7 ms·

This highlights an incentive issue and a paradigm issue in the blockchain space. There is a strong incentive to get new protocols up and running and even though

This highlights an incentive issue and a paradigm issue in the blockchain space. There is a strong incentive to get new protocols up and running and even though users are technically responsible as they can audit the code, most users, of course, are not qualified to do so, and stand to make more from exploiting any vulnerabilities they find than they are pointing for them out. The issue of paradigm is just how poorly suited EVM is as a smart contract language. It is too hard to manage the complexity of bytecode with memory managed on chain and in contract code. When small errors have huge consequences and there are no second chances, EVM is and should be pointed out to be one of the worst standards Ethereum has brought to crypto. When it comes to high stakes programming and especially in a space where new programs are written quickly and often, its almost objectively obvious that functional styles with more guard rails is the better choice. Nothing running on chain needs an infinite loop or many other fancy features one typically expects from a programming language - restrictions and readability in smart contract code are more important to computational chains than seat-belts are to automobiles, but the network effect is slowing the space down. Edit: Some people have pointed out this was an issue with Solana contracts, which run on Rust - so I was wrong to use this as an example for half of my point, but still believe the point stands. Even Rust IMO is not tied down enough for contract code, but the fact that it can happen on Rust which is loads better then EVM for bug catching I think proves the point a bit more if anything.

berberous 5y ago
I think the exploit took place using Rust contracts on Solana.
vkou 5y ago
> most users, of course, are not qualified to do so, and stand to make more from exploiting any vulnerabilities they find than they are pointing for them out. The incentives are even worse then that. Participants who aren't active crooks are actively incentivized to not look for vulnerabilities, because the easiest way to make money in this space, but to sell to a bigger fool. The quality of the underlying 'investment' doesn't matter.
- danielvf 5y ago
  Crypto projects tend to be the best in the entire world about paying out bug bounties. The connection to dollars is really obvious. In the last three months there have million dollar plus bounties paid out. Here's an article from today about a million dollar bounty paid out: https://medium.com/immunefi/notional-double-counting-free-collateral-bugfix-review-28b634903934 https://medium.com/immunefi/notional-double-counting-free-co... Here's another whitehat save in the last two weeks of 480 million dollars: https://media.dedaub.com/phantom-functions-and-the-billion-dollar-no-op-c56f062ae49f https://media.dedaub.com/phantom-functions-and-the-billion-d...
  - verdverm 5y ago
    Imagine how many other world problems we could have solved of cryptos were not a thing. No scams, rugpulls, or bounties. All that money could have gone towards world hunger and climate change. Would that have been a better use of it for marginalized people?
    - astrange 5y ago
      Some things can't be solved with money. (Or rather, it would take infinite money to solve them in a given amount of time, but allow enough time and solving it is free.)
    - FireBeyond 5y ago
      All the energy saved...
    - deleted 5y ago
      [deleted]
    - deleted 5y ago
      [deleted]
    - PretzelPirate 5y ago
      Capital tends to get allocated where it can be the most product for its owner. The alternative to putting it into crypto would not have been to solve world hunger, climate change, or to create a more equitable world. It’s like saying “think of all the ways we could have made the world better if people didn’t invest in Apple.”
altspace 5y ago
You’ll like stacks.co
danielvf 5y ago
This was on the Solana side of a Solana to Ethereum bridge. The vulnerable code was written in rust, and living on the Solana side. Not an EVM issue or EVM code.
- seibelj 5y ago
  But Rust is memory safe! How can it ever have a bug? /s
narrator 5y ago
I think the trippiest bit of cryptocurrency economics I have ever witnessed is how Ethereum and Ethereum Classic forked after the DAO hack and both chains were still worth considerable market caps. It blew my mind. What matters is the order book. How many bid/asks are there on it. The contracts and debts outstanding in it. That's all there is. Everything else. Store of value. Whatever. Doesn't matter. Cryptocurrency is people persuading each other to do things in an organized fashion, believing there will be reciprocation at some later date. I wish we had someone around who really understood currency at a deep level like F.A Hayek to write about crypto economics in a painfully cerebral careful way that avoids all handwaving. There is something very deep going on here that is entirely new or very old and never quite clearly elucidated.
- atmb4u 5y ago
  Insightful comment. Do you have some books or resource recommendation to learn more on this topic?
  - narrator 5y ago
    F.A Hayek wrote a book titled "The Denationalization of Money" in the 70s where he predicted that we'd have competing private currencies not tied to any government at some point. Reading Hayek is difficult because he writes in a very intellectually dense style with very long sentences that assume the reader is already familiar with a lot of technical jargon. Here's a more general introduction to some of his ideas on private currencies with footnotes pointing to the source material: https://mises.org/wire/will-cryptos-fulfill-hayeks-vision-private-de-nationalized-money https://mises.org/wire/will-cryptos-fulfill-hayeks-vision-pr...
- mattwilsonn888 5y ago
  Get rid of 'store of value,' 'decentralization,' 'smart contracts' and all that's left is a ledger. Its really not that complex or special - if that's what fascinates you then you can just as easily approach the topic from the examples of traditional credit or even the history of semi-arbitrary currencies. If your implication is that the only thing backing crypto currencies is an expectation of reciprocation then you are mistaken. The qualities you want to hand waive away, and most importantly (though often trivialized), is the inability to roll back the chain which is a function of "consensus power." Consensus power simply quantifies the cost of rolling back x blocks. Bitcoin currently has the highest cost to roll back blocks and therefore the most assurance.
vmception 5y ago
exploit on Solana side, minted wrap ether and moved that over the bridge. only the solana side was partially uncollateralized fascinating hack actually
secondaryacct 5y ago
Did the cavemen finally rewind all of history to finally rediscover while we organized around justice, legislation and law enforcement or we're still waiting for a few more fortunes lost ?
nootropicat 5y ago
Pretty much all recent bugs are logic errors which have nothing to do with the language. The actual bugs are often things like typos that use > instead of >=, lagging price oracles or using oracles that can be manipulated. You asserted that loops are 'insecure' but in reality dumb restrictions only force people to invent complex workarounds to obtain the same functionality, making everything less secure, not more. The absolute disaster of trying to make dexes work on Cardano is the best recent example. Their 'safe' utxo design is so limiting dexes like Sundae had to implement a trust-based sidechain just to be able to trade tokens, and it barely works. After years of iteration, Solidity is now the safest smart contract language in existence. All common pitfalls are either well known or have been fixed. There are code analyzers. The problem with EVM isn't security, but the fact its word is 32 byte long which limits computational performance - but not that much really.
- pfraze 5y ago
  Hard to be definitive about this kind of analysis, but it’s interesting to look at some surveys (https://medium.com/solidified/most-common-smart-contract-bugs-of-2020-c1edfe9340ac https://medium.com/solidified/most-common-smart-contract-bug...).
- krmmalik 5y ago
  What about the DAML smart contract language? It's currently being used to digitalise the world's largest stock exchange (Hong Kong) and the Australian Securities exchange

berberous 5y ago

I think the exploit took place using Rust contracts on Solana.

vkou 5y ago

> most users, of course, are not qualified to do so, and stand to make more from exploiting any vulnerabilities they find than they are pointing for them out. The incentives are even worse then that. Participants who aren't active crooks are actively incentivized to not look for vulnerabilities, because the easiest way to make money in this space, but to sell to a bigger fool. The quality of the underlying 'investment' doesn't matter.

danielvf 5y ago
Crypto projects tend to be the best in the entire world about paying out bug bounties. The connection to dollars is really obvious. In the last three months there have million dollar plus bounties paid out. Here's an article from today about a million dollar bounty paid out: https://medium.com/immunefi/notional-double-counting-free-collateral-bugfix-review-28b634903934 https://medium.com/immunefi/notional-double-counting-free-co... Here's another whitehat save in the last two weeks of 480 million dollars: https://media.dedaub.com/phantom-functions-and-the-billion-dollar-no-op-c56f062ae49f https://media.dedaub.com/phantom-functions-and-the-billion-d...
- verdverm 5y ago
  Imagine how many other world problems we could have solved of cryptos were not a thing. No scams, rugpulls, or bounties. All that money could have gone towards world hunger and climate change. Would that have been a better use of it for marginalized people?
  - astrange 5y ago
    Some things can't be solved with money. (Or rather, it would take infinite money to solve them in a given amount of time, but allow enough time and solving it is free.)
  - FireBeyond 5y ago
    All the energy saved...
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
  - PretzelPirate 5y ago
    Capital tends to get allocated where it can be the most product for its owner. The alternative to putting it into crypto would not have been to solve world hunger, climate change, or to create a more equitable world. It’s like saying “think of all the ways we could have made the world better if people didn’t invest in Apple.”

altspace 5y ago

You’ll like stacks.co

danielvf 5y ago

This was on the Solana side of a Solana to Ethereum bridge. The vulnerable code was written in rust, and living on the Solana side. Not an EVM issue or EVM code.

seibelj 5y ago
But Rust is memory safe! How can it ever have a bug? /s

narrator 5y ago

I think the trippiest bit of cryptocurrency economics I have ever witnessed is how Ethereum and Ethereum Classic forked after the DAO hack and both chains were still worth considerable market caps. It blew my mind. What matters is the order book. How many bid/asks are there on it. The contracts and debts outstanding in it. That's all there is. Everything else. Store of value. Whatever. Doesn't matter. Cryptocurrency is people persuading each other to do things in an organized fashion, believing there will be reciprocation at some later date. I wish we had someone around who really understood currency at a deep level like F.A Hayek to write about crypto economics in a painfully cerebral careful way that avoids all handwaving. There is something very deep going on here that is entirely new or very old and never quite clearly elucidated.

atmb4u 5y ago
Insightful comment. Do you have some books or resource recommendation to learn more on this topic?
- narrator 5y ago
  F.A Hayek wrote a book titled "The Denationalization of Money" in the 70s where he predicted that we'd have competing private currencies not tied to any government at some point. Reading Hayek is difficult because he writes in a very intellectually dense style with very long sentences that assume the reader is already familiar with a lot of technical jargon. Here's a more general introduction to some of his ideas on private currencies with footnotes pointing to the source material: https://mises.org/wire/will-cryptos-fulfill-hayeks-vision-private-de-nationalized-money https://mises.org/wire/will-cryptos-fulfill-hayeks-vision-pr...
mattwilsonn888 5y ago
Get rid of 'store of value,' 'decentralization,' 'smart contracts' and all that's left is a ledger. Its really not that complex or special - if that's what fascinates you then you can just as easily approach the topic from the examples of traditional credit or even the history of semi-arbitrary currencies. If your implication is that the only thing backing crypto currencies is an expectation of reciprocation then you are mistaken. The qualities you want to hand waive away, and most importantly (though often trivialized), is the inability to roll back the chain which is a function of "consensus power." Consensus power simply quantifies the cost of rolling back x blocks. Bitcoin currently has the highest cost to roll back blocks and therefore the most assurance.

vmception 5y ago

exploit on Solana side, minted wrap ether and moved that over the bridge. only the solana side was partially uncollateralized fascinating hack actually

secondaryacct 5y ago

Did the cavemen finally rewind all of history to finally rediscover while we organized around justice, legislation and law enforcement or we're still waiting for a few more fortunes lost ?

nootropicat 5y ago

Pretty much all recent bugs are logic errors which have nothing to do with the language. The actual bugs are often things like typos that use > instead of >=, lagging price oracles or using oracles that can be manipulated. You asserted that loops are 'insecure' but in reality dumb restrictions only force people to invent complex workarounds to obtain the same functionality, making everything less secure, not more. The absolute disaster of trying to make dexes work on Cardano is the best recent example. Their 'safe' utxo design is so limiting dexes like Sundae had to implement a trust-based sidechain just to be able to trade tokens, and it barely works. After years of iteration, Solidity is now the safest smart contract language in existence. All common pitfalls are either well known or have been fixed. There are code analyzers. The problem with EVM isn't security, but the fact its word is 32 byte long which limits computational performance - but not that much really.

pfraze 5y ago
Hard to be definitive about this kind of analysis, but it’s interesting to look at some surveys (https://medium.com/solidified/most-common-smart-contract-bugs-of-2020-c1edfe9340ac https://medium.com/solidified/most-common-smart-contract-bug...).
krmmalik 5y ago
What about the DAML smart contract language? It's currently being used to digitalise the world's largest stock exchange (Hong Kong) and the Australian Securities exchange