Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical Analysis of the Poly Network Hack

rekt.news

Post reply on HN
Print view View original

31–35 of 35 posts

Re: Technical Analysis of the Poly Network Hack

#31

Post by dcolkitt »

nootropicat wrote: post #30
dcolkitt wrote: post #20

Earlier quoted context omitted.

For sure. The biggest challenge is once you leave Solidity entirely, it's hard to do anything but very simple operations. And actually, I did essentially do what you mentioning for our "gas refund" contracts. Basically another trick to cut gas spend is to use the refund the EVM gives for calling contract self-destruct. You create a bunch of dummy contracts when gas is cheap. Then on your transaction where you're payi…

>The biggest challenge is once you leave Solidity entirely, it's hard to do anything but very simple operations. You don't have to leave solidity, it could all be done in the fallback/default function, no? For the rest, you described gas tokens, but self destruct refunds were removed with London so they are all worthless now.

Good question. I'm 90% sure that fallback function is actually implemented in byte code by comparing the byte code against all the method signatures. Then if none match, the assembly jumps to the fallback. So, what you save in 0s in the input byte code, you pay more than that in the execution gas.

Yeah, for gas tokens you're right. This was all pre-Flashbots, so talking about February or March at the latest. Flashbots kind of wrecked the whole game. Now it's a whole lot simpler, just ship transactions to Flashbots and bid as close as possible to breakeven. Consequently 90%+ of the profits now go to the miners.

Re: Technical Analysis of the Poly Network Hack

#32

Post by martinko »

Gaelan wrote: post #19
capnorange wrote: post #14

Earlier quoted context omitted.

the smart contract has a blacklist flag that can be activated by the Tether, this prevents on-chain transfers. https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c... The USDT will be burned and the USD released to the rightful owner after law/legal approval -- https://twitter.com/paoloardoino/status/1425188386034311168

Wait, so they have the ability to arbitrarily blacklist people from transferring tethers? At this point, is Tether anything other than a weird bank?

To be fair, they never claimed to be anything else, just a conduit to allow seamless transfers of usd value on the blockchain, while they hold the actual funds (applies to all non-algorithmic stables).

Re: Technical Analysis of the Poly Network Hack

#33

Post by martinko »

yonixw wrote: post #18
martinko wrote: post #11

Earlier quoted context omitted.

Don't know about USDC, but USDT almost instantly locked the funds, making them unspendable.

Does this mean they are lost forever? like burning real bills? Or is there a mechanism to repay the original owners?

No, the real bills that back the money should still be sitting in the bank (although some people would question this, given that we are talking about tether. Only the token representation has been frozen.

Re: Technical Analysis of the Poly Network Hack

#34

Post by ryanmarsh »

lordnacho wrote: post #8
3pt14159 wrote: post #3

It will never cease to amaze me that someone with the technical chops to pull off an attack worth this much hasn't done the minimum pre-work necessary to get away with the cash or at least some non-trivial amount of it.

They're claiming to be white hat and have given back 250m.

250 of 600? I question how white that hat is.

Re: Technical Analysis of the Poly Network Hack

#35

Post by nootropicat »

dcolkitt wrote: post #31
nootropicat wrote: post #30

Earlier quoted context omitted.

>The biggest challenge is once you leave Solidity entirely, it's hard to do anything but very simple operations. You don't have to leave solidity, it could all be done in the fallback/default function, no? For the rest, you described gas tokens, but self destruct refunds were removed with London so they are all worthless now.

Good question. I'm 90% sure that fallback function is actually implemented in byte code by comparing the byte code against all the method signatures. Then if none match, the assembly jumps to the fallback. So, what you save in 0s in the input byte code, you pay more than that in the execution gas. Yeah, for gas tokens you're right. This was all pre-Flashbots, so talking about February or March at the latest. Flashbot…

>So, what you save in 0s in the input byte code, you pay more than that in the execution gas.

In this case all methods should be internal, so the preamble would have no methods at all to look for.

Post reply on HN