6 ms·

Exploiting smart contracts are the ultimate bug bounties these days. Forget these fortunes 500s, governments and startups. And to the cynics? This is perfect

Exploiting smart contracts are the ultimate bug bounties these days. Forget these fortunes 500s, governments and startups. And to the cynics? This is perfect for you if you hate cryptocurrencies and everything blockchain. Yeah, they're broken, make some money off of that.

busterarm 8y ago
My willingness to do this is counterbalanced by the fact that I don't want to relocate to, for example, Thailand.
- gammateam 8y ago
  You immediately unlink the transactions with Monero. You convert as much of your reward as you can into something more fungible like Ethereum or Bitcoin. Typically this means having several unverified exchange accounts created where you deposit and trade under the unverified account threshold and withdraw. (This is typically 2 bitcoin worth, per account, per 24 hours... but there is always some new exchange with no withdrawal limits and the decentralized exchanges are pretty robust these days) If that exchange doesn't offer Monero, or they have already blacklisted your Ethereum/Bitcoin addresses, then you Coinswitch or Shapeshift, or XMR.TO the rest. Once in Monero nobody can blacklist any of your addresses. You can stay in Monero forever if you like, as it is good enough for reintegration into the normal economy. Or you can reintegrate slowly in other ways, such as back into Ethereum on new exchange accounts or countswitch/shapeshifting back onto that blockchain, simply because there are more things to buy. And yes, it SHOULD go without saying that you should be doing this on Tails or Whonix, and having funded addresses that are unlinked from your identity to begin with. But everyone ever caught up in a legal action has done this part wrong so far.
  - busterarm 8y ago
    If it looks like criminal behavior, LEO and the courts are going to treat it like criminal behavior. What you're suggesting carries a very large risk profile for someone living in a country where it can be safely assumed that all communications are captured. Someone who places a high value on their freedom and happens to live in most of the desirable countries probably shouldn't be doing this. OpSec shouldn't be treated lightly -- there's good reasons why folks like the grugq live in Thailand.
    - gammateam 8y ago
      Right, the thing is there are 100 other reasons to use Monero if you spend any time using transparent blockchains. What is described here works for all 100 reasons and is a best practice and is indiscriminate from what a hacker needs to do The only "outlier" for your overzealous prosecutor's conspiracy charge is that not a lot of people understand this best practice. The solution? Talk about it.
      - busterarm 8y ago
        I'm with you, but I wouldn't roll the dice on a judge or jury with poorly understood technology. While there are 100 perfectly legitimate reasons to structure your transactions the exact same say someone laundering illicit money would, you probably don't want to become that test case.
        gammateam 8y ago
        correct, you wouldn't want to get caught. either way, the US federal criminal charge of money laundering is heavily misunderstood by the public. people are uneasy at merely moving their own money, let alone watching someone else potentially obfuscate the origin of the money. obfuscating the origin isn't illegal the US federal money laundering requires the origin itself to be illicit AND THEN for it to be obfuscated so the government would already have to weigh what happened at the origin, they'd also have to know about the origin, and yeah in this one case it would have implications on the how smart contract intent is formed sure, you don't want to be the experiment, but its already a tall order to get there. save some money for appeals court.
    - gruez 8y ago
      Isn't this only an issue in jurisdictions with civil forfeiture? If a $10M bag of cash materialized in your house, and you properly paid income tax on it, what can the government do?
      - gammateam 8y ago
        well in the US it is also illegal to pay tax on income from illicit sources. so people obfuscate the source and reintegrate into the economy from a new source. if this fails and the government investigates the obfuscation AND finds the source is illicit, then you have the same problem (well actually more crimes to be charged with). and no, this isn't a civil forfeiture issue, but also not mutually exclusive
  - paulie_a 8y ago
    Thanks for the guide on money laundering using crypto currency. It's shocking that crypto currency has such a bad reputation these days.
    - gammateam 8y ago
      You're welcome. It is supposed to be provocative as this particular route isn't used nearly enough, you can read indictments and see that. There is a little bit of a shift, in one indictment the government was able to seize wallets and they were able to retrieve the addresses and amounts of Bitcoin, Zcash, but they could only make a footnote that they had a Monero wallet and didn't know the amounts or the addresses or senders of the recipients involved. Monero is a public but opaque blockchain, and should be the default holdings for people, with occasional interaction with the rest of the crypto economy for conversion. It should always be a buffer between your national currency accounts and your crypto economy accounts. It raises the bar for government investigations back to the level required to get information about your bank accounts. With banks, the government needs subpoenas and warrants for multiple financial institutions to learn about what an investigated customer is doing. With transparent blockchains, the government does not need a subpoena or warrant to analyze transactions and draw conclusions. They can just scan it like any other participant can. With Monero, the government would need subpoenas and warrants for multiple exchanges to learn about what an investigated customer is doing. And if the customer follows best practices, there are limitations on the information that the exchanges would have, because one hop into the Monero network and the funds are not traceable. It is then easy for the customer to hop onto another blockchain. European Commission has proposed banning the RingCT technology used here, but that is a knee-jerk reaction as they have just gotten used to the transparency that non-opaque blockchains like Bitcoin offer for investigators. General benign Monero use would be indiscriminate from money laundering, protecting everyone from financial sanctions and requiring law enforcement to do real investigations into whatever action they are actually trying to prevent, since they can no longer lazily leverage financial intermediaries.
phyzome 8y ago
Has there yet been any attempted legal action against someone who has "exploited" a software contract? I mean, most of the smart-contracts crowd seem to be of the opinion that whatever a software contract permits must be its intent as well, but I don't imagine that conviction would prevent them from filing suit once they'd lost money.
- busterarm 8y ago
  In general, doing research in the US is a bad move because of the CFAA.
  - phyzome 8y ago
    Yes, although international lawsuits and criminal charges are also a thing.
  - gammateam 8y ago
    "Researching" a smart contract just means broadcasting a transaction to a node in the network. There are over 15,000 Ethereum full nodes, you can hit one not in the US from your own reported location not being in the US. The gas you use in your address also needs to be unlinked from your identity too. So basically over tor just shapeshift like $5 worth of Monero to an ethereum address you just created. A transaction with a specific set of instructions will execute the smart contract program on any of the 15,000 nodes in the network.
- gammateam 8y ago
  Yeah code is law so far. You will want to unlink the transaction and reintegrate later just to avoid the challenge. The disagreement with your actions might not come from the state, after all.
  - askmike 8y ago
    Except when it's not, for example ETH vs ETC.
strictnein 8y ago
There's also lots of bug bounties for smart contracts, cryptocurrencies, etc. And they typically pay pretty well. So make money, fix problems, and stay out of jail is also another avenue.
- gammateam 8y ago
  yep and you can also "audit" these things at a nice premium for a day job as well the hackerone bug bounty formalization was just getting up to speed, but the competition has greatly expanded. exploit, audit, bug bounty.. its all semantics in my opinion. you get paid, and you have to weigh what kind of liability you create. where's the distinction? Even people that go straight through hackerone or some company's bug program wind up with undue liability, its still better not to be known in your most "compliant" way
- chopchopchap 8y ago
  How would you go about getting started with the bounties for cryptocurrencies? What sort of skills or background is needed? It's not so good if you need to be a hardened c++ dev with 10 years of experience. :*(
  - gammateam 8y ago
    you don't need to be a hardened c++ dev with 10 years of experience. thats what you need if you don't want your currency to be exploitable. forget the money and the terms, these are just linked lists with memory leaks. very profitable memory leaks. sometimes getting a function into a certain state gives you access to coins - a variable - just read the function.
tptacek 8y ago
If you believe, as many of us do, that cryptocurrencies are really self-organizing distributed Ponzi schemes, then there's really no ethical way to make a living taking money out of them; every dollar you extract ultimately contains some significant component surrendered by an economically vulnerable person in the US, Asia, Africa, &c.
- deleted 8y ago
  [deleted]

busterarm 8y ago

My willingness to do this is counterbalanced by the fact that I don't want to relocate to, for example, Thailand.

gammateam 8y ago
You immediately unlink the transactions with Monero. You convert as much of your reward as you can into something more fungible like Ethereum or Bitcoin. Typically this means having several unverified exchange accounts created where you deposit and trade under the unverified account threshold and withdraw. (This is typically 2 bitcoin worth, per account, per 24 hours... but there is always some new exchange with no withdrawal limits and the decentralized exchanges are pretty robust these days) If that exchange doesn't offer Monero, or they have already blacklisted your Ethereum/Bitcoin addresses, then you Coinswitch or Shapeshift, or XMR.TO the rest. Once in Monero nobody can blacklist any of your addresses. You can stay in Monero forever if you like, as it is good enough for reintegration into the normal economy. Or you can reintegrate slowly in other ways, such as back into Ethereum on new exchange accounts or countswitch/shapeshifting back onto that blockchain, simply because there are more things to buy. And yes, it SHOULD go without saying that you should be doing this on Tails or Whonix, and having funded addresses that are unlinked from your identity to begin with. But everyone ever caught up in a legal action has done this part wrong so far.
- busterarm 8y ago
  If it looks like criminal behavior, LEO and the courts are going to treat it like criminal behavior. What you're suggesting carries a very large risk profile for someone living in a country where it can be safely assumed that all communications are captured. Someone who places a high value on their freedom and happens to live in most of the desirable countries probably shouldn't be doing this. OpSec shouldn't be treated lightly -- there's good reasons why folks like the grugq live in Thailand.
  - gammateam 8y ago
    Right, the thing is there are 100 other reasons to use Monero if you spend any time using transparent blockchains. What is described here works for all 100 reasons and is a best practice and is indiscriminate from what a hacker needs to do The only "outlier" for your overzealous prosecutor's conspiracy charge is that not a lot of people understand this best practice. The solution? Talk about it.
    - busterarm 8y ago
      I'm with you, but I wouldn't roll the dice on a judge or jury with poorly understood technology. While there are 100 perfectly legitimate reasons to structure your transactions the exact same say someone laundering illicit money would, you probably don't want to become that test case.
      - gammateam 8y ago
        correct, you wouldn't want to get caught. either way, the US federal criminal charge of money laundering is heavily misunderstood by the public. people are uneasy at merely moving their own money, let alone watching someone else potentially obfuscate the origin of the money. obfuscating the origin isn't illegal the US federal money laundering requires the origin itself to be illicit AND THEN for it to be obfuscated so the government would already have to weigh what happened at the origin, they'd also have to know about the origin, and yeah in this one case it would have implications on the how smart contract intent is formed sure, you don't want to be the experiment, but its already a tall order to get there. save some money for appeals court.
  - gruez 8y ago
    Isn't this only an issue in jurisdictions with civil forfeiture? If a $10M bag of cash materialized in your house, and you properly paid income tax on it, what can the government do?
    - gammateam 8y ago
      well in the US it is also illegal to pay tax on income from illicit sources. so people obfuscate the source and reintegrate into the economy from a new source. if this fails and the government investigates the obfuscation AND finds the source is illicit, then you have the same problem (well actually more crimes to be charged with). and no, this isn't a civil forfeiture issue, but also not mutually exclusive
- paulie_a 8y ago
  Thanks for the guide on money laundering using crypto currency. It's shocking that crypto currency has such a bad reputation these days.
  - gammateam 8y ago
    You're welcome. It is supposed to be provocative as this particular route isn't used nearly enough, you can read indictments and see that. There is a little bit of a shift, in one indictment the government was able to seize wallets and they were able to retrieve the addresses and amounts of Bitcoin, Zcash, but they could only make a footnote that they had a Monero wallet and didn't know the amounts or the addresses or senders of the recipients involved. Monero is a public but opaque blockchain, and should be the default holdings for people, with occasional interaction with the rest of the crypto economy for conversion. It should always be a buffer between your national currency accounts and your crypto economy accounts. It raises the bar for government investigations back to the level required to get information about your bank accounts. With banks, the government needs subpoenas and warrants for multiple financial institutions to learn about what an investigated customer is doing. With transparent blockchains, the government does not need a subpoena or warrant to analyze transactions and draw conclusions. They can just scan it like any other participant can. With Monero, the government would need subpoenas and warrants for multiple exchanges to learn about what an investigated customer is doing. And if the customer follows best practices, there are limitations on the information that the exchanges would have, because one hop into the Monero network and the funds are not traceable. It is then easy for the customer to hop onto another blockchain. European Commission has proposed banning the RingCT technology used here, but that is a knee-jerk reaction as they have just gotten used to the transparency that non-opaque blockchains like Bitcoin offer for investigators. General benign Monero use would be indiscriminate from money laundering, protecting everyone from financial sanctions and requiring law enforcement to do real investigations into whatever action they are actually trying to prevent, since they can no longer lazily leverage financial intermediaries.

phyzome 8y ago

Has there yet been any attempted legal action against someone who has "exploited" a software contract? I mean, most of the smart-contracts crowd seem to be of the opinion that whatever a software contract permits must be its intent as well, but I don't imagine that conviction would prevent them from filing suit once they'd lost money.

busterarm 8y ago
In general, doing research in the US is a bad move because of the CFAA.
- phyzome 8y ago
  Yes, although international lawsuits and criminal charges are also a thing.
- gammateam 8y ago
  "Researching" a smart contract just means broadcasting a transaction to a node in the network. There are over 15,000 Ethereum full nodes, you can hit one not in the US from your own reported location not being in the US. The gas you use in your address also needs to be unlinked from your identity too. So basically over tor just shapeshift like $5 worth of Monero to an ethereum address you just created. A transaction with a specific set of instructions will execute the smart contract program on any of the 15,000 nodes in the network.
gammateam 8y ago
Yeah code is law so far. You will want to unlink the transaction and reintegrate later just to avoid the challenge. The disagreement with your actions might not come from the state, after all.
- askmike 8y ago
  Except when it's not, for example ETH vs ETC.

strictnein 8y ago

There's also lots of bug bounties for smart contracts, cryptocurrencies, etc. And they typically pay pretty well. So make money, fix problems, and stay out of jail is also another avenue.

gammateam 8y ago
yep and you can also "audit" these things at a nice premium for a day job as well the hackerone bug bounty formalization was just getting up to speed, but the competition has greatly expanded. exploit, audit, bug bounty.. its all semantics in my opinion. you get paid, and you have to weigh what kind of liability you create. where's the distinction? Even people that go straight through hackerone or some company's bug program wind up with undue liability, its still better not to be known in your most "compliant" way
chopchopchap 8y ago
How would you go about getting started with the bounties for cryptocurrencies? What sort of skills or background is needed? It's not so good if you need to be a hardened c++ dev with 10 years of experience. :*(
- gammateam 8y ago
  you don't need to be a hardened c++ dev with 10 years of experience. thats what you need if you don't want your currency to be exploitable. forget the money and the terms, these are just linked lists with memory leaks. very profitable memory leaks. sometimes getting a function into a certain state gives you access to coins - a variable - just read the function.

tptacek 8y ago

If you believe, as many of us do, that cryptocurrencies are really self-organizing distributed Ponzi schemes, then there's really no ethical way to make a living taking money out of them; every dollar you extract ultimately contains some significant component surrendered by an economically vulnerable person in the US, Asia, Africa, &c.

deleted 8y ago
[deleted]