3 ms·

My understanding is this multisig failed because, like most security, everyone just pressed yes and didn’t communicate, investigate, or ask questions, defeating

My understanding is this multisig failed because, like most security, everyone just pressed yes and didn’t communicate, investigate, or ask questions, defeating the purpose of a multisig.

wslh 2y ago
The concept of strong safeties was not in place. Safeties refer to layers that go beyond common trust mechanisms. In this case, signing a transaction of that magnitude solely based on multi-signature approval was completely insufficient. There should have been additional safeguards, such as special approvals and extra verification steps, specifically designed for transactions within that amount range.
- ttul 2y ago
  Indeed. As in, the organization should only sign such transactions when all signers are present in person in a secure location and they follow a procedure witnessed by independent auditors. “Work from home” when you control billion in value does not cut it.
- greg7mdp 2y ago
  They didn't sign a transaction for 1 billion dollars. They all signed what they thought was a routine transfer, but in reality what they signed gave the hacker full control of the smart contract (the Gnosis Safe) in which the 1.4B $ of tokens were stored. The hackers, having gained control of the smart contract, proceeded to empty it of funds.
  - wslh 2y ago
    Safeties applies as well, it is not the same to have a Gnosis smart contract with 1k, 1m, or 1b. They should change the smart contract to add extra steps in these circumstances, this includes Safe itself.
__turbobrew__ 2y ago
Yea, how is it that multiple people signed a transaction for over a billion dollars of assets without due diligence? If you did this for non crypto there would be lawyers, bankers, etc involved in the transaction. Root certificate authorities have already solved this problem with signing rituals which take place in person in an air gapped vault on specialized hardware and multiple parties as witness.
- alwa 2y ago
  TFA seems to suggest that the thieves modified the signers’ applications to display a routine transaction but actually sign the heist transaction.
- jgilias 2y ago
  Given that the UI they saw was compromised, they likely believed they were signing some routine 1M rebalancing transaction.
  - fc417fc802 2y ago
    Odd that you wouldn't use separate keys for that given the wildly different levels of risk involved.
    - jgilias 2y ago
      Separate keys for what? They believed they were signing a routine transaction. That’s the whole idea of the hack. Splitting funds over 100 wallets would’ve helped. A 100x lower amount would be lost. And/Or having separate hardened devices used only for signing.
      - fc417fc802 2y ago
        Separate keys (ie wallets) for routine small transactions versus the cold wallets used for huge sums. Perhaps I've misunderstood but it sounded like they performed a rare transaction while being led to believe it was a routine one. I'm wondering why you wouldn't split the infrastructure given the differences in risk.
paulpauper 2y ago
The displayed information was tampered due to malware. communication would not have helped.

My understanding is this multisig failed because, like most security, everyone just pressed yes and didn’t communicate, investigate, or ask questions, defeating the purpose of a multisig.

wslh 2y ago

The concept of strong safeties was not in place. Safeties refer to layers that go beyond common trust mechanisms. In this case, signing a transaction of that magnitude solely based on multi-signature approval was completely insufficient. There should have been additional safeguards, such as special approvals and extra verification steps, specifically designed for transactions within that amount range.

ttul 2y ago
Indeed. As in, the organization should only sign such transactions when all signers are present in person in a secure location and they follow a procedure witnessed by independent auditors. “Work from home” when you control billion in value does not cut it.
greg7mdp 2y ago
They didn't sign a transaction for 1 billion dollars. They all signed what they thought was a routine transfer, but in reality what they signed gave the hacker full control of the smart contract (the Gnosis Safe) in which the 1.4B $ of tokens were stored. The hackers, having gained control of the smart contract, proceeded to empty it of funds.
- wslh 2y ago
  Safeties applies as well, it is not the same to have a Gnosis smart contract with 1k, 1m, or 1b. They should change the smart contract to add extra steps in these circumstances, this includes Safe itself.

__turbobrew__ 2y ago

Yea, how is it that multiple people signed a transaction for over a billion dollars of assets without due diligence? If you did this for non crypto there would be lawyers, bankers, etc involved in the transaction. Root certificate authorities have already solved this problem with signing rituals which take place in person in an air gapped vault on specialized hardware and multiple parties as witness.

alwa 2y ago
TFA seems to suggest that the thieves modified the signers’ applications to display a routine transaction but actually sign the heist transaction.
jgilias 2y ago
Given that the UI they saw was compromised, they likely believed they were signing some routine 1M rebalancing transaction.
- fc417fc802 2y ago
  Odd that you wouldn't use separate keys for that given the wildly different levels of risk involved.
  - jgilias 2y ago
    Separate keys for what? They believed they were signing a routine transaction. That’s the whole idea of the hack. Splitting funds over 100 wallets would’ve helped. A 100x lower amount would be lost. And/Or having separate hardened devices used only for signing.
    - fc417fc802 2y ago
      Separate keys (ie wallets) for routine small transactions versus the cold wallets used for huge sums. Perhaps I've misunderstood but it sounded like they performed a rare transaction while being led to believe it was a routine one. I'm wondering why you wouldn't split the infrastructure given the differences in risk.

paulpauper 2y ago

The displayed information was tampered due to malware. communication would not have helped.