4 ms·

So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked

So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked for major computer companies; I was a computer science professor; I have apps on the App Store. In spite of all of this, I have not the foggiest idea, even after reading the thread, how someone who offers to give me something can use the gift to steal from me. Surely this says that the world at least of ETH (whatever that is) is really really broken!

dlubarov 5y ago
I don't think the NFT is very important here; basically the scammer's website asked the victim's wallet to sign a message, using the private key that holds their ETH. It looks like the message in this case would have given the attacker permission to transfer the victim's aWETH, which represents ETH that has been deposited into an Aave lending pool. These transfer permissions are something all ERC-20 tokens support. Typically users will only sign messages sent from trusted websites, just as they would only install software from trusted sources. Or they can sign a questionable message from a separate wallet which doesn't hold much value, as the victim did here. Granted, this isn't a great situation. It can be hard to know which websites to trust, and even trusted websites can be hacked and then send malicious messages to unsuspecting users.
labrador 5y ago
According to this talk about NFTs, an NFT can contain code and the execution of that code can be triggered to do unsafe things. at 1:22:50 Smart contracts are just code, they’re software, there’s no reason they can’t be viruses or worms, the primary limitation is processing power. But, also, it’s a virus that someone can drop directly into your bankless bank account and just wait for you to activate it. And, yeah, that’s right, there’s no offer/confirmation step in sending tokens back and forth, someone who knows your wallet can just drop stuff right into it, so, like, pin that somewhere in your brain. Line Goes Up – The Problem With NFTs https://youtu.be/YQ_xWvX1n9g?t=4970 https://youtu.be/YQ_xWvX1n9g?t=4970
- dlubarov 5y ago
  FWIW it doesn't seem that's what happened in this case. It seems the NFT was just part of the attacker's ruse, where they told a story about some NFT staking dapp they launched. Then the malicious dapp asked for permission to transfer the victim's aWETH tokens. This is just part of the ERC-20 API, unrelated to NFTs. While it's true that NFTs can be sent without permission and can contain code, users normally invoke contracts via (hopefully trusted) dapp websites, such as app.uniswap.org. Invoking code from an NFT I found in my wallet is possible, but not part of any normal/legitimate workflow that I'm aware of.
fleddr 5y ago
It wasn't just giving something. The NFT was given, but this in itself does nothing. The victim was then asked to stake that NFT. To stake an NFT, the smart contract that does the staking needs access to your wallet. This too is normal. Except that the permission prompt asked for approval on another smart contract by means of a misleading name. There's nothing broken here. A smart contract is just a piece of code that moves money. You better be sure about what it's doing before you allow it to run. There's blue chip smart contracts that are proven and thoroughly audited, but anything else you need to read the code. Same as reading a contract before you sign it.
blihp 5y ago
Basically it was the smart contract[1] that came with the NFT where the victim is essentially executing foreign code that gets granted access to their digital wallet. That's the reason the scammers were so insistent that he did it on his main wallet (i.e. where the funds were) [1] Think of these as being similar to Word or Excel macros embedded in a document... nothing bad ever happened with them, did it? ;-)
sumedh 5y ago
> but stories like this make me think that crypto can never become mainstream. We had illegal p2p sharing where you could download a virus from bad people and then Jobs came along and made iTunes which set the standard for streaming. I am sure someone will come along in the crypto space and make crypto easy for the rest of us.
- alex504 5y ago
  itunes isnt p2p
  - sumedh 5y ago
    You missed the point. People wanted easy access to music, itunes provided that service. Right now with the world of crypto is confusing to the average guy, so hopefully in the future someone will create a good UX and the underlying to protocol for instant decentralised payments.
    - l33t2328 5y ago
      Or they could use a bank. They generally have fine UIs and secure protocols.
      - sumedh 5y ago
        and how are you going to pay when the bank closes your account because you broke their terms and conditions. That is where you need decentralized payments.
        l33t2328 5y ago
        This simply doesn’t happen at a rate nearly high enough to make griftocurrency a “need”
    - fragmede 5y ago
      The subtleties of crypto are inscrutably intricate, but for simple transfer between two parties, Coinbase exists and its UX is easy enough. Of course, it's the opposite of decentralized, which defeats the point.
tasha0663 5y ago
This kind of thing always reminds me of one of those articles that used to pop up from time to time about some massive coup in EVE Online. I wouldn't have any idea what they were talking about or why it was showing up on my radar, and moreover, it would be clear that the money, time, and energy required to begin to have even a neophyte's understanding would not be worthwhile. I'm still not convinced that Ethereum isn't just a strange RPG that people who don't really want to play are accidentally getting involved in.

dlubarov 5y ago

I don't think the NFT is very important here; basically the scammer's website asked the victim's wallet to sign a message, using the private key that holds their ETH. It looks like the message in this case would have given the attacker permission to transfer the victim's aWETH, which represents ETH that has been deposited into an Aave lending pool. These transfer permissions are something all ERC-20 tokens support. Typically users will only sign messages sent from trusted websites, just as they would only install software from trusted sources. Or they can sign a questionable message from a separate wallet which doesn't hold much value, as the victim did here. Granted, this isn't a great situation. It can be hard to know which websites to trust, and even trusted websites can be hacked and then send malicious messages to unsuspecting users.

labrador 5y ago

According to this talk about NFTs, an NFT can contain code and the execution of that code can be triggered to do unsafe things. at 1:22:50 Smart contracts are just code, they’re software, there’s no reason they can’t be viruses or worms, the primary limitation is processing power. But, also, it’s a virus that someone can drop directly into your bankless bank account and just wait for you to activate it. And, yeah, that’s right, there’s no offer/confirmation step in sending tokens back and forth, someone who knows your wallet can just drop stuff right into it, so, like, pin that somewhere in your brain. Line Goes Up – The Problem With NFTs https://youtu.be/YQ_xWvX1n9g?t=4970 https://youtu.be/YQ_xWvX1n9g?t=4970

dlubarov 5y ago
FWIW it doesn't seem that's what happened in this case. It seems the NFT was just part of the attacker's ruse, where they told a story about some NFT staking dapp they launched. Then the malicious dapp asked for permission to transfer the victim's aWETH tokens. This is just part of the ERC-20 API, unrelated to NFTs. While it's true that NFTs can be sent without permission and can contain code, users normally invoke contracts via (hopefully trusted) dapp websites, such as app.uniswap.org. Invoking code from an NFT I found in my wallet is possible, but not part of any normal/legitimate workflow that I'm aware of.

fleddr 5y ago

It wasn't just giving something. The NFT was given, but this in itself does nothing. The victim was then asked to stake that NFT. To stake an NFT, the smart contract that does the staking needs access to your wallet. This too is normal. Except that the permission prompt asked for approval on another smart contract by means of a misleading name. There's nothing broken here. A smart contract is just a piece of code that moves money. You better be sure about what it's doing before you allow it to run. There's blue chip smart contracts that are proven and thoroughly audited, but anything else you need to read the code. Same as reading a contract before you sign it.

blihp 5y ago

Basically it was the smart contract[1] that came with the NFT where the victim is essentially executing foreign code that gets granted access to their digital wallet. That's the reason the scammers were so insistent that he did it on his main wallet (i.e. where the funds were) [1] Think of these as being similar to Word or Excel macros embedded in a document... nothing bad ever happened with them, did it? ;-)

sumedh 5y ago

> but stories like this make me think that crypto can never become mainstream. We had illegal p2p sharing where you could download a virus from bad people and then Jobs came along and made iTunes which set the standard for streaming. I am sure someone will come along in the crypto space and make crypto easy for the rest of us.

alex504 5y ago
itunes isnt p2p
- sumedh 5y ago
  You missed the point. People wanted easy access to music, itunes provided that service. Right now with the world of crypto is confusing to the average guy, so hopefully in the future someone will create a good UX and the underlying to protocol for instant decentralised payments.
  - l33t2328 5y ago
    Or they could use a bank. They generally have fine UIs and secure protocols.
    - sumedh 5y ago
      and how are you going to pay when the bank closes your account because you broke their terms and conditions. That is where you need decentralized payments.
      - l33t2328 5y ago
        This simply doesn’t happen at a rate nearly high enough to make griftocurrency a “need”
  - fragmede 5y ago
    The subtleties of crypto are inscrutably intricate, but for simple transfer between two parties, Coinbase exists and its UX is easy enough. Of course, it's the opposite of decentralized, which defeats the point.

tasha0663 5y ago

This kind of thing always reminds me of one of those articles that used to pop up from time to time about some massive coup in EVE Online. I wouldn't have any idea what they were talking about or why it was showing up on my radar, and moreover, it would be clear that the money, time, and energy required to begin to have even a neophyte's understanding would not be worthwhile. I'm still not convinced that Ethereum isn't just a strange RPG that people who don't really want to play are accidentally getting involved in.