5 ms·

Ethernaut: wargame to learn about smart contract security

137 points by elopio 8y ago

dep_b 8y ago
https://en.m.wikipedia.org/wiki/The_Eternaut https://en.m.wikipedia.org/wiki/The_Eternaut It’s not an association free name
- davesque 8y ago
  It's named after that comic. Images from the comic are littered all over the app.
DINKDINK 8y ago
Before investing time in learning how to program on ethereum, one should first assess the engineering feasibility of it's blockchain: https://medium.com/@preethikasireddy/how-does-ethereum-work-anyway-22d1df506369 https://medium.com/@preethikasireddy/how-does-ethereum-work-... Take a look at their github and how the overwhelming majority of users can't run a full node (If you can't run a full node, you rely on an intermediary, you are not decentralized). I'm not sure if the "marketing team behind a decentralized project" is still doing it but they used to be continuing to market ethereum as an immutable blockchain which is patently false due to their roll back of the DAO.
- maiavictor 8y ago
  That's a blatant lie, running a full node is not required to "be decentralized", for the same reason you don't need to run a full node in Bitcoin. Light nodes have the same guarantees about the integrity and irreversibility that full nodes do. Perhaps you should try learning about them - see https://github.com/ethereum/wiki/wiki/Light-client-protocol https://github.com/ethereum/wiki/wiki/Light-client-protocol - before stating things you don't understand? The fact that the worst thing a "fudster" like you has to say against Ethereum is that it had a hard fork to revert a millionaire hack caused by a bug in early stages of the project; whereas something not too different also happened to Bitcoin - see https://en.bitcoin.it/wiki/Value_overflow_incident https://en.bitcoin.it/wiki/Value_overflow_incident - when it had the same age; says it all. I don't often comment here, but I simply can't understand why an human being would come to the internet and hatefully attack things it doesn't like with straight made-up facts. I mean, I know this is so common, I just don't get why. This kind of thing makes me sad about humanity as a whole. Why can't we be nice to each other?
  - RustyRussell 8y ago
    > for the same reason you don't need to run a full node in Bitcoin. Just to be clear: the Bitcoin developers do recommend you run a full node. It is the only way to independently validate the entire chain.
    - CryptoPunk 8y ago
      Yes that's true. However it's silly to choose every user being able to run a full node over every user being able to write to the blockchain. There's no point in being able to read the blockchain if you can't write to it. Practically, you don't need to independently validate the blockchain. You can rely on dozens of blockchain explorers to do that. You do however need to be able to write your own transactions to the blockchain to have any degree of control over your own funds. The 1 MB limit effectively prioritizes the former over the latter, which is something that was never part of Bitcoin's original roadmap, or what Satoshi would have recommended: https://bitcointalk.org/index.php?topic=532.msg6306#msg6306 https://bitcointalk.org/index.php?topic=532.msg6306#msg6306
      - esotericn 8y ago
        You can currently add a transaction to the Bitcoin blockchain for (converted) approximately one US cent. Reference: https://bitcoin.electronrelocation.com https://bitcoin.electronrelocation.com In the future we expect fees to increase (as they must for security purposes), but the idea that someone that can afford to run a full node will not be able to afford to insert a transaction does not hold up under basic scrutiny.
        CryptoPunk 8y ago
        >>You can currently add a transaction to the Bitcoin blockchain for (converted) approximately one US cent. That's irrelevant. The only reason you can get away with a low fee on the Bitcoin Core blockchain at the moment is that it's not operating at capacity. As soon as adoption picks up again, fees will start to climb - they have to because capacity is constrained. At any globally significant level of usage, fees will be astronomical. Remember, as recently as December 2017, BTC's average transaction fee reached $30. >> but the idea that someone that can afford to run a full node will not be able to afford to insert a transaction does not hold up under basic scrutiny. That's absurd. 1 MB of space in each block allows for a maximum of 604,800 transactions being written to the blockchain a day. There is no way that fees for writing to the blockchain wouldn't skyrocket, far out of reach of ordinary users, at any significant level of adoption.
- the_clarence 8y ago
  Go-ethereum is really hard to run. Constant problems that require you to reboot it. Not sure about the parity implementation.
- asynchrony 8y ago
  It's perfectly decentralized. The Ethereum Foundation is just the centralized marketing and governance organization that also lobbied the SEC not to classify it as a security because of how decentralized it is.
  - CryptoPunk 8y ago
    Multiple organizations argued that ether is not a security. No one has a monopoly on speaking for Ethereum. There once was a Bitcoin Foundation too.
    - asynchrony 8y ago
      When the price corrects back to $0.50 I predict many current zealots will change their tune.
- ProfBernardo 8y ago
  This makes no sense. There are thousands of Ethereum nodes in existence. Maybe your arrogance just clouds your ability to figure it out.
- CryptoPunk 8y ago
  I have no idea what you're talking about. Ethereum has over 12,000 full nodes: https://www.ethernodes.org/network/1 https://www.ethernodes.org/network/1 Ethereum's inclusion of state root commitments in its data structure also means ultra-secure light clients - that provide much greater security than Bitcoin's SPV clients - are possible. What you're claiming amounts to blatant FUD.
- trakout 8y ago
  Geth isn't the only software out there..
alert0 8y ago
If you're interested in smart contract security, this repo [1] is a good resource too. 1. https://github.com/trailofbits/not-so-smart-contracts https://github.com/trailofbits/not-so-smart-contracts
- nemild 8y ago
  And more: https://consensys.github.io/smart-contract-best-practices/ https://consensys.github.io/smart-contract-best-practices/ http://dasp.co http://dasp.co Disclaimer: I contributed to the first link. Also, I wrote this a while back for any experienced engineers that want to learn Solidity: https://learnxinyminutes.com/docs/solidity/ https://learnxinyminutes.com/docs/solidity/
socrates1024 8y ago
Another related resource (seems similar to the design of ethernaut) https://github.com/pdaian/hackthiscontract https://github.com/pdaian/hackthiscontract
fucku2 8y ago
Hacker News is BTC’s biotch
djrconcepts 8y ago
followed the instructions. was getting an error in the console when clicking the blue button "Get new instance". refreshed the page and tried again. worked after a few tries
- splintercell 8y ago
  I presume you had Metamask installed?
evanvanness 8y ago
The 21th century computing stack is being built.

137 points by elopio 8y ago

https://en.m.wikipedia.org/wiki/The_Eternaut https://en.m.wikipedia.org/wiki/The_Eternaut It’s not an association free name

davesque 8y ago
It's named after that comic. Images from the comic are littered all over the app.

DINKDINK 8y ago

Before investing time in learning how to program on ethereum, one should first assess the engineering feasibility of it's blockchain: https://medium.com/@preethikasireddy/how-does-ethereum-work-anyway-22d1df506369 https://medium.com/@preethikasireddy/how-does-ethereum-work-... Take a look at their github and how the overwhelming majority of users can't run a full node (If you can't run a full node, you rely on an intermediary, you are not decentralized). I'm not sure if the "marketing team behind a decentralized project" is still doing it but they used to be continuing to market ethereum as an immutable blockchain which is patently false due to their roll back of the DAO.

maiavictor 8y ago
That's a blatant lie, running a full node is not required to "be decentralized", for the same reason you don't need to run a full node in Bitcoin. Light nodes have the same guarantees about the integrity and irreversibility that full nodes do. Perhaps you should try learning about them - see https://github.com/ethereum/wiki/wiki/Light-client-protocol https://github.com/ethereum/wiki/wiki/Light-client-protocol - before stating things you don't understand? The fact that the worst thing a "fudster" like you has to say against Ethereum is that it had a hard fork to revert a millionaire hack caused by a bug in early stages of the project; whereas something not too different also happened to Bitcoin - see https://en.bitcoin.it/wiki/Value_overflow_incident https://en.bitcoin.it/wiki/Value_overflow_incident - when it had the same age; says it all. I don't often comment here, but I simply can't understand why an human being would come to the internet and hatefully attack things it doesn't like with straight made-up facts. I mean, I know this is so common, I just don't get why. This kind of thing makes me sad about humanity as a whole. Why can't we be nice to each other?
- RustyRussell 8y ago
  > for the same reason you don't need to run a full node in Bitcoin. Just to be clear: the Bitcoin developers do recommend you run a full node. It is the only way to independently validate the entire chain.
  - CryptoPunk 8y ago
    Yes that's true. However it's silly to choose every user being able to run a full node over every user being able to write to the blockchain. There's no point in being able to read the blockchain if you can't write to it. Practically, you don't need to independently validate the blockchain. You can rely on dozens of blockchain explorers to do that. You do however need to be able to write your own transactions to the blockchain to have any degree of control over your own funds. The 1 MB limit effectively prioritizes the former over the latter, which is something that was never part of Bitcoin's original roadmap, or what Satoshi would have recommended: https://bitcointalk.org/index.php?topic=532.msg6306#msg6306 https://bitcointalk.org/index.php?topic=532.msg6306#msg6306
    - esotericn 8y ago
      You can currently add a transaction to the Bitcoin blockchain for (converted) approximately one US cent. Reference: https://bitcoin.electronrelocation.com https://bitcoin.electronrelocation.com In the future we expect fees to increase (as they must for security purposes), but the idea that someone that can afford to run a full node will not be able to afford to insert a transaction does not hold up under basic scrutiny.
      - CryptoPunk 8y ago
        >>You can currently add a transaction to the Bitcoin blockchain for (converted) approximately one US cent. That's irrelevant. The only reason you can get away with a low fee on the Bitcoin Core blockchain at the moment is that it's not operating at capacity. As soon as adoption picks up again, fees will start to climb - they have to because capacity is constrained. At any globally significant level of usage, fees will be astronomical. Remember, as recently as December 2017, BTC's average transaction fee reached $30. >> but the idea that someone that can afford to run a full node will not be able to afford to insert a transaction does not hold up under basic scrutiny. That's absurd. 1 MB of space in each block allows for a maximum of 604,800 transactions being written to the blockchain a day. There is no way that fees for writing to the blockchain wouldn't skyrocket, far out of reach of ordinary users, at any significant level of adoption.
the_clarence 8y ago
Go-ethereum is really hard to run. Constant problems that require you to reboot it. Not sure about the parity implementation.
asynchrony 8y ago
It's perfectly decentralized. The Ethereum Foundation is just the centralized marketing and governance organization that also lobbied the SEC not to classify it as a security because of how decentralized it is.
- CryptoPunk 8y ago
  Multiple organizations argued that ether is not a security. No one has a monopoly on speaking for Ethereum. There once was a Bitcoin Foundation too.
  - asynchrony 8y ago
    When the price corrects back to $0.50 I predict many current zealots will change their tune.
ProfBernardo 8y ago
This makes no sense. There are thousands of Ethereum nodes in existence. Maybe your arrogance just clouds your ability to figure it out.
CryptoPunk 8y ago
I have no idea what you're talking about. Ethereum has over 12,000 full nodes: https://www.ethernodes.org/network/1 https://www.ethernodes.org/network/1 Ethereum's inclusion of state root commitments in its data structure also means ultra-secure light clients - that provide much greater security than Bitcoin's SPV clients - are possible. What you're claiming amounts to blatant FUD.
trakout 8y ago
Geth isn't the only software out there..

alert0 8y ago

If you're interested in smart contract security, this repo [1] is a good resource too. 1. https://github.com/trailofbits/not-so-smart-contracts https://github.com/trailofbits/not-so-smart-contracts

nemild 8y ago
And more: https://consensys.github.io/smart-contract-best-practices/ https://consensys.github.io/smart-contract-best-practices/ http://dasp.co http://dasp.co Disclaimer: I contributed to the first link. Also, I wrote this a while back for any experienced engineers that want to learn Solidity: https://learnxinyminutes.com/docs/solidity/ https://learnxinyminutes.com/docs/solidity/

socrates1024 8y ago

Another related resource (seems similar to the design of ethernaut) https://github.com/pdaian/hackthiscontract https://github.com/pdaian/hackthiscontract

fucku2 8y ago

Hacker News is BTC’s biotch

djrconcepts 8y ago

followed the instructions. was getting an error in the console when clicking the blue button "Get new instance". refreshed the page and tried again. worked after a few tries

splintercell 8y ago
I presume you had Metamask installed?

evanvanness 8y ago

The 21th century computing stack is being built.