29 ms·

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb eno

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a centralized server (therefore fast and cheap) authorized to make Ethereum Mainnet transactions. The server was a hot wallet in other words. 3. The Ronin team tried to make it look like they were "decentralized" by splitting signing authority among 9 "validator nodes." (the article) 4. An attacker obtained 5 of 9 keys, which is the signing threshold. 5. With the required threshold of keys, the attacker signed the transitions moving assets off the Ronin servers. None of this is new. The Bitcoin "block size war" was fought over this very point. Unworkable scaling schemes are going to end in disaster with no fallback, and no recourse for those who lose money. You end up with nothing, and will be sad. And it's sad that the same lessons keep getting replayed over and over. It's really simple. Can your "blockchain" be validated with regular hardware? Does it use a secure consensus algorithm? Is there a secure side channel through which low-value transactions can flow? If not, you're going to have a bad time when the shenanigans start happening. Now, is that side channel effectively a single server? Handling hundreds of millions of dollars of value? Have they rolled their own crypto? If yes to any of these, get out and stay out. [1] https://medium.com/axie-infinity/introducing-ronin-axie-infinitys-ethereum-sidechain-8745e31eaef1 https://medium.com/axie-infinity/introducing-ronin-axie-infi...

anchpop 5y ago
Right now they're immature, but I'm hopeful that advancements in ZK-tech will allow practical ZK-rollups. ZKSync already has a zk-evm testnet running (which I believe is based on zk-llvm), so we're close. Currently all the big rollups have master keys which can be used to steal all the money deposited by them, but there's no reason in principle they have to have this. Polygon has permissionless rollups, so I'm quite hopeful that they'll be a viable trustless permissionless scaling solution soon.
- ethbr0 5y ago
  For those who don't follow blockchain tech, like me, here's a primer on ZK-rollups: https://learn.bybit.com/blockchain/zk-rollups-eth-scalability/ https://learn.bybit.com/blockchain/zk-rollups-eth-scalabilit...
- DennisP 5y ago
  The nice thing about zkrollups is that users have a cryptographic guarantee of being able to withdraw their money. The rolled-up transactions are posted on chain in compressed form, and a contract on chain verifies a concise proof that all the rules were followed, including that all transactions had valid signatures. So if this is done correctly, any master keys shouldn't be able to steal user funds. The key holders would be the ones authorized to post the data, but the worst they could do is censor transactions.
  - anchpop 5y ago
    Right. It's possible to conceive of a rollup, particularly a zk-rollup, without anything like a master key. But current rollups do have those keys. ZK-sync for example has two, one used mostly used for upgrading the smart contract that has a 14-day withdrawal delay (or something like that) and one for use in case of emergency that has no withdrawal delay. If the second were compromised, it would lead to all the money stored in the rollup being stolen. But there's no reason in principle that either of these are necessary. ZK-rollups are awesome because they don't introduce any trust assumptions (except for the master key issue, which is just an implementation detail). The only risk is current zk-rollup designs is that they could censor certain transactions by never including them in a "batch" (the rollup equivalent of a block), but with unpermissioned rollups like the one I think Polygon has even this issue is mitigated
  - estro0182 5y ago
    >done correctly This has been the difficult bit for the ecosystem, and I think grasps at what GP is saying. For every competent dev/cryptographer in the space, there are 10(0) who are not because there’s so much money floating around. Those 10(0) may implement zk-class protocols incorrectly and end up in the same situation we see today. There is promise in but a ton of validation/maturation to do for zkrollups in the wild.
jonny_eh 5y ago
> 4. An attacker obtained 5 of 9 keys, which is the signing threshold. How?
- onebot 5y ago
  Exactly. Sounded like the obtained four keys and then used an open backdoor RPC call to obtain the fifth.
- tshaddox 5y ago
  > The attacker used hacked private keys in order to forge fake withdrawals. > The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO. Easiest explanation: at least one Sky Mavis employee and one Axie Infinity employee who have access to those private keys got together and took all the funds. Perhaps it was only one employee; it's not clear to me what the difference between Axie Infinity and Sky Mavis is (there isn't actually an Axie DAO, there's just a web page where they say they plan to be a DAO in 2023).
  - JumpCrisscross 5y ago
    > Easiest explanation: at least one Sky Mavis employee and one Axie Infinity employee who have access to those private keys got together and took all the funds Easier explanation: they were all in a Dropbox or something stupid like that.
    - tmp_anon_22 5y ago
      Is there a chance they were all loaded into application memory?
      - anchpop 5y ago
        They shouldn't even all be on the same computer. Ideally they would be engraved in titanium and inside people's safe deposit boxes
      - deleted 5y ago
jonathan-adly 5y ago
1. Can your "blockchain" be validated with regular hardware? 2. Does it use a secure consensus algorithm? 3. Is there a secure side channel through which low-value transactions can flow? The only blockchain with 3 yes is Bitcoin lol.
- once_inc 5y ago
  Indeed. This is why Bitcoin maximalists tend to be set aside as "religious zealots" while their conviction is a direct result of these three answers.
- freddiecoleman 5y ago
  Actually it's Chia. Bitcoin requires custom hardware. Chia does not - you can use an ordinary hard drive and run a full node on a Raspberry Pi.
  - coconut08 5y ago
    the only reason chia doesn't have specialized hardware that crowds out all commodity hardware is because no one cares about chia. the reason that bitcoin has highly specialized asics is because it is the progenitor and center of the entire cryptocurrency ecosystem and has been for over a decade. also proof of space is no better than proof of work at scale. it will ultimately have very similar consequences.
    - freddiecoleman 5y ago
      There is no such thing as specialized hardware for Chia farming. If you manage to pull that off then congratulations, you have created a bigger hard drive.
      - coconut08 5y ago
        the history of cryptocurrency is a history of projects making that exact claim and being proven wrong over and over again, but surely this time is different.
gruez 5y ago
>None of this is new. The Bitcoin "block size war" was fought over this very point. Unworkable scaling schemes are going to end in disaster with no fallback, and no recourse for those who lose money. You end up with nothing, and will be sad. I don't see the parallel to 'the Bitcoin "block size war"', though? The solution on either side (bigger blocks, lightning network) doesn't require trusting some party to handle transactions.
- tenuousemphasis 5y ago
  I think their point is that at some block size, it's no longer feasible for most people to run their own node to verify the blockchain, and you start relying on a client-server model instead of a peer to peer model.
  - tornato7 5y ago
    Yes, interestingly with Ethereum it's not the individual block size that's holding it back (they're around 80kb), it's the protected size of all blocks for people running validator nodes. You don't want to require node operators to have 100TB in SSD storage because your blocks all pile up too quickly (this is one of the main concerns about Avalanche scaling).
    - thinkmassive 5y ago
      Part of it IS the individual block size though. Individual blocks might seem small, but there's a lot more of them. Ethereum dApps store a LOT of state directly on the base chain. The other scalability disaster is making every node validate every instruction of a Turing-complete scripting language, which results in insane "gas fees" (or loss of fees when you didn't supply quite enough for the script to fully execute).
      - jazzyjackson 5y ago
        > (or loss of fees when you didn't supply quite enough for the script to fully execute). Are they planning to address this in any of the updates on their timeline? This turned me off from ETH completely, just feels like a house-always-wins situation skimming money from users.
EVa5I7bHFq9mnYK 5y ago
That's exactly the situation in Bitcoin second layer now. There are a few centralized servers (lnbig etc) handling almost all transactions. Get out and stay out.
- AlexandrB 5y ago
  Bitcoin second layer as-in the "Lightning" network? That's worrying. I thought Lightning was supposed to solve Bitcoin's scaling issues.
  - tenuousemphasis 5y ago
    No, that person doesn't know what they're talking about, see my response to them.
- tenuousemphasis 5y ago
  It's not at all. The worst thing a centralized server can do in Lightning is refuse to route your transactions. Their peers have the keys and the pre-signed transactions necessary to unilaterally withdraw their funds from the channel.
  - uncletammy 5y ago
    > The worst thing a centralized server can do in Lightning is refuse to route your transactions. This is called censorship, the very thing Bitcoin was created to circumvent. It's an especially big problem given the fact that the vast majority of lightning payments are routed through lightning nodes operated by centralized cryptocurrency exchanges. Most of the remaining nodes on the lightning network are unreliable due to shortcomings in the lightning protocol surrounding state management, node connectivity, and inbound/outbound liquidity. That's not even getting into the abysmal incentive structure node operators face.
    - _1tan 5y ago
      It is certainly not a general instance of censorship if certain node operators or miners choose to exclude transactions meeting certain criteria. This isn't comparable to e.g. a hard coded blacklist.
Mondialisation 5y ago
Is bitcoin's lighting network any different? Just curious
- thinkmassive 5y ago
  Yes, LN is different. The Lightning Network consists of channels with funds held in a 2-of-2 multisig, so the only way one participant can have a quorum of signatures is if they already own both ends of the channel. There are Bitcoin sidechains that have a similar federation of validators, such as Liquid.
spicymaki 5y ago
This is exactly why crypto is such a disaster. Every week there is yet another scam where people losing their money. The feedback from crypto enthusiasts is well look at those idiots for putting their money into some scheme <insert unintelligible jargon filled insanity statement here> or you are not smart enough use this thing. Look "nobody" understands what you are talking about. These financial systems are inscrutable and the problem is getting worse. You are building systems that are ruining peoples lives and making things worse for everyone. Please think about what you are doing and create system of value and meaning which improves humankind.
- cinntaile 5y ago
  > You are building systems that are ruining peoples lives and making things worse for everyone. Don't invest more than you can afford to lose, it's the basis of any investment strategy. If someone puts enough money into highly risky, speculative assets such as these that it would ruin their life, then they only have themselves to blame if you ask me... People have to take responsibility for their own choices. Edit: -4 that's a new record for me, thanks guys!
  - warent 5y ago
    Hideous victim blaming mentality here.
    - cinntaile 5y ago
      I'm not blaming someone for getting scammed, that's on the scammer. But I am blaming someone for ruining their own life if they put more money into a speculative, highly risky asset than they can lose. This isn't confined to crypto, it can also be regular stocks or other investments. I mean this in a general sense. I don't mean people taking advantage of people that aren't in the right state of mind (for whatever reason) to be clear, of course I don't put the blame on those people.
      - mrmuagi 5y ago
viksit 5y ago
curious - “can your blockchain be validated with regular hardware” - why is this a point you call out? is it that specialized equipment is not easily accessible and thus not truly decentralized?
- thinkmassive 5y ago
  Exactly. If validating the ledger requires millions of dollars worth of hardware, only a few people will know what it actually says, and they can collude to impose whatever rules they want (basically like what happened in the article).
- whiskyant 5y ago
  Yes. Bitcoin can be validated with with regular hardware, thus full nodes are cheap and ubiquitous and results in a system that's highly decentralized. Even if a 51% were to hypothetically happen with miners, the full nodes will stop it. Ethereum and many others with massive blocks cannot be validated with regular hardware as there's too much computational power/storage involved. The majority of Ethereum nodes are by 3rd party services which use cloud services such as AWS. Additionally, essential services such as Infura which the majority of apps rely on are basically entirely centralized.
  - yokem55 5y ago
    You can sync a full ethereum node (all blocks with all transactions and fully verified current state) on a rasberry pi with a 1TB ssd. With 3TB of ssd space, you can even have an archival node (the above, but with all the state history changes cleanly indexed by account, which is only really needed if you want to run a block explorer). The issue for ethereum flat out isn't the hardware requirements, its laziness. Infura, Alchemy, et al make a very convenient shortcut for impatient folks and that is why they get used. The good news is that there is a ton of real development going into light clients that can trustlessly get and interact with with the current state of the chain within a few minutes of launching and can even run within a web browser.
    - tphyahoo2 5y ago
hammock 5y ago
Which crypto meet all those criteria?

anchpop 5y ago

Right now they're immature, but I'm hopeful that advancements in ZK-tech will allow practical ZK-rollups. ZKSync already has a zk-evm testnet running (which I believe is based on zk-llvm), so we're close. Currently all the big rollups have master keys which can be used to steal all the money deposited by them, but there's no reason in principle they have to have this. Polygon has permissionless rollups, so I'm quite hopeful that they'll be a viable trustless permissionless scaling solution soon.

ethbr0 5y ago
For those who don't follow blockchain tech, like me, here's a primer on ZK-rollups: https://learn.bybit.com/blockchain/zk-rollups-eth-scalability/ https://learn.bybit.com/blockchain/zk-rollups-eth-scalabilit...
DennisP 5y ago
The nice thing about zkrollups is that users have a cryptographic guarantee of being able to withdraw their money. The rolled-up transactions are posted on chain in compressed form, and a contract on chain verifies a concise proof that all the rules were followed, including that all transactions had valid signatures. So if this is done correctly, any master keys shouldn't be able to steal user funds. The key holders would be the ones authorized to post the data, but the worst they could do is censor transactions.
- anchpop 5y ago
  Right. It's possible to conceive of a rollup, particularly a zk-rollup, without anything like a master key. But current rollups do have those keys. ZK-sync for example has two, one used mostly used for upgrading the smart contract that has a 14-day withdrawal delay (or something like that) and one for use in case of emergency that has no withdrawal delay. If the second were compromised, it would lead to all the money stored in the rollup being stolen. But there's no reason in principle that either of these are necessary. ZK-rollups are awesome because they don't introduce any trust assumptions (except for the master key issue, which is just an implementation detail). The only risk is current zk-rollup designs is that they could censor certain transactions by never including them in a "batch" (the rollup equivalent of a block), but with unpermissioned rollups like the one I think Polygon has even this issue is mitigated
- estro0182 5y ago
  >done correctly This has been the difficult bit for the ecosystem, and I think grasps at what GP is saying. For every competent dev/cryptographer in the space, there are 10(0) who are not because there’s so much money floating around. Those 10(0) may implement zk-class protocols incorrectly and end up in the same situation we see today. There is promise in but a ton of validation/maturation to do for zkrollups in the wild.

jonny_eh 5y ago

> 4. An attacker obtained 5 of 9 keys, which is the signing threshold. How?

onebot 5y ago
Exactly. Sounded like the obtained four keys and then used an open backdoor RPC call to obtain the fifth.
tshaddox 5y ago
> The attacker used hacked private keys in order to forge fake withdrawals. > The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO. Easiest explanation: at least one Sky Mavis employee and one Axie Infinity employee who have access to those private keys got together and took all the funds. Perhaps it was only one employee; it's not clear to me what the difference between Axie Infinity and Sky Mavis is (there isn't actually an Axie DAO, there's just a web page where they say they plan to be a DAO in 2023).
- JumpCrisscross 5y ago
  > Easiest explanation: at least one Sky Mavis employee and one Axie Infinity employee who have access to those private keys got together and took all the funds Easier explanation: they were all in a Dropbox or something stupid like that.
  - tmp_anon_22 5y ago
    Is there a chance they were all loaded into application memory?
    - anchpop 5y ago
      They shouldn't even all be on the same computer. Ideally they would be engraved in titanium and inside people's safe deposit boxes
    - deleted 5y ago

jonathan-adly 5y ago

1. Can your "blockchain" be validated with regular hardware? 2. Does it use a secure consensus algorithm? 3. Is there a secure side channel through which low-value transactions can flow? The only blockchain with 3 yes is Bitcoin lol.

once_inc 5y ago
Indeed. This is why Bitcoin maximalists tend to be set aside as "religious zealots" while their conviction is a direct result of these three answers.
freddiecoleman 5y ago
Actually it's Chia. Bitcoin requires custom hardware. Chia does not - you can use an ordinary hard drive and run a full node on a Raspberry Pi.
- coconut08 5y ago
  the only reason chia doesn't have specialized hardware that crowds out all commodity hardware is because no one cares about chia. the reason that bitcoin has highly specialized asics is because it is the progenitor and center of the entire cryptocurrency ecosystem and has been for over a decade. also proof of space is no better than proof of work at scale. it will ultimately have very similar consequences.
  - freddiecoleman 5y ago
    There is no such thing as specialized hardware for Chia farming. If you manage to pull that off then congratulations, you have created a bigger hard drive.
    - coconut08 5y ago
      the history of cryptocurrency is a history of projects making that exact claim and being proven wrong over and over again, but surely this time is different.

gruez 5y ago

>None of this is new. The Bitcoin "block size war" was fought over this very point. Unworkable scaling schemes are going to end in disaster with no fallback, and no recourse for those who lose money. You end up with nothing, and will be sad. I don't see the parallel to 'the Bitcoin "block size war"', though? The solution on either side (bigger blocks, lightning network) doesn't require trusting some party to handle transactions.

tenuousemphasis 5y ago
I think their point is that at some block size, it's no longer feasible for most people to run their own node to verify the blockchain, and you start relying on a client-server model instead of a peer to peer model.
- tornato7 5y ago
  Yes, interestingly with Ethereum it's not the individual block size that's holding it back (they're around 80kb), it's the protected size of all blocks for people running validator nodes. You don't want to require node operators to have 100TB in SSD storage because your blocks all pile up too quickly (this is one of the main concerns about Avalanche scaling).
  - thinkmassive 5y ago
    Part of it IS the individual block size though. Individual blocks might seem small, but there's a lot more of them. Ethereum dApps store a LOT of state directly on the base chain. The other scalability disaster is making every node validate every instruction of a Turing-complete scripting language, which results in insane "gas fees" (or loss of fees when you didn't supply quite enough for the script to fully execute).
    - jazzyjackson 5y ago
      > (or loss of fees when you didn't supply quite enough for the script to fully execute). Are they planning to address this in any of the updates on their timeline? This turned me off from ETH completely, just feels like a house-always-wins situation skimming money from users.

EVa5I7bHFq9mnYK 5y ago

That's exactly the situation in Bitcoin second layer now. There are a few centralized servers (lnbig etc) handling almost all transactions. Get out and stay out.

AlexandrB 5y ago
Bitcoin second layer as-in the "Lightning" network? That's worrying. I thought Lightning was supposed to solve Bitcoin's scaling issues.
- tenuousemphasis 5y ago
  No, that person doesn't know what they're talking about, see my response to them.
tenuousemphasis 5y ago
It's not at all. The worst thing a centralized server can do in Lightning is refuse to route your transactions. Their peers have the keys and the pre-signed transactions necessary to unilaterally withdraw their funds from the channel.
- uncletammy 5y ago
  > The worst thing a centralized server can do in Lightning is refuse to route your transactions. This is called censorship, the very thing Bitcoin was created to circumvent. It's an especially big problem given the fact that the vast majority of lightning payments are routed through lightning nodes operated by centralized cryptocurrency exchanges. Most of the remaining nodes on the lightning network are unreliable due to shortcomings in the lightning protocol surrounding state management, node connectivity, and inbound/outbound liquidity. That's not even getting into the abysmal incentive structure node operators face.
  - _1tan 5y ago
    It is certainly not a general instance of censorship if certain node operators or miners choose to exclude transactions meeting certain criteria. This isn't comparable to e.g. a hard coded blacklist.

Mondialisation 5y ago

Is bitcoin's lighting network any different? Just curious

thinkmassive 5y ago
Yes, LN is different. The Lightning Network consists of channels with funds held in a 2-of-2 multisig, so the only way one participant can have a quorum of signatures is if they already own both ends of the channel. There are Bitcoin sidechains that have a similar federation of validators, such as Liquid.

spicymaki 5y ago

This is exactly why crypto is such a disaster. Every week there is yet another scam where people losing their money. The feedback from crypto enthusiasts is well look at those idiots for putting their money into some scheme <insert unintelligible jargon filled insanity statement here> or you are not smart enough use this thing. Look "nobody" understands what you are talking about. These financial systems are inscrutable and the problem is getting worse. You are building systems that are ruining peoples lives and making things worse for everyone. Please think about what you are doing and create system of value and meaning which improves humankind.

cinntaile 5y ago
> You are building systems that are ruining peoples lives and making things worse for everyone. Don't invest more than you can afford to lose, it's the basis of any investment strategy. If someone puts enough money into highly risky, speculative assets such as these that it would ruin their life, then they only have themselves to blame if you ask me... People have to take responsibility for their own choices. Edit: -4 that's a new record for me, thanks guys!
- warent 5y ago
  Hideous victim blaming mentality here.
  - cinntaile 5y ago
    I'm not blaming someone for getting scammed, that's on the scammer. But I am blaming someone for ruining their own life if they put more money into a speculative, highly risky asset than they can lose. This isn't confined to crypto, it can also be regular stocks or other investments. I mean this in a general sense. I don't mean people taking advantage of people that aren't in the right state of mind (for whatever reason) to be clear, of course I don't put the blame on those people.
    - mrmuagi 5y ago

viksit 5y ago

curious - “can your blockchain be validated with regular hardware” - why is this a point you call out? is it that specialized equipment is not easily accessible and thus not truly decentralized?

thinkmassive 5y ago
Exactly. If validating the ledger requires millions of dollars worth of hardware, only a few people will know what it actually says, and they can collude to impose whatever rules they want (basically like what happened in the article).
whiskyant 5y ago
Yes. Bitcoin can be validated with with regular hardware, thus full nodes are cheap and ubiquitous and results in a system that's highly decentralized. Even if a 51% were to hypothetically happen with miners, the full nodes will stop it. Ethereum and many others with massive blocks cannot be validated with regular hardware as there's too much computational power/storage involved. The majority of Ethereum nodes are by 3rd party services which use cloud services such as AWS. Additionally, essential services such as Infura which the majority of apps rely on are basically entirely centralized.
- yokem55 5y ago
  You can sync a full ethereum node (all blocks with all transactions and fully verified current state) on a rasberry pi with a 1TB ssd. With 3TB of ssd space, you can even have an archival node (the above, but with all the state history changes cleanly indexed by account, which is only really needed if you want to run a block explorer). The issue for ethereum flat out isn't the hardware requirements, its laziness. Infura, Alchemy, et al make a very convenient shortcut for impatient folks and that is why they get used. The good news is that there is a ton of real development going into light clients that can trustlessly get and interact with with the current state of the chain within a few minutes of launching and can even run within a web browser.
  - tphyahoo2 5y ago

hammock 5y ago

Which crypto meet all those criteria?