4 ms·

Considering there are still new bugs found in chip designs, operating systems, and compilers that have been around 4 times as long as any cryptocurrency I have

Considering there are still new bugs found in chip designs, operating systems, and compilers that have been around 4 times as long as any cryptocurrency I have literally no idea why you would feel safe in “smart contracts.” At least if my bank account is hacked, I have a solid legal standing for compensation and I have good reason to believe centralized financial institutions will keep extensive documentation and logs. With decentralized finance, all I have is some Medium dot com post on the “Forward Plan” and an ominous message that “SAFEDOLLAR IS UNDER ATTACK.”

rawtxapp 5y ago
The bugs found in smart contracts equal large sums of money right away unlike 0-days in OSes or other systems where the link is much more indirect. For example, if you find a 0-day on Windows, sure you might sell it for 7-8 figures on the black market, if you found a bug on maker (or any of the big contracts), you could walk away with billions of dollars in a practically untraceable way.
- doesnotexist 5y ago
  https://en.wikipedia.org/wiki/Market_for_zero-day_exploits#Marketplace https://en.wikipedia.org/wiki/Market_for_zero-day_exploits#M... The wikipedia entry on this is a bit misleading or misinformed. As there are multiple above ground buyers for 0-days that have no interest in making it difficult for people to sell to them.
  - reidjs 5y ago
    There's still a middle-man to deal with in that process. In this case, you extract a decent amount of 'money' directly. Would you rather win $100 and have to make a phone call to claim it, or find a $100 bill on the street?
hanniabu 5y ago
> Considering there are still new bugs found in chip designs, operating systems, and compilers that have been around 4 times as long Not quite the same. Those codebases are much larger, often include legacy spaghetti code, or are closed source. This makes it more difficult to find exploits, not to mention there's not as clear of path of financial incentive.
norswap 5y ago
As someone that has experience in compilers and smart contracts, I can tell you they are an order of magnitude or more apart in terms of difficulty. Most smart contracts are not that complicated.

rawtxapp 5y ago

The bugs found in smart contracts equal large sums of money right away unlike 0-days in OSes or other systems where the link is much more indirect. For example, if you find a 0-day on Windows, sure you might sell it for 7-8 figures on the black market, if you found a bug on maker (or any of the big contracts), you could walk away with billions of dollars in a practically untraceable way.

doesnotexist 5y ago
https://en.wikipedia.org/wiki/Market_for_zero-day_exploits#Marketplace https://en.wikipedia.org/wiki/Market_for_zero-day_exploits#M... The wikipedia entry on this is a bit misleading or misinformed. As there are multiple above ground buyers for 0-days that have no interest in making it difficult for people to sell to them.
- reidjs 5y ago
  There's still a middle-man to deal with in that process. In this case, you extract a decent amount of 'money' directly. Would you rather win $100 and have to make a phone call to claim it, or find a $100 bill on the street?

hanniabu 5y ago

> Considering there are still new bugs found in chip designs, operating systems, and compilers that have been around 4 times as long Not quite the same. Those codebases are much larger, often include legacy spaghetti code, or are closed source. This makes it more difficult to find exploits, not to mention there's not as clear of path of financial incentive.

norswap 5y ago

As someone that has experience in compilers and smart contracts, I can tell you they are an order of magnitude or more apart in terms of difficulty. Most smart contracts are not that complicated.