6 ms·

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make,

by 55555 5y ago

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a) patch the vulnerability, which will get him a pat on the back, or (b) convince himself he didn't notice anything, quit his job, wait a month, go to a coffee shop with a hoodie on, boot into whonix, connect to the internet with a 4g dongle, run a few lines of code, and get $600 million dollars. Most people would choose (a)! And law enforcement is a thing! But a lot of people will choose (b), and if they do a merely decent job they will get away with it, and 600 million dollars is stolen®. Actually, it's worse than that, because unlike normal banks, the code used by these digital banks is open source, and anyone in the world can go bug hunting.

fny 5y ago
Now say you're a company hired to do an audit. Same incentives. The hilarious thing is nearly all of these high profile hacks happen even after being audited. There was one company I remember being called out as a suspect, but I can't find the name. Also given (a) anonymity (b) ability to take cover amid so many other hacks, you could do this for a few years, slow down, and remain a top tier firm claiming the lowest hack rate.
- davidlee1435 5y ago
  Are you thinking of solidity.finance? https://rekt.news/deathbed-confessions-c3pr/ https://rekt.news/deathbed-confessions-c3pr/
crypt1d 5y ago
A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.
- uncomputation 5y ago
  It’s very hard to take this claim seriously in this thread, which details a huge (and somewhat obvious) security vulnerability in a currency worth at least $600m (an amount anyone would assume is “first-tier”).
  - crypt1d 5y ago
    Yeah I can understand that. Once you dive into crypto however, you quickly realize that $600m is just not that much money (especially not if we are talking about digital assets valued at current ticker price). And that lots of money isn't necessarily the right measure of quality of the project.
    - fny 5y ago
      Lol, even 1% of $600M is $6M. That's a lot of money. You'd have to have garbage liquidity to only get back 1%.
    - christkv 5y ago
      It’s valued at 600 million that does not mean it can be liquidated for 600 million.
      - smaryjerry 5y ago
        That is literally what that means. Market caps are what they are because everyone who thinks it is worth less has sold and everyone who thinks it’s worth that or more will buy. There’s some outliers but in general these coins are trading their entire market cap over the course of maybe a month or less. Liquid generally means short term, if you can sell it for cash in under a year then it is liquid. Sure if you tried to sell all coin today in the same minute you won’t find a buyer but over a month this happens all the time.
        deleted 5y ago
        [deleted]
robertwt7 5y ago
but is it that simple though? Even in enterprise company we have to do 2-3 review on PR before merging. I think proper DeFi company should have their own system on deploying contracts. Further, they should have their own security team that audit everything.
hjorthjort 5y ago
That's what you hire auditors for.
- kevingadd 5y ago
  An auditor has the same incentive to become a bad actor for profit
bko 5y ago
> Actually, it's worse than that, because unlike normal banks, the code used by these digital banks is open source, and anyone in the world can go bug hunting. An argument that open source is less secure, and on Hacker News! Now I've seen it all.
- gpderetta 5y ago
  It is not a statement about security but about plausible deniability.
- TravisHusky 5y ago
  There is an argument to be made for having some things remain closed, and obscured from public view. If a company/group has an experienced and large internal audit team that reviews systems, and they are building something that is likely to be placed under extreme amounts of targeted attacks (military crypto, banking systems, etc.) it sometimes makes sense to not allow just anyone to see/poke at the whole thing. Military cryptographic systems, IBM mainframes, and many other products use this approach as a layer in their security framework and it is actually pretty successful. If I asked you to break into the a PFSense box you could just Google "PFSense version X.X.X CVEs" and you would probably get a way in if the box was enough out of date, but if you tried to find the same thing for something like the General Dynamics TACLANE you would have a hard time even finding where to start.
JulianMorrison 5y ago
I wonder if there's some way to make a "thief monkey". Some program that searches your code for vulnerability patterns and rips you off if it can. (Obvs, a tame monkey will then give you the money back). Humans might be motivated to sit on a bug until they can reach the cybercafe. Bots, not so much.
basseq 5y ago
> And law enforcement is a thing! More than that, there's a minority perspective in DeFi that the code is the law. If the code allows it (e.g., withdrawals under an unintended circumstance), it's therefore legal. If it were illegal, the code wouldn't allow it.
- im3w1l 5y ago
  I think this could make sense if it is applied in a small community of tinkerers that understand and accept the risks (cf. accredited investor), or I suppose a community of dissidents that trust the police even less than they trust the code, but for wider society it would not be appropriate.
GhostVII 5y ago
I think the bigger problem is people who are intentionally being malicious rather than people who stumble upon a bug. Just look at how many people fall for wire transfer or gift card scams. Crypto allows scammers to do that much more easily, since there is no human in the pipeline to flag transactions, and since there aren't the same limits that banks put in place on transactions. If someone finds a way to exploit a particular pattern/transaction type/etc. it's not like you can just immediately patch it when you have a decentralized currency. Ex. in an Bitcoin wallet malicious actors could show any text they wanted in an update popup [0]. So of course this was immediately used to steal millions. With crypto all it takes is one piece of malicious software, or to fall for a single phishing email, and you've lost everything. [0] https://www.zdnet.com/article/bitcoin-wallet-trick-has-netted-criminals-more-than-22-million/ https://www.zdnet.com/article/bitcoin-wallet-trick-has-nette...
legulere 5y ago
Why should law enforcement be a problem? I thought the idea behind smart contracts was that code is law?
noch 5y ago
> quit his job, wait a month, go to a coffee shop with a hoodie on, boot into whonix, connect to the internet with a 4g dongle, run a few lines of code, and get $600 million dollars. Think again. In the wild wild west that is cryptocurrency the first thing people assume is an inside job. People with a lot of money and a cut-throat ethic will send death threats to your front door merely for small bugs you accidentally commited to github or for a governance dispute on a forum where you posted pseudonymously. If you dare steal money as an insider you had better make sure you know how to use it to quickly get high-end personal security for you, your family, and friends. This of course simultaneously outs you as guilty. Any hack occurs and you are immediately woken up in the middle of the night to be interrogated by people you've never seen before let alone heard of, stomping through your apartment. Your life becomes a movie. Angry vicious actors with few scruples and long memories will loudly and expensively hunt for you for the rest of your life so you can make them whole. LEOs aren't even your biggest concern at that point. Being an insider or former insider after a large hack sucks whether or not you're guilty.

by 55555 5y ago

fny 5y ago

Now say you're a company hired to do an audit. Same incentives. The hilarious thing is nearly all of these high profile hacks happen even after being audited. There was one company I remember being called out as a suspect, but I can't find the name. Also given (a) anonymity (b) ability to take cover amid so many other hacks, you could do this for a few years, slow down, and remain a top tier firm claiming the lowest hack rate.

davidlee1435 5y ago
Are you thinking of solidity.finance? https://rekt.news/deathbed-confessions-c3pr/ https://rekt.news/deathbed-confessions-c3pr/

crypt1d 5y ago

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

uncomputation 5y ago
It’s very hard to take this claim seriously in this thread, which details a huge (and somewhat obvious) security vulnerability in a currency worth at least $600m (an amount anyone would assume is “first-tier”).
- crypt1d 5y ago
  Yeah I can understand that. Once you dive into crypto however, you quickly realize that $600m is just not that much money (especially not if we are talking about digital assets valued at current ticker price). And that lots of money isn't necessarily the right measure of quality of the project.
  - fny 5y ago
    Lol, even 1% of $600M is $6M. That's a lot of money. You'd have to have garbage liquidity to only get back 1%.
  - christkv 5y ago
    It’s valued at 600 million that does not mean it can be liquidated for 600 million.
    - smaryjerry 5y ago
      That is literally what that means. Market caps are what they are because everyone who thinks it is worth less has sold and everyone who thinks it’s worth that or more will buy. There’s some outliers but in general these coins are trading their entire market cap over the course of maybe a month or less. Liquid generally means short term, if you can sell it for cash in under a year then it is liquid. Sure if you tried to sell all coin today in the same minute you won’t find a buyer but over a month this happens all the time.
      - deleted 5y ago
        [deleted]

robertwt7 5y ago

but is it that simple though? Even in enterprise company we have to do 2-3 review on PR before merging. I think proper DeFi company should have their own system on deploying contracts. Further, they should have their own security team that audit everything.

hjorthjort 5y ago

That's what you hire auditors for.

kevingadd 5y ago
An auditor has the same incentive to become a bad actor for profit

bko 5y ago

> Actually, it's worse than that, because unlike normal banks, the code used by these digital banks is open source, and anyone in the world can go bug hunting. An argument that open source is less secure, and on Hacker News! Now I've seen it all.

gpderetta 5y ago
It is not a statement about security but about plausible deniability.
TravisHusky 5y ago
There is an argument to be made for having some things remain closed, and obscured from public view. If a company/group has an experienced and large internal audit team that reviews systems, and they are building something that is likely to be placed under extreme amounts of targeted attacks (military crypto, banking systems, etc.) it sometimes makes sense to not allow just anyone to see/poke at the whole thing. Military cryptographic systems, IBM mainframes, and many other products use this approach as a layer in their security framework and it is actually pretty successful. If I asked you to break into the a PFSense box you could just Google "PFSense version X.X.X CVEs" and you would probably get a way in if the box was enough out of date, but if you tried to find the same thing for something like the General Dynamics TACLANE you would have a hard time even finding where to start.

JulianMorrison 5y ago

I wonder if there's some way to make a "thief monkey". Some program that searches your code for vulnerability patterns and rips you off if it can. (Obvs, a tame monkey will then give you the money back). Humans might be motivated to sit on a bug until they can reach the cybercafe. Bots, not so much.

basseq 5y ago

> And law enforcement is a thing! More than that, there's a minority perspective in DeFi that the code is the law. If the code allows it (e.g., withdrawals under an unintended circumstance), it's therefore legal. If it were illegal, the code wouldn't allow it.

im3w1l 5y ago
I think this could make sense if it is applied in a small community of tinkerers that understand and accept the risks (cf. accredited investor), or I suppose a community of dissidents that trust the police even less than they trust the code, but for wider society it would not be appropriate.

GhostVII 5y ago

I think the bigger problem is people who are intentionally being malicious rather than people who stumble upon a bug. Just look at how many people fall for wire transfer or gift card scams. Crypto allows scammers to do that much more easily, since there is no human in the pipeline to flag transactions, and since there aren't the same limits that banks put in place on transactions. If someone finds a way to exploit a particular pattern/transaction type/etc. it's not like you can just immediately patch it when you have a decentralized currency. Ex. in an Bitcoin wallet malicious actors could show any text they wanted in an update popup [0]. So of course this was immediately used to steal millions. With crypto all it takes is one piece of malicious software, or to fall for a single phishing email, and you've lost everything. [0] https://www.zdnet.com/article/bitcoin-wallet-trick-has-netted-criminals-more-than-22-million/ https://www.zdnet.com/article/bitcoin-wallet-trick-has-nette...

legulere 5y ago

Why should law enforcement be a problem? I thought the idea behind smart contracts was that code is law?

noch 5y ago

> quit his job, wait a month, go to a coffee shop with a hoodie on, boot into whonix, connect to the internet with a 4g dongle, run a few lines of code, and get $600 million dollars. Think again. In the wild wild west that is cryptocurrency the first thing people assume is an inside job. People with a lot of money and a cut-throat ethic will send death threats to your front door merely for small bugs you accidentally commited to github or for a governance dispute on a forum where you posted pseudonymously. If you dare steal money as an insider you had better make sure you know how to use it to quickly get high-end personal security for you, your family, and friends. This of course simultaneously outs you as guilty. Any hack occurs and you are immediately woken up in the middle of the night to be interrogated by people you've never seen before let alone heard of, stomping through your apartment. Your life becomes a movie. Angry vicious actors with few scruples and long memories will loudly and expensively hunt for you for the rest of your life so you can make them whole. LEOs aren't even your biggest concern at that point. Being an insider or former insider after a large hack sucks whether or not you're guilty.