11–20 of 156 posts
[flagged]
Personally I’ve worked at both coinbase and a blockchain company called avalanche. I think crypto is scams all the way down.
I appreciate how organized the Consensys guide is laid out. It's pretty easy to read. Trail of Bits has a similar guide that is a little more in-the-weeds technically. It also covers, what we think is, essential background about certain automated analysis techniques like static analysis and how fuzzers work. Check it out! https://secure-contracts.com/
The problem is at least in ecosystems such as Ethereum you have a single line of defense, your smart contract code. And that code is written in a poor language with very little security features.
Worst if something go wrong you can maybe pause, suicide your contract before your money is gone (what goes again the very principle of the platform) or if you are lucky & worked very hard on this you might have the chance to upgrade your contract.
The result is any contract being used seriously need to go through a long & very expensive by one of the few serious company is this field.
For now the Ethereum project have been very focused on solving the scalability & decentralization problem but my guess is without big progresses on the smart contract security & developer experience front no serious actor will ever consider adopting the platform.
Every time I hear about another massive hack on Ethereum, I feel a little bit sad that I didn't specialize in software security. For many years there was huge amounts of free cash just sitting on a table waiting to be taken, a victimless crime (VCs and cryptobros are not victims, everyone is playing the same game). I expect the low-hanging fruit has gone now. And setting up spearfishing attacks to scam teenagers out…
As a dark-hat in the space you'd have a pretty good chance of being caught by chainalysis eventually. Meanwhile there are still hundreds of millions of dollars of bounties available for white-hats who responsibly disclose. The dark-hat hackers who aren't held responsible are likely in either Russia or North Korea
Add to that the fact that many of the hacks are largely legal consequence free due to crypto's famous lack of regulation (by design, lol), the economics are far more skewed towards the black hats over the white hats.
[flagged]
From every lawyer I spoke to about this, this was not a win for Ripple but the SEC. They were found guilty of unregistered offerings to institutional. There's no way that the jury/judge won't take that prior decision into account with the non-institutional tranche. Somehow this was spun as a good thing?
Smart contracts are fundamentally a business technology where money is hosted & manipulated natively on the platform. This is pretty awesome & could be very dirsuptive. The problem is at least in ecosystems such as Ethereum you have a single line of defense, your smart contract code. And that code is written in a poor language with very little security features. Worst if something go wrong you can maybe pause, suicid…
Services like code4rena (https://code4rena.com/) and sherlock (https://www.sherlock.xyz/) make audits a public and competitive process with leaderboards that track the best of the best. Naturally those that rise to the top of these leaderboards tend to end up offering boutique auditing services due to projects wanting audits from the best of the best in the business.
Trust (a pseudo-anonymous auditor's handle) launching Trust Security (https://www.trust-security.xyz/) is a perfect example of someone who turned public contest success into a highly sought after auditing firm. There are other examples, but overall smart contract security is undeniably improving over time.
Earlier quoted context omitted.
As a dark-hat in the space you'd have a pretty good chance of being caught by chainalysis eventually. Meanwhile there are still hundreds of millions of dollars of bounties available for white-hats who responsibly disclose. The dark-hat hackers who aren't held responsible are likely in either Russia or North Korea
At most you are going to make a few thousand, maybe if you're super lucky and skilled, a few tens of thousands of dollars on bug bounties. Compared to the amount of poorly-secured money that was/is in crypto, it is a pittance. Add to that the fact that many of the hacks are largely legal consequence free due to crypto's famous lack of regulation (by design, lol), the economics are far more skewed towards the black ha…
As noted above the firms like chainalysis will continue to uncover and attribute all of the nodes in the graph. If you are taking 100s of thousands or more through fraud the incentives are aligned to see your crimes prosecuted.
Smart contracts are fundamentally a business technology where money is hosted & manipulated natively on the platform. This is pretty awesome & could be very dirsuptive. The problem is at least in ecosystems such as Ethereum you have a single line of defense, your smart contract code. And that code is written in a poor language with very little security features. Worst if something go wrong you can maybe pause, suicid…
Earlier quoted context omitted.
At most you are going to make a few thousand, maybe if you're super lucky and skilled, a few tens of thousands of dollars on bug bounties. Compared to the amount of poorly-secured money that was/is in crypto, it is a pittance. Add to that the fact that many of the hacks are largely legal consequence free due to crypto's famous lack of regulation (by design, lol), the economics are far more skewed towards the black ha…
Doing crime on a system with a perfect immutable record doesn’t seem like a smart play to me. As noted above the firms like chainalysis will continue to uncover and attribute all of the nodes in the graph. If you are taking 100s of thousands or more through fraud the incentives are aligned to see your crimes prosecuted.
Earlier quoted context omitted.
As a dark-hat in the space you'd have a pretty good chance of being caught by chainalysis eventually. Meanwhile there are still hundreds of millions of dollars of bounties available for white-hats who responsibly disclose. The dark-hat hackers who aren't held responsible are likely in either Russia or North Korea
At most you are going to make a few thousand, maybe if you're super lucky and skilled, a few tens of thousands of dollars on bug bounties. Compared to the amount of poorly-secured money that was/is in crypto, it is a pittance. Add to that the fact that many of the hacks are largely legal consequence free due to crypto's famous lack of regulation (by design, lol), the economics are far more skewed towards the black ha…
Seems legit and claims to have made one million in 14 months in bug bounties, although he was #1 on some leaderboard. Based on his blog I think he’s probably one of the best in the world at smart contract security so it’s probably not a realistic goal for most people , but assuming the blogger is honest I think you underestimate the potential for top white hats. Certainly the big black hat hacks are far bigger money but a million is nothing to sneeze at especially for no legal or moral risk.