[ad_1]
This week saw a pair of high-profile cryptocurrency thefts, totaling over $150 million. One from MonoX and one from BadgerDAO.
And the details illustrate the staggering naivety and ineptitude of these cryptocurrency fanbois. Yeah, sure, let’s sweep aside the centuries of governance, safeguards and legal practice in the banking industry. Because … uhhhh … something-something fiat?
Schadenfreude for those of us who know this craze for imaginary money is hilariously dumb. In today’s SB Blogwatch, we break out the popcorn.
Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: Big box, little box, cardboard fish.
DeFi DAO D’oh!
What’s the craic? Dan Goodin reports—“Really stupid ‘smart contract’ bug let hackers steal $31 million”:
“Multimillion-dollar hack”
A hacker stole $31 million by exploiting a bug in software [that] Blockchain startup MonoX Finance … uses to draft smart contracts. [It] lets users trade digital currency tokens without some of the requirements of traditional exchanges.
…
An accounting error [in] the company’s software let an attacker inflate the price of the MONO token and to then use it to cash out all the other deposited tokens. … Specifically, the hack used the same token as both the tokenIn and tokenOut [which] greatly inflated the price … because the updating of the tokenOut overwrote the price update of the tokenIn.
…
MonoX isn’t the only decentralized finance protocol to fall victim to a multimillion-dollar hack.
You can say that again. Thomas Claburn says that again—“BadgerDAO DeFi defunded”:
“Assertion of overconfidence”
BadgerDAO, maker of a decentralized finance (DeFi) protocol, said … it is investigating reports that … $120.3 million … in user funds have been stolen. … The DAO in BadgerDAO stands for Decentralized Autonomous Organization [which] perhaps explains its deer-in-the-headlights crisis communication.
…
BadgerDAO doesn’t list a central headquarters, nor a phone number, nor … email. Instead, it directs customers to its Discord channel. No, really. Discord.
…
Yes, people still use the term “smart contract” with a straight face, even though they would be laughed out of the room were they to use an equivalent assertion of overconfidence like “my bug-free code,” … or “my impenetrable self-rolled cryptography library”.
Who in their right minds is trusting these platforms? Whoever they are, Bruce Schneier wants them off his lawn—“Smart Contract Bug”:
“Reason enough never to use”
The basic problem is that the code is the ultimate authority — there is no adjudication protocol — so if there’s a vulnerability in the code, there is no recourse. And, of course, there are lots of vulnerabilities.
…
This is reason enough never to use smart contracts for anything important. Human-based adjudication systems are not useless pre-Internet human baggage, they’re vital.
Well said. Julien Bouteloup is scared to upgrade his firmware—“rekt roadkill”:
“DeFi users can’t afford to get too comfortable”
A user flagged the suspicious increaseAllowance() approval … almost two weeks ago. … How did Badger not notice?
…
$120 million taken in various forms of wBTC and ERC20. … The vast majority of stolen assets were vault deposit tokens … with the underlying BTC bridged back to the Bitcoin network, and any ERC20 tokens remaining on Ethereum.
…
Should regular users be expected to spot an illegitimate contract? … If longstanding projects with such strong reputations as Badger can get rekt like this … DeFi users can’t afford to get too comfortable.
As Schneier said, humans aren’t pre-internet baggage. Bongle agrees:
“It's really, really hard”
I like how, with smart contracts, they’ve managed to create something so obtuse that for an operation a human would instantly say “sorry, we don’t do that,” the smart contract happily allowed them to run off with [$150 million].
…
It’s really, really hard to prove even the simplest code does what the spec says. And then the specs are hard to write too.
Indeed, as olliej argues, “It isn’t theft”:
“This is the correct result”
The whole point of the “smart contract” nonsense is that the code is the exact legal contract. What is “meant” is not … relevant and the ability to argue about such things in court is considered a flaw that these contracts are meant to be fixing.
…
Someone obeyed the terms of the contract and earned coins in exchange. By all the definitions that crypto folk have been throwing around this is the correct result, and if people didn’t like the terms of the contract they didn’t have to accept it.
Interesting point. garyisabusyguy is a busy guy, so puts it more succinctly:
Is it a bug if it was designed to do that? Just askin’ for a friend.
If we can argue it’s not theft, what is it? Impossibly Stupid categorizes it thuswise:
“Code is vulnerable”
People need to get their thinking straight about this kind of thing. It should have more properly been reported as security researchers collecting a [$150M] bug bounty.
…
We need to stop calling things “smart” when they’re stupid. … Maybe the better term for these things is “hackable contracts.” Code is vulnerable … and any developer that doesn’t understand that is a dumb hire.
But people don’t know what they don’t know. Here’s Richocet, bouncing off that idea:
“Dunning-Kruger”
I worked in the finance industry for 10 years and IT for 20. I would not touch crypto with a bargepole.
And I kind of understand it. Why do so many people who don’t understand how crypto works speculate in it or trust it? Dunning-Kruger?
Meanwhile, LuDux alleges an allegation:
Working as intended. Who wants to bet this ‘hacker’ was just the company owner looking to exit scam?
And Finally:
Wait, what?
Previously in And Finally
You have been reading SB Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weirdest websites … so you don’t have to. Hate mail may be directed to @RiCHi or [email protected]. Ask your doctor before reading. Your mileage may vary. E&OE. 30.
Image sauce: Steve Berry (cc:by-nc-sa)
[ad_2]
Source link
