The bug which lost more than $600M in various cryptocurrencies a few hours ago

#1

Post by edward » Thu, Aug 12, 2021, 8:35 AM UTC

The bug which lost more than $600M in various cryptocurrencies a few hours ago
twitter.com

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#2

Post by irjustin » Thu, Aug 12, 2021, 9:02 AM UTC

Can someone help ELI5 please?

[EDIT] Okay not 5... maybe like 25 but not in crypto tech.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#3

Post by saalweachter » Thu, Aug 12, 2021, 9:05 AM UTC

irjustin wrote: post #2

Can someone help ELI5 please? [EDIT] Okay not 5... maybe like 25 but not in crypto tech.

Smart contracts are actually dumb contracts.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#4

Post by lordnacho » Thu, Aug 12, 2021, 9:09 AM UTC

irjustin wrote: post #2

Can someone help ELI5 please? [EDIT] Okay not 5... maybe like 25 but not in crypto tech.

My quick reading of it: there's this chain of chains that tries to make it possible to interoperate the various blockchains. The way they do it is they have a gatekeeper on each chain that locks up funds on one chain and releases them on another. Someone found a way to replace this gatekeeper with their own version, leading to havoc.

The technical details are fascinating and super complex. And IME comically badly documented.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#5

Post by Clewza313 » Thu, Aug 12, 2021, 9:17 AM UTC

Here's the original thread, as opposed to a random person quoting a random tweet halfway into it:

https://twitter.com/kelvinfichter/status/1425217046636371969

https://threadreaderapp.com/thread/1425217046636371969.html

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#6

Post by im3w1l » Thu, Aug 12, 2021, 9:33 AM UTC

So my understanding of contracts (and particularly cross chain ones) is low. But how likely is the compare-four-bytes-only to be a deliberate weakness? Is this an inside job?

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#7

Post by malthaus » Thu, Aug 12, 2021, 9:37 AM UTC

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward.

At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under the impression this hyped up space learned from the DAO fiasco but i might be wrong.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#8

Post by joelbluminator » Thu, Aug 12, 2021, 9:50 AM UTC

So I'm gonna stick with real currencies but thanks...looks good.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#9

Post by vincnetas » Thu, Aug 12, 2021, 9:52 AM UTC

irjustin wrote: post #2

Can someone help ELI5 please? [EDIT] Okay not 5... maybe like 25 but not in crypto tech.

I would say it was confused deputy attack : https://en.wikipedia.org/wiki/Confused_deputy_problem

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#10

Post by creshal » Thu, Aug 12, 2021, 9:56 AM UTC

im3w1l wrote: post #6

So my understanding of contracts (and particularly cross chain ones) is low. But how likely is the compare-four-bytes-only to be a deliberate weakness? Is this an inside job?

Cynic mode: Putting sighash in things you shouldn't is incredible common cargo culting in cryptobro areas, it's much more likely that the people involved didn't even understand its implications.