Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attacking an Ethereum L2 with Unbridled Optimism

saurik.com

Post reply on HN
Print view View original

151–156 of 156 posts

Re: Attacking an Ethereum L2 with Unbridled Optimism

#151

Post by SilasX »

EGreg wrote: post #149
SilasX wrote: post #17

Earlier quoted context omitted.

Yes! I got burned by Optimism in another way. They tell you to point your applications at etherscan.io for transaction data/history, but then, on November 11 last year, the pushed an update that deletes all transaction history up to that point, which you need for taxes! They swore they'd have the history restored on Etherscan by Nov 18th, but they still haven't. Only recently they pushed a workaround that lets you do…

Wait, what do you mean? I can see all ERC20 transactions in our token (and others) from before Nov 2020

I'm talking about the record on optimistic.etherscan.io, which they tell you to point to as the definitive blockchain for Optimism. I am looking at my transaction history right now, and it does not show any history from then in the human-readable part of the site.

They recently updated it so you can download a CSV with history from before then (but otherwise no interoperability with the interfaces ETH clients expect).

You're probably looking at a client's local cache of transactions (which I have as well), which doesn't help, since they have limited info within a transaction, and depend on you going to (you guessed it) the etherscan endpoints to see the rest.

Re: Attacking an Ethereum L2 with Unbridled Optimism

#152

Post by sizzle »

jkhdigital wrote: post #101
SilasX wrote: post #17

Earlier quoted context omitted.

Yes! I got burned by Optimism in another way. They tell you to point your applications at etherscan.io for transaction data/history, but then, on November 11 last year, the pushed an update that deletes all transaction history up to that point, which you need for taxes! They swore they'd have the history restored on Etherscan by Nov 18th, but they still haven't. Only recently they pushed a workaround that lets you do…

> The crypto tax software, of course, doesn't know what to do with it I’m still trying to calculate proper basis and gains on transactions from 2018… tens of thousands of trades in various complex hedges across 7-8 different exchanges. I just aggregated everything in a single line item on my original return but of course I got audited T_T

Were they on dexes or cexes? If centralized, don’t you get Tex reports? If not centralized, how will they ever know the extent of the trades?

Re: Attacking an Ethereum L2 with Unbridled Optimism

#153

Post by artdigital »

saurik wrote: post #99
artdigital wrote: post #88

Can someone explain this to me? He states that Optimism doesn’t have a native gas token and native currency, and eth balances are implemented using ERC20 tokens with OVM instead of the native balance mechanism However the exploit is using selfdestruct to transfer and create the remaining balance to the target address, effectively creating new tokens out of thin air. > This means that, when a contract self-destructs,…

Would it help if that paragraph had said "10 OETH"'instead of "10 ETH"? (I am going to go change it regardless, as that is probably at least theoretically less confusing; but, like: is that sufficient?)

But selfdestruct only acts on balance held in the native token, if it's balance in ERC20 it wouldn't transfer it to the target account

I still have trouble understanding how this exploit worked

Re: Attacking an Ethereum L2 with Unbridled Optimism

#154

Post by jimmydorry »

rawtxapp wrote: post #133
jimmydorry wrote: post #113

Earlier quoted context omitted.

I thought the routing node was putting up some amount of Bitcoin per channel. Each channel would therefore have a non-zero cost (and each user requires a channel). I would need to go back and refresh my understand as it's been quite a while since I read the LN whitepaper, much less kept abreast of developments in that space.

When you fund a channel, the Bitcoin is still yours, you're not giving it away. With batched channel open/closes, it'll be super cheap to open and close channels. The only cost you'd pay is the opportunity cost if your counterparty isn't sending transactions, so you're not collecting routing fees. If that's the case, you can just close the channel if you need to fund another channel and don't have spare Bitcoin for i…

You've just outlined how the marginal cost that you originaly stated was near zero, is in fact quite a lot larger than zero (you can't open channels without locking up your node's Bitcoin). Also, each channel opening costs a Bitcoin L1 transaction fee (which is a lot larger than $0.01 and can only really grow from here).

Re: Attacking an Ethereum L2 with Unbridled Optimism

#155

Post by yeetard »

artdigital wrote: post #153
saurik wrote: post #99

Earlier quoted context omitted.

Would it help if that paragraph had said "10 OETH"'instead of "10 ETH"? (I am going to go change it regardless, as that is probably at least theoretically less confusing; but, like: is that sufficient?)

But selfdestruct only acts on balance held in the native token, if it's balance in ERC20 it wouldn't transfer it to the target account I still have trouble understanding how this exploit worked

Isn't that the actual bug? That balances are kept at two places? What actually happens in SetBalance() if rcfg.UsingOVM ==true?

So... I guess what it boils down to is 'How does Optimism manage it's state trie'? I'd really enjoy a more in-depth explanation for this.

Re: Attacking an Ethereum L2 with Unbridled Optimism

#156

Post by yeetard »

vmception wrote: post #6
saurik wrote: post #3

Earlier quoted context omitted.

Yeah, so to run your own Optimism full node--the "whole stack"--you need 1) a normal Ethereum full node of some kind, 2) an Optimism data-transport-layer service (which scrapes the L1 looking for L2 transactions and provides a web service to access just that data), and then 3) an Optimism l2geth instance (which is an Ethereum node modified to read its transaction batches from the DTL).

Wow. A tutorial on doing that would be great. Speaking of "bug bounties", I use the term liberally as a euphemism for hacking these contracts and taking everything for yourself under the observation that company/community bug bounty systems are broken and undervalued for the value they provide. Although seen as a euphamism now, I think the term is accurate especially when looking at how bounty was used in the America…

> I use the term liberally as a euphemism for hacking these contracts and taking everything for yourself under the observation that company/community bug bounty systems are broken and undervalued for the value they provide.

hmm...

Post reply on HN