Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White hat hacker awarded $2M for fixing ETH-creation bug

cryptoadventure.com

Post reply on HN
Print view View original

291–300 of 354 posts

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#291

Post by saurik »

vdalal wrote: post #289
saurik wrote: post #3

Prior discussion of this incident (and the $2M bounty) here on Hacker News: https://news.ycombinator.com/item?id=30289240 My (I'm the hacker) article / post-mortem this blog post is referring to: https://www.saurik.com/optimism.html At the time of this last getting traction a few days ago, some people were sad that the title of my article and the discussion that resulted focused more on the bug instead of the bounty…

Wow, what a find. And save. Very well deserved reward too. Wondering (some of it aloud), how long was the vulnerability present in the code? Is it possible to know if someone was actually using this exploit to mint OETH's? How would a disconnect of this sort show up? Regular reconciliation (hourly, daily) or perhaps there are other methods.

It existed since November. It is not only possible but I did such a search (and found one such transaction, from a developer at Etherscan, who had seemingly noticed something awkward but not realized it was broken). Search my post-morten for "etherscan" and it should come up!

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#292

Post by [deleted] »

saurik wrote: post #213
saurik wrote: post #3

Prior discussion of this incident (and the $2M bounty) here on Hacker News: https://news.ycombinator.com/item?id=30289240 My (I'm the hacker) article / post-mortem this blog post is referring to: https://www.saurik.com/optimism.html At the time of this last getting traction a few days ago, some people were sad that the title of my article and the discussion that resulted focused more on the bug instead of the bounty…

So, while I knew that this had been offered in back channels, I failed to realize that this was not only confirmed to me in e-mail as well as publicly announced: Boba (one of the forks of Optimism that was affected by this same bug) has additionally extended to me their maximum bug bounty reward of $100k, making the "updated total" awarded for this bug (so far ;P) $2,100,042 (which more firmly might be setting a new…

[deleted]

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#293

Post by Consultant32452 »

sillysaurusx wrote: post #40
jacquesm wrote: post #34

Earlier quoted context omitted.

I strongly disagree with that. You really can't claim to speak for everybody.

If you don’t play ball in certain parts of the world, you end up in a river. The price tag is just different. Yours would likely be family or close relatives. I think you’d take money to do something untoward if that was the alternative. Almost everybody would. And there’s nothing wrong with admitting that.

People choose the river regularly.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#294

Post by SparkyMcUnicorn »

jollybean wrote: post #283
VectorLock wrote: post #264

Earlier quoted context omitted.

Ethereum has forked to roll-back hacks in the past, likely for something as big as making ETH from thin air they'd do the same with even less hesitation.

Yes, and they can do it for whatever reason they want. One might argue therefore that ETH is centrally controlled, and with considerably less oversight and reasonable oversight than, for example, most central banks.

Anyone can fork ETH, and a fork is only successful if there's consensus.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#295

Post by heliodor »

toolz wrote: post #137
odonnellryan wrote: post #126

Earlier quoted context omitted.

No. People buy lottery tickets for a lot of reasons. It is a fun bit of escapism and entertainment that costs just a few dollars. You're making the assumption that everyone plays the lottery because they think it is a smart financial decision.

I don't assume nor do I have to assume anything about someones intent to know that gambling is stupid. Entertainment can be had in so many forms today that even the poorest of the poor in developed countries can have choice paralysis from having so many options. Gambling is a stupid waste of resources, if you enjoy doing stupid things I have no moral/ethical qualms with your choices, but it's still stupid.

Gambling is not a waste of resources. It is a transfer of resources from one entity to another. It's a zero-sum game.

On an individual level, gambling is roughly breaking even in the long run (say, 95% retention of the resources).

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#296

Post by dragonwriter »

heliodor wrote: post #295
toolz wrote: post #137

Earlier quoted context omitted.

I don't assume nor do I have to assume anything about someones intent to know that gambling is stupid. Entertainment can be had in so many forms today that even the poorest of the poor in developed countries can have choice paralysis from having so many options. Gambling is a stupid waste of resources, if you enjoy doing stupid things I have no moral/ethical qualms with your choices, but it's still stupid.

Gambling is not a waste of resources. It is a transfer of resources from one entity to another. It's a zero-sum game. On an individual level, gambling is roughly breaking even in the long run (say, 95% retention of the resources).

> Gambling is not a waste of resources.

Yes, it is.

> It is a transfer of resources from one entity to another. It's a zero-sum game.

All real gambling consumes as well as transfers resources, and is, therefore, negative sum.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#297

Post by paulpauper »

jack_pp wrote: post #274
saurik wrote: post #42

Earlier quoted context omitted.

I do not expect to make any major expensive lifestyle changes as a result of having more money (and to the extent to which I have already been being paid better recently due to working on Orchid, I have only barely done so and usually only quite temporarily), which I realize disappoints some people who had wanted me to post a concrete picture of something expensive I purchase to help motivate others to reach for bug…

You can buy a very nice car that might even appreciate in value so you get to have your cake and eat it too, I recommend you do research on this.

maybe you can even download one too. I would do even more research into this.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#298

Post by paulpauper »

stepanhruda wrote: post #52
sillysaurusx wrote: post #31

Earlier quoted context omitted.

So how many lambos are you buying? More seriously, will you keep it in the bank and extract $100k a year the rest of your life? What are you going to do?

Don’t forget about taxes. Most of it is getting taxed at least 37%

have it paid to a corp he sets up, and the the corp pays it as dividends

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#299

Post by SEJeff »

saurik wrote: post #3

Prior discussion of this incident (and the $2M bounty) here on Hacker News: https://news.ycombinator.com/item?id=30289240 My (I'm the hacker) article / post-mortem this blog post is referring to: https://www.saurik.com/optimism.html At the time of this last getting traction a few days ago, some people were sad that the title of my article and the discussion that resulted focused more on the bug instead of the bounty…

$10m for wormhole and another dao project (if you succeed obviously):

https://immunefi.com/bounty/wormhole/

Good job btw.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#300

Post by xwolfi »

aaaaaaaaata wrote: post #8
secondaryacct wrote: post #4

Earlier quoted context omitted.

But you should have sat on it, laundered it through FBI honeypots and then made a rap album about it !! What have you done telling them about it :D

Is this the reference? https://www.youtube.com/watch?v=SSHrpYeyYV8

No this is: https://www.youtube.com/watch?v=7jlSHGAem6g !!
Post reply on HN