5 ms·

Hacker Steals $1.4M in NFTs from Collector in One Sweep

7 points by jbegley 4y ago

themodelplumber 4y ago
> the hacker sent him to a phishing website set up with a smart contract, which he approved Can someone with web3 experience explain this? Is this a matter of not reading a contract properly, or was the website carrying legit malware in some way? Edit: Seems like a matter of a contract being akin to source code, and the small print being an algorithm? How are non-algorithm-sensitive humans supposed to operate in oversight of contractual agreements?
- whywhywhywhy 4y ago
  Doesn't need to be malware, they just didn't read the contract what it was allowing. The real issue is if you're interacting with web3 the contract system just isn't very clear to the user what you're enabling it to do, it doesn't like pop up saying "You ok with allowing this website access to send these NFTs or currencies out of your wallet?" End of the day, having a wallet with $1M in it and opening random websites and pressing Agree Agree Agree is a sure fire way to have a wallet with $0M in it. Until these systems are better at alerting the user whats actually being allowed this will continue to happen.
  - gs17 4y ago
    There really isn't a "running this smart contract will cost you: X of token Y (to be sent to address Z), do you approve?" popup in the wallet browser extensions people use? It seems like it should require approval for payment, although maybe that's inconvenient for a lot of use cases (games?).
- yunohn 4y ago
  Smart contracts are Turing complete. They could do literally anything and even if you are an expert, you probably wouldn’t catch it.
arthurcolle 4y ago
Yes, phishing exists. Not sure how him being a father is relevant when he put most of his liquid assets into jpegs
nradov 4y ago
If your spouse is stupid enough to waste $1.4M on low-effort owl JPEGs, that's a good reason for divorce.
cyanydeez 4y ago
Just stop putting dollar signs to things that never had those literal values.

5 ms·

Hacker Steals $1.4M in NFTs from Collector in One Sweep

7 points by jbegley 4y ago

themodelplumber 4y ago
> the hacker sent him to a phishing website set up with a smart contract, which he approved Can someone with web3 experience explain this? Is this a matter of not reading a contract properly, or was the website carrying legit malware in some way? Edit: Seems like a matter of a contract being akin to source code, and the small print being an algorithm? How are non-algorithm-sensitive humans supposed to operate in oversight of contractual agreements?
- whywhywhywhy 4y ago
  Doesn't need to be malware, they just didn't read the contract what it was allowing. The real issue is if you're interacting with web3 the contract system just isn't very clear to the user what you're enabling it to do, it doesn't like pop up saying "You ok with allowing this website access to send these NFTs or currencies out of your wallet?" End of the day, having a wallet with $1M in it and opening random websites and pressing Agree Agree Agree is a sure fire way to have a wallet with $0M in it. Until these systems are better at alerting the user whats actually being allowed this will continue to happen.
  - gs17 4y ago
    There really isn't a "running this smart contract will cost you: X of token Y (to be sent to address Z), do you approve?" popup in the wallet browser extensions people use? It seems like it should require approval for payment, although maybe that's inconvenient for a lot of use cases (games?).
- yunohn 4y ago
  Smart contracts are Turing complete. They could do literally anything and even if you are an expert, you probably wouldn’t catch it.
arthurcolle 4y ago
Yes, phishing exists. Not sure how him being a father is relevant when he put most of his liquid assets into jpegs
nradov 4y ago
If your spouse is stupid enough to waste $1.4M on low-effort owl JPEGs, that's a good reason for divorce.
cyanydeez 4y ago
Just stop putting dollar signs to things that never had those literal values.