4 ms·
From the bounty: "The Summary On 2/2/2022, I reported a critical security issue to Optimism—an "L2 scaling solution" for Ethereum—that would allow an attacker t
by jollybean 5y ago
From the bounty: "The Summary On 2/2/2022, I reported a critical security issue to Optimism—an "L2 scaling solution" for Ethereum—that would allow an attacker to replicate money on any chain using their "OVM 2.0" fork of go-ethereum (which they call l2geth)."
No - sorry - ETH doesn't get a 'pass' on this.
The 'Rest Of The World' is tired of the Crypto Scam Delusion masquerading as something reasonable and watching these critical failures getting swept under the rug.
This issue demonstrates that critical failures will exist in the wild (and it's wrong to suggest that they won't come up in the future - they will) creating an existential flaw for systems in which there is no intrinsic remedy. Forks by 'completely arbitrary central powers' entirely defeat the purpose.
Just last week we had the FBI arrest criminals laundering literally billions in Crypto.
It's a tiring fraud absorbing enormous amounts of attention and energy for no apparent benefit but entertainment.
The concept is currently fundamentally flawed, it belongs in 'side project' territory for now, not in the mainstream.
- fastball 5y agoBy definition an "L2 scaling solution" is not the Ethereum blockchain. Ethereum itself clearly is a secure blockchain given the fact that it has not been exploited directly ever, as far as I am aware. Smart contracts running in the EVM obviously have exploits galore, but that is different from Ethereum itself being vulnerable. Just like it is different when the Java Virtual Machine itself has an exploit (uncommon) vs when a program that runs in the JVM does (very common). You can of course argue that the lack of inherent soundness / correctness in Ethereum smart contracts makes the entire chain less useful since running smart contracts is kinda the whole point, but then you should make that argument rather than saying dumb things like: > ETH was an insecure blockchain
- CRConrad 5y ago> Ethereum itself clearly is a secure blockchain given the fact that it has not been exploited directly ever, as far as I am aware. Oh, so it can only be exploited indirectly. Yeah, wow, that makes it oh-so-secure.
- pshc 5y agoThis was a critical success for Optimism's bug bounty program, if anything? No one got rug pulled. Optimism's liquidity could have been drained in the worst case, and still ETH L1 would remain unaffected.
- jollybean 5y agoIt's great for a 'bounty program' - but it speaks negatively to the intercity of a system that is not supposed to have any centralised control.
- pshc 5y agoI think it speaks to the reality of a development process lead by humans in uncharted territory. Figure it out, audit it, test it for a long time, eventually cross fingers and blow the fuses. After that, either it successfully becomes a permanent public fixture, or maybe there's a small chance it implodes one day, who knows? Certainly anything that's absolutely mission critical should not live on these L2 networks yet.
- jollybean 5y ago"I think it speaks to the reality of a development process lead by humans in uncharted territory." Yes, exactly, and that's why we can't have distributed systems with 'no central authority' - if those systems are inherently and always faulty there needs to be intervention of some kind by an 'authority'. There is no such thing as a trestles system, the whole thing depends on webs of trust.