4 ms·

I can't recommend "web3 is going great" highly enough for creating digestible explanations. There's good commentary on Axie Infinity (the Sky Mavis game which

I can't recommend "web3 is going great" highly enough for creating digestible explanations. There's good commentary on Axie Infinity (the Sky Mavis game which got hacked) and links to more detailed explanations here. https://web3isgoinggreat.com/?id=2022-03-29-0 https://web3isgoinggreat.com/?id=2022-03-29-0 (particularly by Molly White the owner of the web3isgoinggreat https://blog.mollywhite.net/axie-hack/ https://blog.mollywhite.net/axie-hack/ )

dboreham 5y ago
Hmm...thanks, but reading those I don't see any more details. There is some good background information on side chains and bridges but I'm already familiar with the security risks in the typical trusted bridge design. For clarity: I'm interested in answers to questions such as : how exactly did the attacker gain control of 5 validator private keys? The validators were running a vulnerable version of the Linux kernel, and the private keys were sitting in the filesystem, for example, could be an answer. And: what exactly is the mumble about RPC about? Did they build some sort of master key into the bridge contract, then left that key sitting on a machine with no root password?
- phphphphp 5y ago
  Valid questions but they’re answers we will likely never know, because either the hack was an inside job and disclosure is bad for them or because they’re too incompetent to ever identify the real cause. Disclosure beyond “we were hacked” is not common in web3.
  - dboreham 5y ago
    They're pretty important questions imho because if you can just compromise 2/3 the validators in a BFT network "like that" then the whole idea of BFT-based chains is broken.
    - renewiltord 5y ago
      It is interesting that in a 9-validator design, 4 of them were really one with 4 votes. With a 5 of 9 min, that makes this a 2 of 5 design really.
- caoilte 5y ago
  haha. fair. That's more detail than I want to know.
  - t0mmyb0y 5y ago

dboreham 5y ago

Hmm...thanks, but reading those I don't see any more details. There is some good background information on side chains and bridges but I'm already familiar with the security risks in the typical trusted bridge design. For clarity: I'm interested in answers to questions such as : how exactly did the attacker gain control of 5 validator private keys? The validators were running a vulnerable version of the Linux kernel, and the private keys were sitting in the filesystem, for example, could be an answer. And: what exactly is the mumble about RPC about? Did they build some sort of master key into the bridge contract, then left that key sitting on a machine with no root password?

phphphphp 5y ago
Valid questions but they’re answers we will likely never know, because either the hack was an inside job and disclosure is bad for them or because they’re too incompetent to ever identify the real cause. Disclosure beyond “we were hacked” is not common in web3.
- dboreham 5y ago
  They're pretty important questions imho because if you can just compromise 2/3 the validators in a BFT network "like that" then the whole idea of BFT-based chains is broken.
  - renewiltord 5y ago
    It is interesting that in a 9-validator design, 4 of them were really one with 4 votes. With a 5 of 9 min, that makes this a 2 of 5 design really.
caoilte 5y ago
haha. fair. That's more detail than I want to know.
- t0mmyb0y 5y ago