6 ms·

This just proves how insecure the blockchain / web3 / cryptocurrency space is. It's good to see white hat hackers in this space trying to fix what is already b

This just proves how insecure the blockchain / web3 / cryptocurrency space is. It's good to see white hat hackers in this space trying to fix what is already broken. But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid.

__MatrixMan__ 5y ago
Do you think that a bank or a government would've handled fixing such a flaw as well has optimism did? All tokenization schemes are ponzi scams including USD, it's just that some use violence to stay relevant, and other use bug bounties.
- jollybean 5y ago
  "Do you think that a bank or a government would've handled fixing such a flaw as well has optimism did?" It's irrelevant. We don't use 'algorithms as ownership' in the real world. We use social agreements like contract law to undo problems. "All tokenization schemes are ponzi scams including USD, it's just that some use violence to stay relevant, and other use bug bounties." We use the law to maintain civil infrastructure. Yes, if someone wants to murder you or someone else, or launder billions, we'll use violence to stop them. An algorithm that is effectively used as a Pyramid Scheme is not going to save your from anything.
  - __MatrixMan__ 5y ago
    It can take years for contract law to get in front of a judge and be enforced, often the damage that can be done in that interval is significant. So I think they timeliness is indeed relevant. As for your murder comment, I'm not saying that violence is strictly unnecessary, just that the coincidence of "we have the guns" with "we issue the ponzi tokens" is probably not the only way to enforce the law.
    - CRConrad 5y ago
      > the coincidence of "we have the guns" with "we issue the ponzi tokens" is probably not the only way to enforce the law. Not "the only way", perhaps, but AFAICS the only way that makes sense. Sure, "the law is an ass" and "the querns of law grind exceedingly slow" and all that... But still, it's the worst alternative except for having no law, right? So if you want the rule of law, the law needs to have the biggest guns. And why would anyone want anyone but the law to issue the tokens of lawful commerce?
- skizm 5y ago
  Banks or stock exchanges would just revert any bad transactions like they do with most scams, thefts, or accidents. It is built into the current system by design.
  - __MatrixMan__ 5y ago
    They revert the money (if they like you), but usually if money flows one way, something else flows the other way, and they can't revert that half of the fraudulent transactions without great expenditure. Often it's not worth it and they just write it off and the whole economy bears the cost. I'm not saying it's a better or worse plan than whatever might happen under an alternative system, but just that it's not exactly a clean solution either.
    - NovemberWhiskey 5y ago
      I think your premise is fundamentally wrong there. Say I buy something my credit card but it's never delivered. My bank will reverse that transaction - exactly because half of the transaction never occurred. The way that the credit card system works in the US is fundamentally biased towards consumer protection, because that's an explicit policy objective. The same with the Direct Debit guarantee in the UK, or the various laws which limit the maximum exposure due to fraudulent use of payment cards. And when exchanges break trades, they undo the entire transaction - you don't end up with one party out cash or shares.
      - __MatrixMan__ 5y ago
        The lack of agility shows up when I buy something with your credit card number. It gets delivered, and then the bank reverses the transaction because they later learn that I'm not you. Now I get a bank-subsidized thing and you're not missing any money. It creates a drag on the whole economy, because instead of doing productive work to get the thing, it's often easier to play games with the system. The fact that credit cards use a symmetric key to authorize spend is a glaring flaw. The technology to fix it (asymmetric key cryptography) has been around for decades. But instead of fixing it, the credit card companies just keep writing off the instances of fraud.
- colesantiago 5y ago
  I have no problem with white hat hackers, I'm saying more power to them in the broken web3 space, which that is a complete scam. However, I can use USD, GBP or any fiat currency in my local grocery store. Can I use Bitcoin, Shib, Doge, or even Orchid at my grocery store without waiting hours in the queue for the transaction to complete and no huge fees?
  - __MatrixMan__ 5y ago
    Not yet, but I don't think that we're too far away from using USD, GBP or any fiat currency as a unit of account at the POS and letting software handle ensuring that the buyer loses whatever assets they want to pay in and the seller receives whatever assets they want to be paid in. But that's orthogonal to how quickly the maintainers of these tokens can make changes in response to threats.
    - colesantiago 5y ago
      So no then? Over a decade later and I still cannot use any of them at the restaurant or without waiting in the queue for the transaction to settle and paying more for the fees than the goods itself.
      - __MatrixMan__ 5y ago
        It took 100 years for steam engines to start outperforming horses, why is it so damning that crypto isn't yet outperforming fiat after a decade and change?
        CRConrad 5y ago
        Please stop using "crypto" and "fiat" as if they were opposites. "Crypto" is just as "fiat" as any Royal Mint; it's just that the fiat-ers[1] are different people. They just want to muscle in on the "make the tokens that everyone else's transactions are counted in" business niche, because they reckon the makers can always somehow skim a bit off the top. ___ [1]: lit. "makers": "Fiat" is Latin for "let there be made", a form of the verb "to make". It's a cognate of modern French "faire", Italian "fare", etc. (Related words are "fact" and "factory".)
- jokethrowaway 5y ago
  I agree the government would be way worse at dealing with this flaw - but they probably would have just reversed whatever exploited transactions they needed. Or even just printed some more money to make everyone pay at the latest.
- Sparkyte 5y ago
  To be fair we should be weary of both systems. Crypto isn't something sustainable in the long run. USD isn't a ponzi scheme, it is backed by commerce. Crypto isn't the multi sales and trades of goods are what dictate the value of the currency.
birracerveza 5y ago
>But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid. Seems like just an opinion to me, and a poorly opinionated one at that.
- colesantiago 5y ago
  Can you name any examples of cryptocurrencies being used that are not scams, ponzi schemes or for speculative purposes? All I see are people holding coins and not using them at all for anything else other than 'I want coin to go up'.
  - pg5 5y ago
    Helium has practical uses - a cheaper alternative to cellular data for stuff like Lime scooters.
    - CRConrad 5y ago
      The only practical uses of Helium are for weather balloons and for making your voice hilariously squeaky.
    - colesantiago 5y ago
      This can be done without the need for a blockchain. Adding a new technology + blockchain + a coin still makes it ponzi scheme scam, even worse when the price of this coin comes crashing down.
      - kristofferR 5y ago
        Why would individuals buy relatively expensive equipment, set it up and manage it, without the potential for return on their investments? The only reason Helium's LoRaWAN coverage is expanding rapidly is due to the crypto aspects of it.
        colesantiago 5y ago
whitepaint 5y ago
Tell me you don't know what DeFi is without telling me you don't know what DeFi is.
- colesantiago 5y ago
  What is the process of getting your money back from a hacked DeFi project? Why do I have to pay more fees to swap tokens on decentralised exchanges making them unusable, and how exactly is DeFi decentralised?
  - whitepaint 5y ago
    > Why do I have to pay more fees to swap tokens on decentralised exchanges making them unusable Wait for ETH 2.0. It's a really difficult problem to solve. In the meantime though, use Polygon (or other side chains). Swap tokens for a cent or two. > how exactly is DeFi decentralised Take a protocol like app.uniswap.org or pooltogether.com. If you have an internet connection, no one can stop you from using these protocols (and many other protocols). No arbitrary rules imposed by governments or companies. Your funds are your funds, there are no arbiters (just tens of thousands of Ethereum nodes which are responsible for settling transactions). > What is the process of getting your money back from a hacked DeFi project? Use protocols that have been around for a long time and have hundreds of millions, billions, or even tens of billions of dollars locked in. That decreases chances of you losing funds. But it is a problem, I agree, hopefully somehow we will make it better.
    - colesantiago 5y ago
      > Why do I have to pay more fees to swap tokens on decentralised exchanges making them unusable So I still have to wait at least 2023 (2025 or 2026 for a realistic possibility of merchant adoption) for ETH 2.0 to be used? I don't think merchants would want to wait for something that is not complete and unregulated. You do realise that ETH 2.0 has nothing to do with lowering fees? So all the DeFi apps using it will still be unusable anyway. > If you have an internet connection, no one can stop you from using these protocols (and many other protocols)...(just tens of thousands of Ethereum nodes which are responsible for settling transactions). Aren't most of these Ethereum nodes and DeFi exchanges on AWS like dydx? It went down a few months ago no? [0] That doesn't sound decentralised to me. > Use protocols that have been around for a long time...That decreases chances of you losing funds. But it is a problem So I can't get my money back then? I see DeFi hacks everyday and not getting my money back doesn't help either. Makes robbing a bank less attractive for criminals and instead target DeFi projects. [0] https://twitter.com/dydxprotocol/status/1468293558360805381 https://twitter.com/dydxprotocol/status/1468293558360805381
vmception 5y ago
It just proves that particular project had an exploit and a decent bug bounty program. Its nice that this person used the bug bounty program. Other organization bounties should go higher. Especially Web2 ones.

__MatrixMan__ 5y ago

Do you think that a bank or a government would've handled fixing such a flaw as well has optimism did? All tokenization schemes are ponzi scams including USD, it's just that some use violence to stay relevant, and other use bug bounties.

jollybean 5y ago
"Do you think that a bank or a government would've handled fixing such a flaw as well has optimism did?" It's irrelevant. We don't use 'algorithms as ownership' in the real world. We use social agreements like contract law to undo problems. "All tokenization schemes are ponzi scams including USD, it's just that some use violence to stay relevant, and other use bug bounties." We use the law to maintain civil infrastructure. Yes, if someone wants to murder you or someone else, or launder billions, we'll use violence to stop them. An algorithm that is effectively used as a Pyramid Scheme is not going to save your from anything.
- __MatrixMan__ 5y ago
  It can take years for contract law to get in front of a judge and be enforced, often the damage that can be done in that interval is significant. So I think they timeliness is indeed relevant. As for your murder comment, I'm not saying that violence is strictly unnecessary, just that the coincidence of "we have the guns" with "we issue the ponzi tokens" is probably not the only way to enforce the law.
  - CRConrad 5y ago
    > the coincidence of "we have the guns" with "we issue the ponzi tokens" is probably not the only way to enforce the law. Not "the only way", perhaps, but AFAICS the only way that makes sense. Sure, "the law is an ass" and "the querns of law grind exceedingly slow" and all that... But still, it's the worst alternative except for having no law, right? So if you want the rule of law, the law needs to have the biggest guns. And why would anyone want anyone but the law to issue the tokens of lawful commerce?
skizm 5y ago
Banks or stock exchanges would just revert any bad transactions like they do with most scams, thefts, or accidents. It is built into the current system by design.
- __MatrixMan__ 5y ago
  They revert the money (if they like you), but usually if money flows one way, something else flows the other way, and they can't revert that half of the fraudulent transactions without great expenditure. Often it's not worth it and they just write it off and the whole economy bears the cost. I'm not saying it's a better or worse plan than whatever might happen under an alternative system, but just that it's not exactly a clean solution either.
  - NovemberWhiskey 5y ago
    I think your premise is fundamentally wrong there. Say I buy something my credit card but it's never delivered. My bank will reverse that transaction - exactly because half of the transaction never occurred. The way that the credit card system works in the US is fundamentally biased towards consumer protection, because that's an explicit policy objective. The same with the Direct Debit guarantee in the UK, or the various laws which limit the maximum exposure due to fraudulent use of payment cards. And when exchanges break trades, they undo the entire transaction - you don't end up with one party out cash or shares.
    - __MatrixMan__ 5y ago
      The lack of agility shows up when I buy something with your credit card number. It gets delivered, and then the bank reverses the transaction because they later learn that I'm not you. Now I get a bank-subsidized thing and you're not missing any money. It creates a drag on the whole economy, because instead of doing productive work to get the thing, it's often easier to play games with the system. The fact that credit cards use a symmetric key to authorize spend is a glaring flaw. The technology to fix it (asymmetric key cryptography) has been around for decades. But instead of fixing it, the credit card companies just keep writing off the instances of fraud.
colesantiago 5y ago
I have no problem with white hat hackers, I'm saying more power to them in the broken web3 space, which that is a complete scam. However, I can use USD, GBP or any fiat currency in my local grocery store. Can I use Bitcoin, Shib, Doge, or even Orchid at my grocery store without waiting hours in the queue for the transaction to complete and no huge fees?
- __MatrixMan__ 5y ago
  Not yet, but I don't think that we're too far away from using USD, GBP or any fiat currency as a unit of account at the POS and letting software handle ensuring that the buyer loses whatever assets they want to pay in and the seller receives whatever assets they want to be paid in. But that's orthogonal to how quickly the maintainers of these tokens can make changes in response to threats.
  - colesantiago 5y ago
    So no then? Over a decade later and I still cannot use any of them at the restaurant or without waiting in the queue for the transaction to settle and paying more for the fees than the goods itself.
    - __MatrixMan__ 5y ago
      It took 100 years for steam engines to start outperforming horses, why is it so damning that crypto isn't yet outperforming fiat after a decade and change?
      - CRConrad 5y ago
        Please stop using "crypto" and "fiat" as if they were opposites. "Crypto" is just as "fiat" as any Royal Mint; it's just that the fiat-ers[1] are different people. They just want to muscle in on the "make the tokens that everyone else's transactions are counted in" business niche, because they reckon the makers can always somehow skim a bit off the top. ___ [1]: lit. "makers": "Fiat" is Latin for "let there be made", a form of the verb "to make". It's a cognate of modern French "faire", Italian "fare", etc. (Related words are "fact" and "factory".)
jokethrowaway 5y ago
I agree the government would be way worse at dealing with this flaw - but they probably would have just reversed whatever exploited transactions they needed. Or even just printed some more money to make everyone pay at the latest.
Sparkyte 5y ago
To be fair we should be weary of both systems. Crypto isn't something sustainable in the long run. USD isn't a ponzi scheme, it is backed by commerce. Crypto isn't the multi sales and trades of goods are what dictate the value of the currency.

birracerveza 5y ago

>But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid. Seems like just an opinion to me, and a poorly opinionated one at that.

colesantiago 5y ago
Can you name any examples of cryptocurrencies being used that are not scams, ponzi schemes or for speculative purposes? All I see are people holding coins and not using them at all for anything else other than 'I want coin to go up'.
- pg5 5y ago
  Helium has practical uses - a cheaper alternative to cellular data for stuff like Lime scooters.
  - CRConrad 5y ago
    The only practical uses of Helium are for weather balloons and for making your voice hilariously squeaky.
  - colesantiago 5y ago
    This can be done without the need for a blockchain. Adding a new technology + blockchain + a coin still makes it ponzi scheme scam, even worse when the price of this coin comes crashing down.
    - kristofferR 5y ago
      Why would individuals buy relatively expensive equipment, set it up and manage it, without the potential for return on their investments? The only reason Helium's LoRaWAN coverage is expanding rapidly is due to the crypto aspects of it.
      - colesantiago 5y ago

whitepaint 5y ago

Tell me you don't know what DeFi is without telling me you don't know what DeFi is.

colesantiago 5y ago
What is the process of getting your money back from a hacked DeFi project? Why do I have to pay more fees to swap tokens on decentralised exchanges making them unusable, and how exactly is DeFi decentralised?
- whitepaint 5y ago
  > Why do I have to pay more fees to swap tokens on decentralised exchanges making them unusable Wait for ETH 2.0. It's a really difficult problem to solve. In the meantime though, use Polygon (or other side chains). Swap tokens for a cent or two. > how exactly is DeFi decentralised Take a protocol like app.uniswap.org or pooltogether.com. If you have an internet connection, no one can stop you from using these protocols (and many other protocols). No arbitrary rules imposed by governments or companies. Your funds are your funds, there are no arbiters (just tens of thousands of Ethereum nodes which are responsible for settling transactions). > What is the process of getting your money back from a hacked DeFi project? Use protocols that have been around for a long time and have hundreds of millions, billions, or even tens of billions of dollars locked in. That decreases chances of you losing funds. But it is a problem, I agree, hopefully somehow we will make it better.
  - colesantiago 5y ago
    > Why do I have to pay more fees to swap tokens on decentralised exchanges making them unusable So I still have to wait at least 2023 (2025 or 2026 for a realistic possibility of merchant adoption) for ETH 2.0 to be used? I don't think merchants would want to wait for something that is not complete and unregulated. You do realise that ETH 2.0 has nothing to do with lowering fees? So all the DeFi apps using it will still be unusable anyway. > If you have an internet connection, no one can stop you from using these protocols (and many other protocols)...(just tens of thousands of Ethereum nodes which are responsible for settling transactions). Aren't most of these Ethereum nodes and DeFi exchanges on AWS like dydx? It went down a few months ago no? [0] That doesn't sound decentralised to me. > Use protocols that have been around for a long time...That decreases chances of you losing funds. But it is a problem So I can't get my money back then? I see DeFi hacks everyday and not getting my money back doesn't help either. Makes robbing a bank less attractive for criminals and instead target DeFi projects. [0] https://twitter.com/dydxprotocol/status/1468293558360805381 https://twitter.com/dydxprotocol/status/1468293558360805381

vmception 5y ago

It just proves that particular project had an exploit and a decent bug bounty program. Its nice that this person used the bug bounty program. Other organization bounties should go higher. Especially Web2 ones.