Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White hat hacker awarded $2M for fixing ETH-creation bug

cryptoadventure.com

Post reply on HN
Print view View original

221–230 of 354 posts

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#221

Post by SilasX »

pshc wrote: post #203
SilasX wrote: post #100

Earlier quoted context omitted.

But you could drain out all the ETH in the Optimism reserve by asking to withdraw, since you've fooled the network into thinking you own an arbitrary amount of OETH? Which would keep working until the main L1 Eth network rejects transactions for transferring ETH it doesn't have?

The folks at Optimism would certainly hit the pause button on that withdrawal before it escaped, if there aren't already limits and automatic controls in place. It takes 7 days to withdraw L2->L1 via the standard bridge. (They have administrative controls for now during development, at some point they're supposed to turn it completely permissionless...)

You don't have to use the standard bridge though; I've withdrawn in less than five minutes using the Hop bridge/network, which I think just involves an additional fee to a middleman (my L1 transaction for it shows it spending ~0.02 ETH). I can't speak to what additional checks that protocol may have that would have prevented conversion of excess OETH though. Here's the FAQ for it:

https://help.hop.exchange/hc/en-us/sections/4405172442509-FA...

Edit: O...kay? Apparently the parent of this comment is aware of alternate, much-faster ways of withdrawing L2->L1, and what their constraints are, but still elected to leave those out and imply the one-week lag was a binding constraint?

(Would have posted as a reply, but my comment rate is getting throttled for some reason.)

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#222

Post by easrng »

devoutsalsa wrote: post #178
saurik wrote: post #164

Earlier quoted context omitted.

The bounty amount was denominated in USD and is being paid in USDC (a stable coin, which is means it is intended to map effectively 1:1 with--in this case--USD).

At the moment, USDC is the only stable coin I’m comfortable holding. Are there are any other stable coins that are like backed by hard assets?

IIRC USDP (Formerly PAX) is audited and completely backed.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#223

Post by offmycloud »

flatiron wrote: post #62
stepanhruda wrote: post #52

Earlier quoted context omitted.

Don’t forget about taxes. Most of it is getting taxed at least 37%

Not on capital gains. At least in the US that’s only taxed at 15% with no tiering. The deck is stacked for the investment class

If this is a reward or payment for services, it is taxed as regular income, not as an investment. The FICA tax (SS/Medicare) will either be payed by the payer (shown on W-2) or the payee as self-employment tax when filing a Schedule C.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#224

Post by vmception »

colesantiago wrote: post #49

This just proves how insecure the blockchain / web3 / cryptocurrency space is. It's good to see white hat hackers in this space trying to fix what is already broken. But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid.

It just proves that particular project had an exploit and a decent bug bounty program. Its nice that this person used the bug bounty program.

Other organization bounties should go higher. Especially Web2 ones.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#225

Post by pshc »

SilasX wrote: post #221
pshc wrote: post #203

Earlier quoted context omitted.

The folks at Optimism would certainly hit the pause button on that withdrawal before it escaped, if there aren't already limits and automatic controls in place. It takes 7 days to withdraw L2->L1 via the standard bridge. (They have administrative controls for now during development, at some point they're supposed to turn it completely permissionless...)

You don't have to use the standard bridge though; I've withdrawn in less than five minutes using the Hop bridge/network, which I think just involves an additional fee to a middleman (my L1 transaction for it shows it spending ~0.02 ETH). I can't speak to what additional checks that protocol may have that would have prevented conversion of excess OETH though. Here's the FAQ for it: https://help.hop.exchange/hc/en-us/s…

I've used Hop too. Transfers are naturally limited to however much liquidity Hop has, though.

Edit: Sorry for being disingenuous and unnecessarily curt in my reply. I didn't mean to. I'm in some kind of weird zombie mode this morning.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#226

Post by vmception »

pshc wrote: post #198
pg5 wrote: post #101

Earlier quoted context omitted.

Helium has practical uses - a cheaper alternative to cellular data for stuff like Lime scooters.

I was looking into Helium yesterday due to news coverage. "Proof of coverage" is a bunch of hot air, sorry. It's not resistant to Sybil attacks and GPS location is easily forged. Seems like a scheme to push hardware units that will topple once the token value runs out.

Sort of, Helium no longer sells hardware and the community votes on third party manufacturers to be approved for authorization on the Helium network. This has helped distributed hardware delivery more than any single organization was prepared to do, with the semiconductor and supply chain issues.

There is definitely an opportunity to sell overpriced hardware into the community then.

There are some other antenna-blockchain systems out there that look more like "schemes to sell hardware", such as Match X. There is a big and burgeoning market for these "passive income" things, people install hardware to earn a cryptocurrency.

It is definitely worthwhile to sell the hardware if you can.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#227

Post by vmception »

colesantiago wrote: post #130
pg5 wrote: post #101

Earlier quoted context omitted.

Helium has practical uses - a cheaper alternative to cellular data for stuff like Lime scooters.

This can be done without the need for a blockchain. Adding a new technology + blockchain + a coin still makes it ponzi scheme scam, even worse when the price of this coin comes crashing down.

Nobody wants a corporatecurrency

And there is no human coordination mechanism without the freely convertible currency

Blockchains provide the open source rails of all the account management and distribution, easing development costs. The infrastructure is already built compared to alternate ways of attempting to do this

have fun doing that without a blockchain

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#228

Post by ThrustVectoring »

everfree wrote: post #202

The title isn't really accurate. It wasn't a bug to create ETH, it was a bug to steal ETH from the Optimism contract.

That's not exactly accurate either - if I understand the situation correctly, it's a bug that allows counterfeiting of the contract's outputs. This could be a higher magnitude event if the counterfeiters could generate more purported liabilities than the contract can cover.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#230

Post by vmception »

colesantiago wrote: post #205
kristofferR wrote: post #181

Earlier quoted context omitted.

Why would individuals buy relatively expensive equipment, set it up and manage it, without the potential for return on their investments? The only reason Helium's LoRaWAN coverage is expanding rapidly is due to the crypto aspects of it.

So basically a ponzi scheme that is expensive to join with guaranteed diminishing returns in mining. If I would like to lose my money in style this would be it.

> If I would like to lose my money in style this would be it.

Well get in line, the backlog for receiving hotspots across all distributors is 6-9 months long.

Post reply on HN