4 ms·

Position 3 on the leaderboard: https://rekt.news/leaderboard/ https://rekt.news/leaderboard/

nothrowaways 5y ago
Cool website.
k__ 5y ago
unaudited unaudited unaudited unaudited unaudited unaudited well, well, well If it isn't the consequences of my own actions.
- rfd4sgmk8u 5y ago
  "auditing" means paying someone to run various open source solidity and EVM analysis tools and copy-pasting the results into a doc. Auditing really doesn't mean much. A lot of audited platforms get hacked. A lot of unaudited platforms get hacked. Nobody is ever accountable.
  - dcolkitt 5y ago
    As someone paying a six figure invoice to have their project audited right now, it's really not that simple. Do audited projects get hacked? Yes, absolutely. Is a clean audit report mean a project is bullet proof. Definitely not, especially if it's not from a top-tier firm. But an audit will definitely catch any of the common exploits that are easy to make, like this protocol doesn't check to make sure that the caller is not currently inside another transaction in the contract. All in all, an unaudited protocol has at least an order of magnitude higher risk than one audited by a reputable firm. Ignoring audits altogether would be like refusing to lock your doors, because you heard about a house that still get robbed when the front door was locked.
    - danielvf 5y ago
      There's the Swiss cheese theory of accidents. Each layer may have holes in it, but by having enough layers and aggressively trying to shrink the number and size of holes in each layer, you can get much more secure. External audits by good teams are a good layer, but neither they, nor any other individual layer is a silver bullet. Good audits do provide a lot of value.
    - rfd4sgmk8u 5y ago
      Can you explain how it is not more simple than running open source tooling and copy pasting the results? I am yet to see an 'audit report' that is more than just this. Its checkbox compliance. Are you paying six figures for this? I agree that unaudited is worse. But what are you actually paying for with these clowns?
      - warkdarrior 5y ago
        There are plenty of audit companies that do a in-depth review of the code, a review of the protocol itself, etc., and come up with questions trying to understand the various execution flows. This goes beyond what current tools can do, it acts as a second pair of eyes to read through and understand all of the smart contracts.
      - danielvf 5y ago
        We've also paid for an audit from a leading company recently. You paying for a team of smart people to spend a couple weeks trying to break your system. It's not going to find everything, but everything that is found is a way that can't be attacked anymore.
  - rodiger 5y ago
    This would have likely been caught in a standard audit. Flashloan attacks are incredibly well known and any auditor worth their salt will examine those scenarios
    - rfd4sgmk8u 5y ago
      Yeah, just like the thousand other times. These kinds of attacks rely on contract state and unbalance of tokens. They are quite difficult to detect statically.
    - danielvf 5y ago
      You are correct that flash loans are a part of the standard attack toolbox. This was not a standard attack though. It was a genuinely new attack vector that's not been seen before. Flash loan was just one hammer in the attacks toolbox. Remember anything a flashloan can do, a whale can do too.
  - latchkey 5y ago
    I am friends with a top auditor. He is a genius. Two seconds of looking at a contract and he's found 10 holes. Auditing isn't perfect, but it is better than not doing it at all.
    - rfd4sgmk8u 5y ago
      There are some brilliant people out there. I have no doubt solidity experts can spot vulns by inspection. My point is that auditing is necessary but not sufficient. Its a greater issue in security where audits and testing can lead one into a false sense of security, 'because it is audited'. The original post was saying all the hacked contracts were 'unaudited'. While this is true, I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling.
      - latchkey 5y ago
        Agreed fully. Even with all the unit tests that I write, I still find logic bugs in my code. =) Software is hard!
      - danielvf 5y ago
        "I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling." That's not been my experience with good audits. Automated tooling only gets you so far. We use open source automated security tooling, unit tests, and and some formal proving, and audits have found things these didn't.
        rfd4sgmk8u 5y ago
        Would you be willing to share either reports or the name of the audit vendor that you trust?
        danielvf 5y ago
        Sure. Best auditor is https://openzeppelin.com/security-audits/ https://openzeppelin.com/security-audits/. Second might be https://www.trailofbits.com https://www.trailofbits.com. Here's the audit that just finished: https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20-%20October%202021.pdf https://github.com/OriginProtocol/security/blob/master/audit...
- CuriousCosmic 5y ago
  Interestingly the project was audited but the audit was very surface level and basically concluded with "the code is derived from another project and doesn't have any glaring flaws however the project itself lacks decentralisation in its oracle setup and lacks a formal spec which limits further auditability".

Cool website.

k__ 5y ago

unaudited unaudited unaudited unaudited unaudited unaudited well, well, well If it isn't the consequences of my own actions.

rfd4sgmk8u 5y ago
"auditing" means paying someone to run various open source solidity and EVM analysis tools and copy-pasting the results into a doc. Auditing really doesn't mean much. A lot of audited platforms get hacked. A lot of unaudited platforms get hacked. Nobody is ever accountable.
- dcolkitt 5y ago
  As someone paying a six figure invoice to have their project audited right now, it's really not that simple. Do audited projects get hacked? Yes, absolutely. Is a clean audit report mean a project is bullet proof. Definitely not, especially if it's not from a top-tier firm. But an audit will definitely catch any of the common exploits that are easy to make, like this protocol doesn't check to make sure that the caller is not currently inside another transaction in the contract. All in all, an unaudited protocol has at least an order of magnitude higher risk than one audited by a reputable firm. Ignoring audits altogether would be like refusing to lock your doors, because you heard about a house that still get robbed when the front door was locked.
  - danielvf 5y ago
    There's the Swiss cheese theory of accidents. Each layer may have holes in it, but by having enough layers and aggressively trying to shrink the number and size of holes in each layer, you can get much more secure. External audits by good teams are a good layer, but neither they, nor any other individual layer is a silver bullet. Good audits do provide a lot of value.
  - rfd4sgmk8u 5y ago
    Can you explain how it is not more simple than running open source tooling and copy pasting the results? I am yet to see an 'audit report' that is more than just this. Its checkbox compliance. Are you paying six figures for this? I agree that unaudited is worse. But what are you actually paying for with these clowns?
    - warkdarrior 5y ago
      There are plenty of audit companies that do a in-depth review of the code, a review of the protocol itself, etc., and come up with questions trying to understand the various execution flows. This goes beyond what current tools can do, it acts as a second pair of eyes to read through and understand all of the smart contracts.
    - danielvf 5y ago
      We've also paid for an audit from a leading company recently. You paying for a team of smart people to spend a couple weeks trying to break your system. It's not going to find everything, but everything that is found is a way that can't be attacked anymore.
- rodiger 5y ago
  This would have likely been caught in a standard audit. Flashloan attacks are incredibly well known and any auditor worth their salt will examine those scenarios
  - rfd4sgmk8u 5y ago
    Yeah, just like the thousand other times. These kinds of attacks rely on contract state and unbalance of tokens. They are quite difficult to detect statically.
  - danielvf 5y ago
    You are correct that flash loans are a part of the standard attack toolbox. This was not a standard attack though. It was a genuinely new attack vector that's not been seen before. Flash loan was just one hammer in the attacks toolbox. Remember anything a flashloan can do, a whale can do too.
- latchkey 5y ago
  I am friends with a top auditor. He is a genius. Two seconds of looking at a contract and he's found 10 holes. Auditing isn't perfect, but it is better than not doing it at all.
  - rfd4sgmk8u 5y ago
    There are some brilliant people out there. I have no doubt solidity experts can spot vulns by inspection. My point is that auditing is necessary but not sufficient. Its a greater issue in security where audits and testing can lead one into a false sense of security, 'because it is audited'. The original post was saying all the hacked contracts were 'unaudited'. While this is true, I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling.
    - latchkey 5y ago
      Agreed fully. Even with all the unit tests that I write, I still find logic bugs in my code. =) Software is hard!
    - danielvf 5y ago
      "I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling." That's not been my experience with good audits. Automated tooling only gets you so far. We use open source automated security tooling, unit tests, and and some formal proving, and audits have found things these didn't.
      - rfd4sgmk8u 5y ago
        Would you be willing to share either reports or the name of the audit vendor that you trust?
        danielvf 5y ago
        Sure. Best auditor is https://openzeppelin.com/security-audits/ https://openzeppelin.com/security-audits/. Second might be https://www.trailofbits.com https://www.trailofbits.com. Here's the audit that just finished: https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20-%20October%202021.pdf https://github.com/OriginProtocol/security/blob/master/audit...
CuriousCosmic 5y ago
Interestingly the project was audited but the audit was very surface level and basically concluded with "the code is derived from another project and doesn't have any glaring flaws however the project itself lacks decentralisation in its oracle setup and lacks a formal spec which limits further auditability".