Hacker News Reader

Comment by berkes | Hacker News Reader

No. This was neither ETH, nor the Ethereum blockchain. Nor does this imply more issues indeed exist today.

From the bounty: "The Summary On 2/2/2022, I reported a critical security issue to Optimism—an "L2 scaling solution" for Ethereum—that would allow an attacker to replicate money on any chain using their "OVM 2.0" fork of go-ethereum (which they call l2geth)."

No - sorry - ETH doesn't get a 'pass' on this.

The 'Rest Of The World' is tired of the Crypto Scam Delusion masquerading as something reasonable and watching these critical failures getting swept under the rug.

This issue demonstrates that critical failures will exist in the wild (and it's wrong to suggest that they won't come up in the future - they will) creating an existential flaw for systems in which there is no intrinsic remedy. Forks by 'completely arbitrary central powers' entirely defeat the purpose.

Just last week we had the FBI arrest criminals laundering literally billions in Crypto.

It's a tiring fraud absorbing enormous amounts of attention and energy for no apparent benefit but entertainment.

The concept is currently fundamentally flawed, it belongs in 'side project' territory for now, not in the mainstream.

By definition an "L2 scaling solution" is not the Ethereum blockchain.

Ethereum itself clearly is a secure blockchain given the fact that it has not been exploited directly ever, as far as I am aware. Smart contracts running in the EVM obviously have exploits galore, but that is different from Ethereum itself being vulnerable. Just like it is different when the Java Virtual Machine itself has an exploit (uncommon) vs when a program that runs in the JVM does (very common).

You can of course argue that the lack of inherent soundness / correctness in Ethereum smart contracts makes the entire chain less useful since running smart contracts is kinda the whole point, but then you should make that argument rather than saying dumb things like:

> ETH was an insecure blockchain

> Ethereum itself clearly is a secure blockchain given the fact that it has not been exploited directly ever, as far as I am aware.

Oh, so it can only be exploited indirectly. Yeah, wow, that makes it oh-so-secure.

This was a critical success for Optimism's bug bounty program, if anything? No one got rug pulled. Optimism's liquidity could have been drained in the worst case, and still ETH L1 would remain unaffected.

It's great for a 'bounty program' - but it speaks negatively to the intercity of a system that is not supposed to have any centralised control.

I think it speaks to the reality of a development process lead by humans in uncharted territory. Figure it out, audit it, test it for a long time, eventually cross fingers and blow the fuses. After that, either it successfully becomes a permanent public fixture, or maybe there's a small chance it implodes one day, who knows?

Certainly anything that's absolutely mission critical should not live on these L2 networks yet.

"I think it speaks to the reality of a development process lead by humans in uncharted territory."

Yes, exactly, and that's why we can't have distributed systems with 'no central authority' - if those systems are inherently and always faulty there needs to be intervention of some kind by an 'authority'.

There is no such thing as a trestles system, the whole thing depends on webs of trust.

I guess we’ll find out Soon(TM). Trustless computation is the plan. Maybe it’s possible to build a system that’s correct/antifragile enough, when you restrict yourself to some hundreds of lines of code tops?

That could be true, but it doesn't matter until we find a real use case that transcends our regular systems.

Optimism, Arbitrum, and other Ethereum L2 rollups plan to have decentralized sequencers.

It’s all new technology so they’re taking it slow.

Reply on news.ycombinator.com