7 ms·

I've seen them described as "self-funding bug bounties".

by mrec 5y ago

intrasight 5y ago
When I think about it in those terms... Why not fund bug bounties that way?
- X6S1x6Okd1st 5y ago
  That is happening as well.
- solomonb 5y ago
  Because you presumably want to find bugs in applications that are not smart contracts.
  - adtac 5y ago
    Wait you don't have a /root/btc_bounty_private_key.txt with 600 permissions in every server?
  - intrasight 5y ago
    No. I was specifically referring to finding bugs in smart contracts. Stand up a network and have a "bounty" that would attract attempts.
- EGreg 5y ago
  Because the payout would be too large
  - intrasight 5y ago
    The payout would be whatever gas you put in as the "bounty"
- rawtxapp 5y ago
  They are called ransomwares and people aren't very happy with that method.
  - ineedasername 5y ago
    And oddly ineffective at actually prompting action on closing out those bugs.
    - CryptoPunk 5y ago
      While I don't have numbers, there is indication that it's prompting increased investment into cyber security: https://www.forbes.com/sites/kevindowd/2021/06/06/private-equity-pushes-deeper-into-cybersecurity-as-ransomware-attacks-ramp-up/ https://www.forbes.com/sites/kevindowd/2021/06/06/private-eq...
unholiness 5y ago
But it's so much worse than that, right? Bugs in a smart contract are immutable. Those are just the terms everyone agreed to. There's simply no path to deploying a fix that every good actor agrees is beneficial.
- pjerem 5y ago
  I guess technically you can deploy a new contract that reverses the previous contract outcomes then replays the « fixed » terms. Good luck to find a common agreement though. And so much more possibilities for new bugs.
- ekir 5y ago
  It's fairly common to deploy a proxy contract, which allows for a sort of updating. Basically you deploy a new contract and have the proxy point to that new contract instead of the old one. There are definitely some limitations and it's not fully standardized yet. There's a tentative standard here https://github.com/ethereum/EIPs/issues/1538 https://github.com/ethereum/EIPs/issues/1538 and OpenZeppelin also has their own implementation. Although neither of these things will actually help if your contract gets exploited before you can push a fix.
  - acjohnson55 5y ago
    The problem there is that it allows people with deploy privileges to unilaterally change the rules. So you lose "code is law". Hypothetically, you want to custody of assets in an immutable contract with the minimal amount of privileges, and use proxy contracts for higher level on-chain functionality. But it's not so clear to me that it's possible to achieve a perfect factoring, in general.
    - xur17 5y ago
      Typically folks require a governance vote (so multiple parties) + a timelocked contract, and then after some system age / volume they burn the option.
  - gumby 5y ago
ike0790 5y ago
lmao

I've seen them described as "self-funding bug bounties".

by mrec 5y ago

I've seen them described as "self-funding bug bounties".

intrasight 5y ago

When I think about it in those terms... Why not fund bug bounties that way?

X6S1x6Okd1st 5y ago
That is happening as well.
solomonb 5y ago
Because you presumably want to find bugs in applications that are not smart contracts.
- adtac 5y ago
  Wait you don't have a /root/btc_bounty_private_key.txt with 600 permissions in every server?
- intrasight 5y ago
  No. I was specifically referring to finding bugs in smart contracts. Stand up a network and have a "bounty" that would attract attempts.
EGreg 5y ago
Because the payout would be too large
- intrasight 5y ago
  The payout would be whatever gas you put in as the "bounty"
rawtxapp 5y ago
They are called ransomwares and people aren't very happy with that method.
- ineedasername 5y ago
  And oddly ineffective at actually prompting action on closing out those bugs.
  - CryptoPunk 5y ago
    While I don't have numbers, there is indication that it's prompting increased investment into cyber security: https://www.forbes.com/sites/kevindowd/2021/06/06/private-equity-pushes-deeper-into-cybersecurity-as-ransomware-attacks-ramp-up/ https://www.forbes.com/sites/kevindowd/2021/06/06/private-eq...

unholiness 5y ago

But it's so much worse than that, right? Bugs in a smart contract are immutable. Those are just the terms everyone agreed to. There's simply no path to deploying a fix that every good actor agrees is beneficial.

pjerem 5y ago
I guess technically you can deploy a new contract that reverses the previous contract outcomes then replays the « fixed » terms. Good luck to find a common agreement though. And so much more possibilities for new bugs.
ekir 5y ago
It's fairly common to deploy a proxy contract, which allows for a sort of updating. Basically you deploy a new contract and have the proxy point to that new contract instead of the old one. There are definitely some limitations and it's not fully standardized yet. There's a tentative standard here https://github.com/ethereum/EIPs/issues/1538 https://github.com/ethereum/EIPs/issues/1538 and OpenZeppelin also has their own implementation. Although neither of these things will actually help if your contract gets exploited before you can push a fix.
- acjohnson55 5y ago
  The problem there is that it allows people with deploy privileges to unilaterally change the rules. So you lose "code is law". Hypothetically, you want to custody of assets in an immutable contract with the minimal amount of privileges, and use proxy contracts for higher level on-chain functionality. But it's not so clear to me that it's possible to achieve a perfect factoring, in general.
  - xur17 5y ago
    Typically folks require a governance vote (so multiple parties) + a timelocked contract, and then after some system age / volume they burn the option.
- gumby 5y ago

ike0790 5y ago

lmao