Hacker News Reader

Now say you're a company hired to do an audit. Same incentives.

The hilarious thing is nearly all of these high profile hacks happen even after being audited.

There was one company I remember being called out as a suspect, but I can't find the name.

Also given (a) anonymity (b) ability to take cover amid so many other hacks, you could do this for a few years, slow down, and remain a top tier firm claiming the lowest hack rate.

Are you thinking of solidity.finance?

https://rekt.news/deathbed-confessions-c3pr/

> Actually, it's worse than that, because unlike normal banks, the code used by these digital banks is open source, and anyone in the world can go bug hunting.

An argument that open source is less secure, and on Hacker News! Now I've seen it all.

It is not a statement about security but about plausible deniability.

There is an argument to be made for having some things remain closed, and obscured from public view. If a company/group has an experienced and large internal audit team that reviews systems, and they are building something that is likely to be placed under extreme amounts of targeted attacks (military crypto, banking systems, etc.) it sometimes makes sense to not allow just anyone to see/poke at the whole thing.

Military cryptographic systems, IBM mainframes, and many other products use this approach as a layer in their security framework and it is actually pretty successful.

If I asked you to break into the a PFSense box you could just Google "PFSense version X.X.X CVEs" and you would probably get a way in if the box was enough out of date, but if you tried to find the same thing for something like the General Dynamics TACLANE you would have a hard time even finding where to start.

I think the bigger problem is people who are intentionally being malicious rather than people who stumble upon a bug. Just look at how many people fall for wire transfer or gift card scams. Crypto allows scammers to do that much more easily, since there is no human in the pipeline to flag transactions, and since there aren't the same limits that banks put in place on transactions. If someone finds a way to exploit a particular pattern/transaction type/etc. it's not like you can just immediately patch it when you have a decentralized currency. Ex. in an Bitcoin wallet malicious actors could show any text they wanted in an update popup [0]. So of course this was immediately used to steal millions.

With crypto all it takes is one piece of malicious software, or to fall for a single phishing email, and you've lost everything.

[0] https://www.zdnet.com/article/bitcoin-wallet-trick-has-nette...

> And law enforcement is a thing!

More than that, there's a minority perspective in DeFi that the code is the law. If the code allows it (e.g., withdrawals under an unintended circumstance), it's therefore legal. If it were illegal, the code wouldn't allow it.

I think this could make sense if it is applied in a small community of tinkerers that understand and accept the risks (cf. accredited investor), or I suppose a community of dissidents that trust the police even less than they trust the code, but for wider society it would not be appropriate.

> quit his job, wait a month, go to a coffee shop with a hoodie on, boot into whonix, connect to the internet with a 4g dongle, run a few lines of code, and get $600 million dollars.

Think again. In the wild wild west that is cryptocurrency the first thing people assume is an inside job.

People with a lot of money and a cut-throat ethic will send death threats to your front door merely for small bugs you accidentally commited to github or for a governance dispute on a forum where you posted pseudonymously.

If you dare steal money as an insider you had better make sure you know how to use it to quickly get high-end personal security for you, your family, and friends. This of course simultaneously outs you as guilty.

Any hack occurs and you are immediately woken up in the middle of the night to be interrogated by people you've never seen before let alone heard of, stomping through your apartment. Your life becomes a movie.

Angry vicious actors with few scruples and long memories will loudly and expensively hunt for you for the rest of your life so you can make them whole. LEOs aren't even your biggest concern at that point.

Being an insider or former insider after a large hack sucks whether or not you're guilty.

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

It’s very hard to take this claim seriously in this thread, which details a huge (and somewhat obvious) security vulnerability in a currency worth at least $600m (an amount anyone would assume is “first-tier”).

Yeah I can understand that. Once you dive into crypto however, you quickly realize that $600m is just not that much money (especially not if we are talking about digital assets valued at current ticker price). And that lots of money isn't necessarily the right measure of quality of the project.

Lol, even 1% of $600M is $6M. That's a lot of money. You'd have to have garbage liquidity to only get back 1%.

It’s valued at 600 million that does not mean it can be liquidated for 600 million.

That is literally what that means. Market caps are what they are because everyone who thinks it is worth less has sold and everyone who thinks it’s worth that or more will buy. There’s some outliers but in general these coins are trading their entire market cap over the course of maybe a month or less. Liquid generally means short term, if you can sell it for cash in under a year then it is liquid. Sure if you tried to sell all coin today in the same minute you won’t find a buyer but over a month this happens all the time.

I had never heard of this bridge before the attack. The fact that a project manages to attract half a billion in capital unfortunately doesn't say all that much, since so much capital is flowing in so fast to every project with a pulse.

And the bug wasn't really obvious, although the lack of input sanitation is something an auditor (given enough time) would probably point out.

Do you have some sources for this claim? Or just a belief?

High quality protocols like PoolTogether for example have this: https://docs.pooltogether.com/security/audits-and-testing

Most people have never heard of PoolTogether, so I’m not sure if your definition of “first tier” and “high quality” is objective.

Regardless, this quote from your link stands out: “it should never be expected that 100% of the deployed code has been formally audited.”

It has $175 M locked in the protocol, it is also featured on https://ethereum.org/en/dapps/, and is one of the oldest DeFI projects. By my definition, it is both "first tier" and "high quality". We can of course have the philosophical debate of objectivity and if such thing even exists, not sure if it's needed here though.

The audits of this protocol is also continuous.

175M$ is like 1/4th of the hack that this thread is discussing.

Also, they specifically state that not everything is audited? Nowhere do they mention continuous audits.

You are right, it's not mentioned, but they do in fact spend hundreds of thousands every few months for audits. You'll find more info here: https://gov.pooltogether.com/

Here are some examples I'm aware of, I haven't personally verified these.

Uniswap: https://uniswap.org/audit.html

Sushi Swap: https://github.com/peckshield/publications/blob/master/audit...

Alpaca Finance (high complexity in my opinion): https://docs.alpacafinance.org/transparency

A lot of projects provide their source and you can verify that what you're interacting with matches the source.

Not sure what you mean by source, but its fairly easy to find out if any official audits were done as this is always announced and documented by the involved parties (for example, I couldn't find any detailed audit info for Poly). It's not like the audit is mandated by law, its initiated by the SC owners to put the investors at ease. A lot of companies like Certik, Consensys, ZK Labs, etc. provide auditing services for this purpose explicitly.

Auditors have never fully prevented bugs in any other computing domain, i dont know why cryptocurrency would be any different.

Can't the same be said that auditors have never fully prevented fraud in the real-world?

The real world has ways to reverse fraudulent actions. Crypto does not.

Sure i guess, but im not sure i see what point you're trying to make. Nobody is claiming that auditors will prevent all financial fraud.

As this space evolves, I think there will be insurance and basic best practice safety measures. Also considering that almost all blockchains are open by design, it's no trivial task to liquidate a large sum of stolen tokens. So its not exactly a straight path from writing a script at Starbucks to making hundreds of millions of dollars.

I agree. There are already some insurance protocols in place - see Cover Protocol or Unslashed Finance. Its still very early in this space, but things are definitely developing!

There already are a number of insurance options.

I wonder if there's some way to make a "thief monkey". Some program that searches your code for vulnerability patterns and rips you off if it can. (Obvs, a tame monkey will then give you the money back).

Humans might be motivated to sit on a bug until they can reach the cybercafe. Bots, not so much.

Why should law enforcement be a problem? I thought the idea behind smart contracts was that code is law?

but is it that simple though? Even in enterprise company we have to do 2-3 review on PR before merging.

I think proper DeFi company should have their own system on deploying contracts. Further, they should have their own security team that audit everything.

That's what you hire auditors for.

An auditor has the same incentive to become a bad actor for profit