Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White hat hacker awarded $2M for fixing ETH-creation bug

cryptoadventure.com

Post reply on HN
Print view View original

71–80 of 354 posts

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#71

Post by skizm »

__MatrixMan__ wrote: post #64
colesantiago wrote: post #49

This just proves how insecure the blockchain / web3 / cryptocurrency space is. It's good to see white hat hackers in this space trying to fix what is already broken. But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid.

Do you think that a bank or a government would've handled fixing such a flaw as well has optimism did? All tokenization schemes are ponzi scams including USD, it's just that some use violence to stay relevant, and other use bug bounties.

Banks or stock exchanges would just revert any bad transactions like they do with most scams, thefts, or accidents. It is built into the current system by design.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#72

Post by jacquesm »

sillysaurusx wrote: post #48
jacquesm wrote: post #43

Earlier quoted context omitted.

My 'goalposts moved' detector just twitched.

If you say so. It’s the same thing, even if it’s more comfortable to believe it’s not. It helps to frame it this way, because once you accept that you’d do that, you’re more likely to accept you would do something unethical for a billion dollars if it had no consequences to you. And from there, it’s a binary search to determine exactly what your price is. Would you be able to say you wouldn’t lie to your wife if it m…

Yes, but that's not what we're discussing, because then I can counter with:

"Would you sell your mother or your children at any price?"

And I hope - admittedly, that's speculation - I know what the answer to that would be.

So this is now an absurd discussion, whereas it started off from a rational point of view: there exist such people whose ethics can not be corrupted. The fact that you believe this is not the case says nothing about people in general.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#73

Post by colesantiago »

__MatrixMan__ wrote: post #64
colesantiago wrote: post #49

This just proves how insecure the blockchain / web3 / cryptocurrency space is. It's good to see white hat hackers in this space trying to fix what is already broken. But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid.

Do you think that a bank or a government would've handled fixing such a flaw as well has optimism did? All tokenization schemes are ponzi scams including USD, it's just that some use violence to stay relevant, and other use bug bounties.

I have no problem with white hat hackers, I'm saying more power to them in the broken web3 space, which that is a complete scam.

However, I can use USD, GBP or any fiat currency in my local grocery store.

Can I use Bitcoin, Shib, Doge, or even Orchid at my grocery store without waiting hours in the queue for the transaction to complete and no huge fees?

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#74

Post by mentat »

saurik wrote: post #13
saagarjha wrote: post #6

Earlier quoted context omitted.

I’m glad you seem to be happy with your payout, but can we talk for a moment about how much you got? For an exploit like this, especially given how much effort was put into it and how much the market rate of a security engineer like this would be, plus given how much this could be worth on the exploit market, $2 million is literally pennies. This could’ve easily been a bug worth hundreds of millions of dollars. I gue…

If we choose to value everything we touch by way of "the next highest bidder might have paid $X for this" while fully ignoring their intentions (and so allowing black market sales to be in scope for the implied auction), I think you won't actually enjoy the society you end up with :(. Like, as a security researcher yourself, it might feel interesting to posit the exact addition of value we protect per incident, but I…

Really exceptional response. A surprising number of people aren't aware of moral constitution, practically, even though this was a core topic for at least the last few hundred years. Interesting times we live in.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#75

Post by saurik »

vinnymac wrote: post #55

> Had the issue not been promptly resolved, malicious users on the chain could have exploited the flaw. This means a cyber actor could have gained access to the unlimited generation of fresh ETH tokens. I am curious, would it be easy to detect an individual who was exploiting this vulnerability?

In my post-mortem I go into this a bit: someone had actually triggered the bug (on accident while debugging the Etherscan block explorer) but it hadn't been noticed by anyone (and the person at Etherscan didn't realize the ramifications). I believe, due to the atypical mechanism used to store the account balance state on Optimism (which is discussed in detail in my post-mortem as this is also what I claim to be the root cause of the bug), it would have taken quite a long time to notice someone taking advantage of this issue if they weren't being egregiously ostentatious with it (and even then it would have taken "too long" before tons of extremely-difficult-or-arguably-even-impossible-to-unwind economic confusion and damage would have resulted as the whole ecosystem is so heavily automated).

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#77

Post by jimmaswell »

csdvrx wrote: post #53
saurik wrote: post #42

Earlier quoted context omitted.

I do not expect to make any major expensive lifestyle changes as a result of having more money (and to the extent to which I have already been being paid better recently due to working on Orchid, I have only barely done so and usually only quite temporarily), which I realize disappoints some people who had wanted me to post a concrete picture of something expensive I purchase to help motivate others to reach for bug…

> I can't imagine myself buying a pointlessly extravagant car; and, sadly, now is a bad time to buy a car anyway Get a fun car that can be a hacking project :) I was suggested a police car by a friend. They are cheap at auctions, more or less well maintained (tax payer money) and have interesting internals (check sites like https://www.dippy.org/upgrade/dipcop.html ) especially for electrical circuits where a police-…

I want to convert an 80s-style car to powerful electric someday, cyberpunk style. Z31 300ZX probably. If I had a lot of money like that I'd build a big garage and do things like that.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#78

Post by NovemberWhiskey »

flatiron wrote: post #62
stepanhruda wrote: post #52

Earlier quoted context omitted.

Don’t forget about taxes. Most of it is getting taxed at least 37%

Not on capital gains. At least in the US that’s only taxed at 15% with no tiering. The deck is stacked for the investment class

Capital gains for higher earners are taxed at 20%, and also subject to the Net Investment Income Tax at 3.8%.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#79

Post by harikb »

flatiron wrote: post #62
stepanhruda wrote: post #52

Earlier quoted context omitted.

Don’t forget about taxes. Most of it is getting taxed at least 37%

Not on capital gains. At least in the US that’s only taxed at 15% with no tiering. The deck is stacked for the investment class

Even long term capital gain for “the investment class” is more like 20%. This is not even a capital gain - this is straight income at 35+

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#80

Post by mushbino »

bushbaba wrote: post #60
sillysaurusx wrote: post #31

Earlier quoted context omitted.

So how many lambos are you buying? More seriously, will you keep it in the bank and extract $100k a year the rest of your life? What are you going to do?

You forget taxes. It’s roughly 1M post income tax.

Closer to $1,260,000
Post reply on HN