Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

421–430 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#421

Post by thinkmassive »

tornato7 wrote: post #406
tenuousemphasis wrote: post #387

Earlier quoted context omitted.

I think their point is that at some block size, it's no longer feasible for most people to run their own node to verify the blockchain, and you start relying on a client-server model instead of a peer to peer model.

Yes, interestingly with Ethereum it's not the individual block size that's holding it back (they're around 80kb), it's the protected size of all blocks for people running validator nodes. You don't want to require node operators to have 100TB in SSD storage because your blocks all pile up too quickly (this is one of the main concerns about Avalanche scaling).

Part of it IS the individual block size though. Individual blocks might seem small, but there's a lot more of them. Ethereum dApps store a LOT of state directly on the base chain. The other scalability disaster is making every node validate every instruction of a Turing-complete scripting language, which results in insane "gas fees" (or loss of fees when you didn't supply quite enough for the script to fully execute).

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#422

Post by tornato7 »

ChrisLomont wrote: post #234
whatshisface wrote: post #120

Earlier quoted context omitted.

Cryptocurrency theft is illegal and the US government does investigate and prosecute it. [0] https://www.theguardian.com/law/2022/feb/14/us-bitcoin-case-...

Not to anywhere near the extent as they'd investigate and prosecute for $625M stolen from a normal bank.....

Do you have any sources to support that claim? You can see in the link above that a task force worked for years to catch that Bitcoin heist couple.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#423

Post by throw_nbvc1234 »

cecilpl2 wrote: post #312
gowld wrote: post #189

Earlier quoted context omitted.

The increased risk of total loss in the edge case is in exchange for a more efficient system with lower prices in the average case. Individual users should make an informed decision about the tradeoff. See also http://go/hackernews/item?id=30838572 and https://en.wikipedia.org/wiki/Financial_crisis_of_2007%E2%80...

This sounds like an argument for why companies should be allowed to sell unregulated drugs and use asbestos and lead paint. Individual consumers, who we all know are extremely knowledgeable and informed on all topics interacting with their lives, should weigh the increased risk of total loss against generally lower prices. And then in the event they unluck into in the total loss case, they should just shrug their sho…

Companies selling "unregulated drugs" could also mean people getting the covid vaccine in mid 2020 rather then waiting months and months for trials. People could have made that personal choice based on their own situation and risk factors. Also compare the regulation between "drugs" and "supplements" in the USA.

I find it hard to argue that "asbestos and lead paint" are the same kind of individual choice as a bank or unregulated drugs.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#424

Post by rmbyrro »

JumpCrisscross wrote: post #316
tshaddox wrote: post #292

Earlier quoted context omitted.

> The attacker used hacked private keys in order to forge fake withdrawals. > The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO. Easiest explanation: at least one Sky Mavis employee and one Axie Infinity employee who have access to those private keys got together and took all the funds. Perhaps it was only one employee; it's not clear to me what the…

> Easiest explanation: at least one Sky Mavis employee and one Axie Infinity employee who have access to those private keys got together and took all the funds Easier explanation: they were all in a Dropbox or something stupid like that.

Most likely that

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#425

Post by anchpop »

DennisP wrote: post #365
anchpop wrote: post #253

Earlier quoted context omitted.

Right now they're immature, but I'm hopeful that advancements in ZK-tech will allow practical ZK-rollups. ZKSync already has a zk-evm testnet running (which I believe is based on zk-llvm), so we're close. Currently all the big rollups have master keys which can be used to steal all the money deposited by them, but there's no reason in principle they have to have this. Polygon has permissionless rollups, so I'm quite…

The nice thing about zkrollups is that users have a cryptographic guarantee of being able to withdraw their money. The rolled-up transactions are posted on chain in compressed form, and a contract on chain verifies a concise proof that all the rules were followed, including that all transactions had valid signatures. So if this is done correctly, any master keys shouldn't be able to steal user funds. The key holders…

Right. It's possible to conceive of a rollup, particularly a zk-rollup, without anything like a master key. But current rollups do have those keys. ZK-sync for example has two, one used mostly used for upgrading the smart contract that has a 14-day withdrawal delay (or something like that) and one for use in case of emergency that has no withdrawal delay. If the second were compromised, it would lead to all the money stored in the rollup being stolen. But there's no reason in principle that either of these are necessary.

ZK-rollups are awesome because they don't introduce any trust assumptions (except for the master key issue, which is just an implementation detail). The only risk is current zk-rollup designs is that they could censor certain transactions by never including them in a "batch" (the rollup equivalent of a block), but with unpermissioned rollups like the one I think Polygon has even this issue is mitigated

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#426

Post by estro0182 »

DennisP wrote: post #365
anchpop wrote: post #253

Earlier quoted context omitted.

Right now they're immature, but I'm hopeful that advancements in ZK-tech will allow practical ZK-rollups. ZKSync already has a zk-evm testnet running (which I believe is based on zk-llvm), so we're close. Currently all the big rollups have master keys which can be used to steal all the money deposited by them, but there's no reason in principle they have to have this. Polygon has permissionless rollups, so I'm quite…

The nice thing about zkrollups is that users have a cryptographic guarantee of being able to withdraw their money. The rolled-up transactions are posted on chain in compressed form, and a contract on chain verifies a concise proof that all the rules were followed, including that all transactions had valid signatures. So if this is done correctly, any master keys shouldn't be able to steal user funds. The key holders…

>done correctly

This has been the difficult bit for the ecosystem, and I think grasps at what GP is saying. For every competent dev/cryptographer in the space, there are 10(0) who are not because there’s so much money floating around. Those 10(0) may implement zk-class protocols incorrectly and end up in the same situation we see today. There is promise in but a ton of validation/maturation to do for zkrollups in the wild.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#427

Post by rmbyrro »

mabbo wrote: post #47

In a system run by people, the transaction could be reversed, traced, and the culprits eventually brought to justice. In a system run by algorithms, designed to avoid oversight by people (governments), there is no such powers. There's no reversal. There's no checking the name on the account the transfer was to. It's just gone. I do not understand why people who have legal intentions would want to be part of the crypt…

Sure, like this, right? [1]

[1] https://www.fresnobee.com/news/local/article259205608.html

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#428

Post by pchristensen »

xyzzyz wrote: post #206
lolinder wrote: post #142

Earlier quoted context omitted.

That's all well and good when the thieves are in the US or a country that will extradite them. What happens when the thieves are operating out of a country without an extradition treaty? In the regular financial world you can at least reverse the transaction. With crypto, is there anything you can do?

You can't always reverse the transaction in regular financial world. It is typically possible if all parties involved act in good faith, and often possible in other cases too, if you act fast, or the bad faith actor is less than competent. However, this is not always the case. Imagine the following scenario: bank A sends $100M to bank B, which then sends it to bank C. By "reversing" the A->B transaction, all you're d…

Patio11's recent article dives into this more - https://bam.kalzumeus.com/archive/no-payments-are-final/

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#429

Post by narrator »

afpx wrote: post #164
calrain wrote: post #140

Earlier quoted context omitted.

Because there are people in the world who can wake up and have lost all money they had deposited in a bank. There are people who have to pay 20% transfer fees to move money overseas. There are people who don't have the ability to open a bank account. There are people who can lose all their banked money if their government doesn't like them. The first world doesn't have these problems. Crypto is a bigger play than 'ge…

Where in the world is it common to lose all money deposited in a bank? And, why not just create better banks?

In Argentina, in 2002, they took everyone's dollars denominated accounts at the Argentinian banks, converted them to Pesos and devalued the peso by 75%. Everyone in the country now had 1/3 of the money they previously had. The country is arguably still recovering from that theft.

Currently, people who left Ukraine are finding out that their Ukrainian credit cards no longer work. Some people who have bitcoin are still able to use that.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#430

Post by once_inc »

jonathan-adly wrote: post #286
Barrera wrote: post #225

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a c…

1. Can your "blockchain" be validated with regular hardware? 2. Does it use a secure consensus algorithm? 3. Is there a secure side channel through which low-value transactions can flow? The only blockchain with 3 yes is Bitcoin lol.

Indeed. This is why Bitcoin maximalists tend to be set aside as "religious zealots" while their conviction is a direct result of these three answers.
Post reply on HN