Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Escaping the Dark Forest

samczsun.com

Post reply on HN
Print view View original

71–80 of 142 posts

Re: Escaping the Dark Forest

#71

Post by 3np »

nonsens3 wrote: post #70
3np wrote: post #53

Earlier quoted context omitted.

Arbitrage trades and related activities like MakerDAO keepers would be legitimate transactions vulnerable to this (essentially someone else extracting the value from their discovery). Granted that is a very small subset of users.

Liquidation contracts and Arbitrage contracts do check the caller and would not allow to be executed by non-approved senders. This raises the bar, so that you can front run only contracts that you can implement and deploy. If anyone could just replace an address and execute a profitable transaction by being first on existing contracts, surely miners would be doing it already, no?

> If anyone could just replace an address and execute a profitable transaction by being first on existing contracts, surely miners would be doing it already, no?

To a large degree not yet.

Re: Escaping the Dark Forest

#72

Post by asdfasgasdgasdg »

SiempreViernes wrote: post #66
pavlov wrote: post #40

Nice work, but honestly I'm not sure why they bother. The article states that the purpose of these smart contracts is: "Stake your tokens with us and you could be the next cryptocurrency millionaire" That's an obvious scam. Anyone who gave real money to such a cause has already lost it. So why is the author giving away his time to help the scammers?

For the glory? Because even chumps deserve justice? Because someone needs to defend the reputation of digicoins?

Two things: if digicoins have a deservedly bad reputation, maybe it shouldn't be defended. And: if this is defending their reputation I'd hate to see what attacking it looks like. I have never wanted less to be involved in cryptocurrency or been more skeptical of it's future than now having finished reading this article.

Re: Escaping the Dark Forest

#73

Post by iameli »

bodski wrote: post #46
iameli wrote: post #21

Love whitehat crypto postmortems like this. They always read like heist movies. Curious about the use of SparkPool to bypass the mempool and get the transactions minted directly into a block. It looks like anyone can sign up and contribute their hashrate to SparkPool. Is there a risk of malicious miners running workers in their competitors' pools and then frontrunning?

AFAIK only the pool operator can see the full set of transactions for the block being mined. Pool workers only get to see the block header for the new block. This header only contains the hashed root of the transaction tree, and so they are unable to front-run private transactions in this way.

That makes sense, ty

Re: Escaping the Dark Forest

#75

Post by SilasX »

3np wrote: post #50
SilasX wrote: post #43

Earlier quoted context omitted.

Great analogy! The only thing I would add is that, if your arbitrage trade takes away too much money from an account belong the core devs (which would be like, the regulators responsible for the computer), they would retroactively undo that transaction in the computer's logic (force a hard fork). https://news.ycombinator.com/item?id=14819268

That's an unfair representation of what actually unfolded.

Unfair enough that you can articulate why?

Re: Escaping the Dark Forest

#76

Post by nootropicat »

dwaltrip wrote: post #65
nootropicat wrote: post #37

Earlier quoted context omitted.

It's way safer and less complex than you would expect. Most staking contracts are a copy-paste of two basic staking contracts (from synthetix and sushiswap), so it's enough to do a text diff and see what was changed, which is trivial. For more complex contracts that do something more, funds at risk are the best bug bounty there is - in the current environment if something had >$10M for a month and wasn't hacked, it m…

Me think you are in a bit too deep and may be underestimating how things can go wrong. Another possibility is that you have a high risk tolerance as well as an uncommon knack for this sort of thing that most people don’t have.

I have low risk tolerance, but these contracts are usually very simple. I described the basic process of analysis on reddit some time ago (second half): https://reddit.com/r/ethtrader/comments/ihpj6f/yield_farming...

In total, I did this with about 40 different farms. There was a time when there were several new ones every day. For a while it was pretty much a 24/7 job as maximizing apy required constantly jumping to some new hype. I was constantly afraid of depositing into a contract that would allow the owner to steal everything, but the worst I noticed were locking bugs + two contracts that allowed the owner to mint infinite tokens (of these two, only one used it to clean the liquidity pool).

The list of farms in that reddit post is obsolete (I think only sushiswap is still running, but with low roi), in general this particular way of making money has run its course.

Re: Escaping the Dark Forest

#77

Post by nootropicat »

escapecharacter wrote: post #51
hitekker wrote: post #49

Earlier quoted context omitted.

As an investor who is not into crypto, I don't understand this comment, let alone use it to correctly price the risk of crypto.

agreed; this reads like someone explaining their casino good luck charm strategy.

Wrong, there was never any luck involved. The single worst case scenario was that the token price dumps to 0 immediately after I deposit, which would mean I don't even make the gas fee back. Didn't happen.

Re: Escaping the Dark Forest

#79

Post by stackzero »

cryptocurreny != investment scam. It's just another way to transfer and store value.

Interacting with automated contracts is an interesting extension to that system which can make things alot more complex.

The 'dark forest' comes from a kind of man-in-the-middle attack where anyone can see the order book and exploit it, by putting their own slightly better orders in. Hence the need for co-operation with a closed order book (miner) to get the transaction in safely.

Re: Escaping the Dark Forest

#80

Post by lukev »

sneak wrote: post #24

I offer that anyone who did the work that these researchers did would have also been “rightful owners” of that money. This is the consequence of programmable money; there’s no getting around it, and, in my opinion, people shouldn’t want to. Rescuing people and brands who don’t put the effort into security from the consequences of their own mistakes isn’t a net benefit. I'm all for anonymous teams, but look at the hoo…

I agree with this. The whole "value" proposition of cryptocurrency is that there is no governing authority, no undo, no takebacks, the code is the only law. If that's _not_ what you want, you should 100% be using a bank instead.

All that "rescuing" people who have fucked up does is make the system seem more artificially reliable than it is. Providing a failsafe to people who have very deliberately and explicitly eschewed failsafes (at extreme effort and by subverting the system itself, no less) seems rather pointless and paternalistic.

Post reply on HN