

Post by sophrocyne »

8note wrote: post #118
sophrocyne wrote: post #81

Earlier quoted context omitted.

This turned out to be longer than I intended. Apologies. I view Ethereum as a value network, connecting disparate sets of transactional use cases around a set of core services (like Address, asset records, and transaction functions) To believe that blockchain makes sense for assets which do not require absolute integrity, you'd need to first accept that there are valuable use cases which having an asset management &…

This does a good job of answering what kinds of transactions you don't care about, but not why you want them to be on a block chain. The usecase given agregating those assets by the wallet has two problems: 1. You can have many wallets 2. Not everything associated with the wallet has to have it's transactions tracked on a block chain All you need is one more column in the wow database, and you can pull up your wow as…

I suppose that’s fair. You could theoretically argue for some “integration” between an off-chain centralized database and on-chain wallet - but unless it were just an untrusted pointer, there would need to be some asset managed from a contract to serve as a “proof” of sorts.

If you’re questioning why people would prefer on-chain vs off-chain games, I wager there’s something appealing about the “decentralized” nature of the system that attracts people to on-chain games - and I put decentralized in quotes because it’s not always certain that’s a promise always delivered on, but it’s where the appeal is derived from.

Regarding your other notes - 1. Same theory applies though. One wallet is often seen as a primary wallet (hot) that manages public facing assets - e.g., registered ENS domain, an NFT, etc. 2. It’s certainly not required that all associations live on chain, but if you want core services and verification of ownership, it’s mostly on/chain or bust.

Re: Attacking an Ethereum L2 with Unbridled Optimism

#130

Post by sophrocyne »

iskander wrote: post #72
sophrocyne wrote: post #50

Earlier quoted context omitted.

For those interested in data supporting diversity comment (~82% geth) - https://www.ethernodes.org/ Re: GP comment - From a "trust" perspective, there is a distinct difference to call out between the integrity of data on the platform, and the trustworthiness of the platform itself (i.e., the ability for centralized control of all data) In an instance where an L2 is compromised, the potential impact is limited to the…

>In an instance where an L2 is compromised, the potential impact is limited to the integrity of data that individual L2 was contributing to the overall platform. I think distinction is only meaningful as long as L2s remain a niche curiosity while the majority of transaction volume resides on L1. If the L2 plan succeeds and almost all volume passes through an L2 and one of the major L2s has a bug like in this post, th…

Certainly a possibility, but this is one reason I’d be inclined to believe there will be some significant demand for direct L1 transactions, and a diverse set of L2 layers.
Post reply on HN