10 ms·
Billion-Dollar Crypto Loan Is Easy to Get, but Gone in a Flash
- erikig 4y agoArchived Link - https://archive.ph/OumQb https://archive.ph/OumQb
- xwdv 4y agoSometimes I fantasize about become a modern day Robinhood type figure and using these flash loan scams to liberate millions in crypto and then disburse them to people stuck with crippling student loan or medical debts. Not like I’m really doing much else with my life.
- _8j50 4y agoDon't forget to wear modern tights.
- diogenescynic 4y agoTight, tights!
- Fargoan 4y agoSteal from the poor/middle class to give to the poor. Ridiculous
- s5300 4y agoPoor people don’t have money to throw in crypto. If you think they do, you seriously haven’t met genuinely poor people.
- kerbs 4y agoI generally agree with this sentiment, then I saw a gas station in the middle-of-nowhere-Wisconsin was selling Bitcoin. It was essentially a $5 lottery ticket
- datashaman 4y agoWhich will never win.
- bilbo0s 4y agoYou'll see a lot of get rich quick crypto schemes around Wisconsin. It's a little depressing. I hate to see people who I know are not so well off risking what little they have on something so precarious.
- missedthecue 4y ago$5 of Bitcoin, if purchased five years ago, is worth like $80 now. Hardly a lotto ticket.
- moron4hire 4y ago$5 of Bitcoin, if purchased a year ago, is worth like $3.50 now.
- flyosity 4y agoThat's enough to buy some lottery tickets!
- kerbs 4y agoThis was definitely not 5 years ago. This was 12 months ago. And yes you can definitely win $80 from a $5 lotto ticket I promise you.
- pr0zac 4y agoI've met quite a few less-than-well-off folks with significant portions of their net worth in cryptocurrencies. Like work 60 hours a week across multiple jobs but still qualify for food stamps poor. For a lot of them they see it as their only way to get out of poverty and the skill/knowledge level necessary to interact with those markets has dropped enough they're able to access them with their small amount of available capital. Depending on your perspective this is either because crypto projects are grassroots projects bringing financial freedom to everyone or because the scam has reached a size where it needs to bring those people in in order to continue running without collapsing.
- missedthecue 4y agoI don't think it's mathematically possible to work 60 hours a week and still qualify for food stamps.
- ac29 4y agoIf you're the sole wage earner in a family of 4 and you make federal minimum wage or close to it, you'd still be within the qualifying income range at 60 hours a week: https://www.fns.usda.gov/snap/recipient/eligibility https://www.fns.usda.gov/snap/recipient/eligibility
- missedthecue 4y agoI wonder why anyone would work for $7.25 when McDonalds, Amazon, Target, Starbucks, and basically everyone else these days pay double that at least. Looking at the data it looks like almost no one earns minimum wage aside from waitstaff who get tips on top of it.
- pfraze 4y agoGot curious and did the math. Minimum federal wage is 7.25 in the US. 60 hours a week over 50 weeks is 3000 hours. Pretax that’s 21,750 a year. Food stamps qualification depends on household size. I got different numbers when I googled but 21.75k a year qualified in all of them if there’s at least two people in your home.
- Fargoan 4y agoI'm a working class guy in North Dakota. I'm just telling you what I see in my community. Sorry you're out of touch with a chunk of America
- xwdv 4y agoWell it’s the thought that counts.
- Okx 4y agoMy question is, how was there enough liquidity in Beanstalk to be able to buy half of it in an instant? The article doesn't explain this.
- chizhik-pyzhik 4y agoThe attacker used AAVE lending platform to facilitate the flash loan. rekt.news has a better writeup: https://rekt.news/beanstalk-rekt/ https://rekt.news/beanstalk-rekt/
- vmception 4y agoI analyzed this transaction when it happened back in April There was enough liquidity in Uniswap V2. A lot of projects incentivize community organized trading liquidity these days. Larger and larger traders are more willing to buy into projects when the liquidity is large enough to support them, but in the past (and simultaenously now in the present, for projects that bother), providing liquidity had a major challenge of both expense and regulatory issues (promising liquidity to potential buyers and actively courting exchanges has been a prong in being designated as a security, but communities expected funds to be used this way anyway, exchanges know this and extort project founders). So now with AMM technology like Uniswap, this has all been solved. Nobody ever has to deal with crypto exchanges again, and communities don't have to worry about liquidity. This has allowed rapid flourishing of some kinds of projects. Anyway, there are 71,000,000 BEAN tokens in existence. And if you look at the Uniswap liquidity pool, it has risen to around 30,000,000 BEAN slowly over time.[0] And the day the amount got high enough, the person did a flash loan of $1,000,000,000 in stablecoins and bought everything from the liquidity pool, they got 6,000,000 additional BEAN from another source, deposited 36,000,000 BEAN into Beanstalk to get immediate majority vote of their proposal, which gave them all the funds locked up in Beanstalk to themselves (the $80,000,000 or so), withdrew the bean, sold it back into the liquidity pool (resetting the price to what it was before), returned the $1,000,000,000 and kept the $80,000,000 to themselves. ($250,000 to Ukraine Relief to fulfill the promise of their proposal, but they deposited it all into Tornado cash to never have to figure out if that was good enough like in a court) [1] [0] https://etherscan.io/token/0xdc59ac4fefa32293a95889dc396682858d52e5db?a=0x87898263b6c5babe34b4ec53f22d98430b91e371#tokenAnalytics https://etherscan.io/token/0xdc59ac4fefa32293a95889dc3966828... [1] https://etherscan.io/tx/0xcd314668aaa9bbfebaf1a0bd2b6553d01dd58899c508d4729fa7311dc5d33ad7 https://etherscan.io/tx/0xcd314668aaa9bbfebaf1a0bd2b6553d01d...
- ALittleLight 4y agoIf the hacker had not said the bit about donating to Ukraine, but instead just made the proposal "send me all the money" would he have committed any crime? It's not clear to me that, apart from lying, he really did anything you're not supposed to do. If, analogously, my bank had a program where people could propose actions to the bank and vote on them by putting dollars in a "yes" or "No" jar - and I started a "give me the bank" proposal, took out a massive loan and won the vote... What have I done wrong?
- corlinpalmer 4y agoYes, it would be theft because the usage was clearly outside of the intended use of the system. This sort of thing has been tested in the courts before and likely falls under the realm of any bug exploit. For another example, let’s say you were an employee of a retailer with the power to set a discount on certain items. You suddenly set a 100% discount on every item in the store and then buy all the inventory for $0. Try explaining to the police that you were actually fully within your legal right to do that.
- colinmhayes 4y agoBut isn’t code law? I thought the intended usage was to faithfully execute the contract.
- charcircuit 4y agoThe same could be said about other vulnerabilities like mysql injections. The difference in this case is that there was a government proposal that was legitimately passed, but it was unpopular with the community as votes are not 1 per person but rather based off how much you have financially invented into buying voting rights. In real life this would be the equivalent of buying enough shares of a company to make unpopular changes. Hostile takeovers aren't illegal AFAIK.
- ALittleLight 4y agoIf someone had a website that said "My server's code is law. You can do whatever it lets you do." And you found an sql injection vulnerability I would think you'd be allowed to mess with it.
- arberx 4y agoFlash loans are actually extremely democratic and socialize the ability to conduct billions of $ worth of transactions (as long as the debt is paid for in a single block). This is in contrast to the current stock market in which only a handful of players have the liquidity and the regulatory ability to market make.
- VectorLock 4y agoMaybe not having that ability be available to "anyone" is actually a good thing.
- thebeastie 4y agoWell, they’re kind of limited in what they can do with it because of the requirement to make a profit in an atomic transaction. But I think the conversation we should be having is, do we want to move towards more resilient markets, given that the additional security will carry a heavy cost in terms of productivity? I’m sure there are arguments both ways but it seems like we don’t have the full picture yet.
- VectorLock 4y agoThey might be limited but people seem to be figuring out how to cause all kinds of havoc with them.
- postcynical 4y agoAgree. Only fine men like George Soros and companies willing to pay enough to lawyers should be able to do so. Also open source software should be banned, as everyone can search for security exploits. I see it the same with flash loans, etc. It forces DeFi protocols to safeguard against all attack vectors, resulting in a much more secure environment.
- poopypoopington 4y agoAnyone includes George Soros
- jcranmer 4y agoSo, seeing yet another story involving flash loans, I have to ask this question: what is the actual utility of a flash loan? The first use that occurred to me was to use it to pretend you were sufficiently rich for the purposes of exploiting an insufficiently secure smart contract, and judging from the number of stories involving them, I'm not the only person to think along these lines. But I'm not seeing any other uses than some variation on that fraudulent idea of making people think you have money you don't really have. Surely the people who came up with this financial innovation had some other use for it in mind, one that would outweigh the inherent externality of this-is-a-perfect-vehicle-for-fraud, right? ... right?
- vmception 4y agoFTA? > Such flash loans have beneficial uses, including help for traders trying to capitalize on price differences between cryptocurrencies on different exchanges. In that sense, they are much like the financing that an investment bank might provide to an investment fund to make bets on different stocks or currencies. This is their predominant use as well. If you bid up the price of something on Sushiswap, that also trades on Uniswap, a flash loan will be deployed pretty much in the same block, pull all available capital necessary, and fix that price imbalance to its maximum potential. Just a form of arbitrage. Projects have to do system design that accounts for this. Beanstalk did not seem to account for the idea that the liquidity pool would have more than 50% of the BEAN supply eventually. But aside from that, having proposals passable in one block of deposit is the primary vector. Teams and communities like this model though because it basically comes down to "imagine how rich we would be if an attacker actually tried to buy all the tokens, I hope state actors get involved to really test that theory" because then it wouldn't matter if one block or many blocks was used if an actual organization was determined to pass something, this mentality is just not compatible with flash loans when all the liquidity is purchaseable already.
- downandout 4y agoFlash loans are useful for both arbitrage and loan liquidations. Every swap on Uniswap and its many forks on many chains is actually a "flash swap" under the hood - you can take the coins out and use them before the code checks that you have sent the tokens for the swap in to the contract. You don't even need a dedicated flash loan provider on a given chain to be able to use very large amounts of capital sitting in DEX pair contracts. There are other case-specific uses for them, but loan liquidations and arbs are the big ones.
- downandout 4y agoI write MEV bots for a living. I can tell you that the Beanstalk "hack" was evidence of extremely poor design. One of the key security aspects of designing a DAO is that you are not supposed to let the results of a vote take effect in the same transaction or even the same block. This was entirely on the designers of that protocol. It's so negligent and downright stupid that I would be quite surprised if it weren't an inside job. The fact that it took more than a day for anyone to notice this is truly shocking.
- bushbaba 4y agoreentrancy attacks are also well known. Yet many DEFI projects continually get hacked from them.
- vmception 4y agoWas this a reentrancy attack though I don’t think it counts as one, I was thinking that needs the governance contract to either recursively call itself or call an external unrelated contract
- downandout 4y agoCorrect, the Beanstalk thing was not a reentrancy attack. That was a governance attack on the world's most insecure DAO. The Rari Capital exploit was a reentrancy attack. https://twitter.com/BTCTN/status/1520425720631156736?s=20&t=eyF7NEWua4335xtCxhThAw https://twitter.com/BTCTN/status/1520425720631156736?s=20&t=...
- pru567 4y agoIs there a list of common attacks with names? This is the first time I've heard the term "reentrancy attack", there's probably a dozen other terms I've never heard of, but would like to read about.
- anony23 4y agoSearch for ethernaut for a good overview of exploitable solidity bugs.
- TekMol 4y agoIs all that is going on in DeFi just self-referential? I mean, there is money moved around all the time, there are more and more clever and complex systems. But are they connected to the real world in some way? For example, the stock market is. It lets people with savings invest those savings in companies that produce real world goods and services. Another example is a bank. A bank can loan money to people who want to spend now what they will earn later. But DeFi? Is anything happening there that has value to mankind? Or is it all a zero-sum game between crypto traders?
- searchableguy 4y agoMany invest in private companies through DAOs and crypyo token. So I don't get your stock market difference.
- TekMol 4y agoThis is the first time I hear about something like this. Can you give an example?
- MacsHeadroom 4y agoAll governance tokens are essentially common stock with voting rights. $GRT for The Graph, for example. All DAOs are essentially corporations. But not all are legally registered corporations. "LAO" (Legal Autonomous Organization" is the moniker for legally registered DAOs. There's a few thousand Ethereum based LAOs listed on this site: https://aragon.org/aragon-govern https://aragon.org/aragon-govern
- LittlePeter 4y agohttps://aragon.org/aragon-govern https://aragon.org/aragon-govern seems to be a landing page. There is no list of thousands of LAOs. Is it hidden behind some link perhaps? Also you explicitly say LAO instead of DAO. Under which country's jurisdiction does the LAO fall?
- 4y ago
- nathias 4y agoThis very similar how Voltaire got his fortune exploiting a national lottery.