4 ms·

> The loophole was not a bug or an exploit, according to the NFT marketplace, but rather a user interface issue that occurs when a user creates a listing, then

> The loophole was not a bug or an exploit, according to the NFT marketplace, but rather a user interface issue that occurs when a user creates a listing, then transfers the NFT to a different wallet. lol, what? I don't know anything about OpenSea and this ridiculous NFT generated ape business, but this is a comical quote.

guiambros 5y ago
Yeah, it's bad for OpenSea, and another example that the achilles heel of web3 are the (centralized) web interfaces on top of it. In this specific case, the NFT owners had, at some point in time, listed their assets for sale on OpenSea. The issue was that you could re-list (e.g., at a higher price) and the transition would be stored in OpenSea's off-chain db, but not complete the on-chain cancellation (supposedly because the user didn't want to pay gas fees, and/or the UI was confusing). OpenSea would show the transaction cancelled/relisted in their UI, but the on-chain contract still had the item for sale using the original price. If you know where to look, you could skip OpenSea's UI and interact with the contract directly, thus yielding a handful of Bored Apes for a fraction of their current price. Clearly folks exploited a loophole, but at the same time "code is law" and all of that, and clearly OpenSea's fault for not preventing this from happening in the first place, so it doesn't surprise me they are stepping in and covering the costs. This thread has the full details: https://twitter.com/yakirrotem/status/1485559864948629512 https://twitter.com/yakirrotem/status/1485559864948629512
- chottocharaii 5y ago
  “code is law” … until it isn’t between this and the original DAO fork, crypto fans fail on even their own terms
- sorokod 5y ago
  Thanks for the explanation. My guess is there will always be some sort of gap between the centralized and the de-centralized web3 (otherwise there would be no reason for the centralized) and that gap will always be a source of exploits.
  - tluyben2 5y ago
    The way this works this way now is because of gas costs as ai understand it; is not the dream of these people to get these costs low enough that you can do it all on chain? If not, it seems the basics will be indeed broken forever.
    - UncleMeat 5y ago
      That's the dream. We will see if it ends up being a reality. But for the last decade we've seen a similar pattern as various chains become popular: fee costs rise dramatically. ETH intends to be a global computer for everybody. Imagine if the number of smart contracts went up by 100x. 1000x. 10,000x. This isn't the sort of thing that you can scale by simply buying more machines in a datacenter. Maybe people will solve the fee problem, but if they don't then this is going to become an even bigger problem as virtually nobody will ever want to transact on chain because of incredibly high fees.
      - PretzelPirate 5y ago
        Zero-Knowledge Proof Rollups (ZK Rollups) with Data Availability Committees (or off-chain data availability for lower security situations) actually provide a fantastic balance of high scale+cheap (or free) transactions. The downside is that code of running machines that can create and validate the ZK Proof, but since these systems can be more centralized without sacrificing anti-censorship properties, it’s more practical than it seems. For people who aren’t convinced that ZK Proofs will be feasible due to the prover cost, Optimistic Rollups with the same data availability management systems also provide cheap/free transactions with the downside that moving assets off of them takes days to weeks. Zero-Knowledge proof applications have been accelerated by the blockchain research community and they are, most likely, the solution to the fee problem while maintaining the security of users (which ‘high-scale, cheap blockchains’ just can’t do).
        UncleMeat 5y ago
        This is the current most promising solution, yes. But it remains a promising solution rather than a proven solution at this point. We've seen a variety of attempts to solve this problem over time and we've largely moved from one to the other without truly landing them. I'm not saying that there won't be a solution. Only that there needs to be a solution.
mint2 5y ago
Slumlord taking notes: “those are not roaches or bugs they’re just a number of small objects with exoskeletons, antenna, an aversion to light and attraction to crumbs.”

guiambros 5y ago

Yeah, it's bad for OpenSea, and another example that the achilles heel of web3 are the (centralized) web interfaces on top of it. In this specific case, the NFT owners had, at some point in time, listed their assets for sale on OpenSea. The issue was that you could re-list (e.g., at a higher price) and the transition would be stored in OpenSea's off-chain db, but not complete the on-chain cancellation (supposedly because the user didn't want to pay gas fees, and/or the UI was confusing). OpenSea would show the transaction cancelled/relisted in their UI, but the on-chain contract still had the item for sale using the original price. If you know where to look, you could skip OpenSea's UI and interact with the contract directly, thus yielding a handful of Bored Apes for a fraction of their current price. Clearly folks exploited a loophole, but at the same time "code is law" and all of that, and clearly OpenSea's fault for not preventing this from happening in the first place, so it doesn't surprise me they are stepping in and covering the costs. This thread has the full details: https://twitter.com/yakirrotem/status/1485559864948629512 https://twitter.com/yakirrotem/status/1485559864948629512

chottocharaii 5y ago
“code is law” … until it isn’t between this and the original DAO fork, crypto fans fail on even their own terms
sorokod 5y ago
Thanks for the explanation. My guess is there will always be some sort of gap between the centralized and the de-centralized web3 (otherwise there would be no reason for the centralized) and that gap will always be a source of exploits.
- tluyben2 5y ago
  The way this works this way now is because of gas costs as ai understand it; is not the dream of these people to get these costs low enough that you can do it all on chain? If not, it seems the basics will be indeed broken forever.
  - UncleMeat 5y ago
    That's the dream. We will see if it ends up being a reality. But for the last decade we've seen a similar pattern as various chains become popular: fee costs rise dramatically. ETH intends to be a global computer for everybody. Imagine if the number of smart contracts went up by 100x. 1000x. 10,000x. This isn't the sort of thing that you can scale by simply buying more machines in a datacenter. Maybe people will solve the fee problem, but if they don't then this is going to become an even bigger problem as virtually nobody will ever want to transact on chain because of incredibly high fees.
    - PretzelPirate 5y ago
      Zero-Knowledge Proof Rollups (ZK Rollups) with Data Availability Committees (or off-chain data availability for lower security situations) actually provide a fantastic balance of high scale+cheap (or free) transactions. The downside is that code of running machines that can create and validate the ZK Proof, but since these systems can be more centralized without sacrificing anti-censorship properties, it’s more practical than it seems. For people who aren’t convinced that ZK Proofs will be feasible due to the prover cost, Optimistic Rollups with the same data availability management systems also provide cheap/free transactions with the downside that moving assets off of them takes days to weeks. Zero-Knowledge proof applications have been accelerated by the blockchain research community and they are, most likely, the solution to the fee problem while maintaining the security of users (which ‘high-scale, cheap blockchains’ just can’t do).
      - UncleMeat 5y ago
        This is the current most promising solution, yes. But it remains a promising solution rather than a proven solution at this point. We've seen a variety of attempts to solve this problem over time and we've largely moved from one to the other without truly landing them. I'm not saying that there won't be a solution. Only that there needs to be a solution.

mint2 5y ago

Slumlord taking notes: “those are not roaches or bugs they’re just a number of small objects with exoskeletons, antenna, an aversion to light and attraction to crumbs.”