Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical Analysis of the Poly Network Hack

rekt.news

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Technical Analysis of the Poly Network Hack

#21

Post by Anunayj »

Gaelan wrote: post #19
capnorange wrote: post #14

Earlier quoted context omitted.

the smart contract has a blacklist flag that can be activated by the Tether, this prevents on-chain transfers. https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c... The USDT will be burned and the USD released to the rightful owner after law/legal approval -- https://twitter.com/paoloardoino/status/1425188386034311168

Wait, so they have the ability to arbitrarily blacklist people from transferring tethers? At this point, is Tether anything other than a weird bank?

Yes, Tether is nothing more than a weird bank. USDT is backed by real currency (or atleast Tether claims so). And is equivalent of the treasury giving you a bill and promising to pay you, just on a pollution causing blockchain

Re: Technical Analysis of the Poly Network Hack

#22

Post by rank0 »

goldenkey wrote: post #5
mschuster91 wrote: post #4

Earlier quoted context omitted.

Money laundering, especially when hundreds of millions of dollars in value are on the line (meaning it's not your sleepy local police office dealing with it, but the best the federal government can offer), is hard in itself - and cashing out in actual physical dollars is even harder . The potential for messing up on the way is simply enormous. Remember Silk Road? Guy got v& because of a stackoverflow post.

Not really. Ethereum has anonymous transfers through zkSnarks in the same spirit as other anon cryptos, except as a contract: https://tornado.cash/ All the hacker would have had to do was do the hack from a secure connection (ie cantenna to free wifi + proxy chaining ..etc.) https://tornado-cash.medium.com/how-to-stay-anonymous-with-t...

1. Tornado is self described as “experimental software.” I would not trust that protocol over a token designed around privacy like xmr. Especially with volume this large, timing attacks become a concern.

2. LE can still catch you on the way out. People are gonna start asking questions when you spend hundreds of millions in crypto.

Re: Technical Analysis of the Poly Network Hack

#23

Post by hamburgerwah »

This doesn't even sound like a hack. The beneficiaries executed the digital contract in way that was explicitly permissible by the contract. It was perhaps contrary to the original intent of the contracts creator but that intent needs to be irrelevant for digital contracts to serve any useful purpose more than just traditional non-digital contracts.

Re: Technical Analysis of the Poly Network Hack

#26

Post by secondaryacct »

Gaelan wrote: post #19
capnorange wrote: post #14

Earlier quoted context omitted.

the smart contract has a blacklist flag that can be activated by the Tether, this prevents on-chain transfers. https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c... The USDT will be burned and the USD released to the rightful owner after law/legal approval -- https://twitter.com/paoloardoino/status/1425188386034311168

Wait, so they have the ability to arbitrarily blacklist people from transferring tethers? At this point, is Tether anything other than a weird bank?

But see how nice having a blacklist is (which you seem to say is the core business of banks, when in fact it is to provide massive amount of capital as loans at a cost or create yield-producing aggregated products - which can work with any currency, crypto or not, and which Tether barely fits the definition of).

I d propose every chain to have a blacklist mechanism, temporary if you want, with a voting mechanism to remove innocents. You cant facebook your way ("we re just a platform") out of financial rules or you ll just end up rewarding thieves while benefitting innocents very little.

Re: Technical Analysis of the Poly Network Hack

#27

Post by secondaryacct »

yonixw wrote: post #18
martinko wrote: post #11

Earlier quoted context omitted.

Don't know about USDC, but USDT almost instantly locked the funds, making them unspendable.

Does this mean they are lost forever? like burning real bills? Or is there a mechanism to repay the original owners?

Code is law, law was obeyed, the original owners dont matter anymore. Currency of the future.

Re: Technical Analysis of the Poly Network Hack

#28

Post by patrickthebold »

hamburgerwah wrote: post #23

This doesn't even sound like a hack. The beneficiaries executed the digital contract in way that was explicitly permissible by the contract. It was perhaps contrary to the original intent of the contracts creator but that intent needs to be irrelevant for digital contracts to serve any useful purpose more than just traditional non-digital contracts.

I agree, I'm not a lawyer but it's not clear to me what laws the hacker broke.

Re: Technical Analysis of the Poly Network Hack

#29

Post by capnorange »

Gaelan wrote: post #19
capnorange wrote: post #14

Earlier quoted context omitted.

the smart contract has a blacklist flag that can be activated by the Tether, this prevents on-chain transfers. https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c... The USDT will be burned and the USD released to the rightful owner after law/legal approval -- https://twitter.com/paoloardoino/status/1425188386034311168

Wait, so they have the ability to arbitrarily blacklist people from transferring tethers? At this point, is Tether anything other than a weird bank?

It is more like a regular bank than anything else. A bank that uses a different transport network.

That's why decentralized stable coins like DAI and others exist :)

Re: Technical Analysis of the Poly Network Hack

#30

Post by nootropicat »

dcolkitt wrote: post #20
nootropicat wrote: post #17

Earlier quoted context omitted.

Wouldn't it be cheaper to replace the method id with byte id? No need to follow solidity abi if nobody but you is going to call the contract.

For sure. The biggest challenge is once you leave Solidity entirely, it's hard to do anything but very simple operations. And actually, I did essentially do what you mentioning for our "gas refund" contracts. Basically another trick to cut gas spend is to use the refund the EVM gives for calling contract self-destruct. You create a bunch of dummy contracts when gas is cheap. Then on your transaction where you're payi…

>The biggest challenge is once you leave Solidity entirely, it's hard to do anything but very simple operations.

You don't have to leave solidity, it could all be done in the fallback/default function, no?

For the rest, you described gas tokens, but self destruct refunds were removed with London so they are all worthless now.

Post reply on HN