Hacker News Reader

Comment by sidcool | Hacker News Reader

I feel incredibly dumb for not getting the details of how it happened.

Hacker sends NFT to Thomas.

Since NFT's are subject to heavy criticism of their existence, a lot of people are developing extra things you actually can do with them. The market is interested in that being done right, so its interesting to be a part of projects that are trying. This extra thing required Thomas sending the NFT to another service they developed. Smart contracts in Ethereum Virtual Machine environments (EVMs) have to be primed to recognize asset. So there is something called an Approval. When Thomas interacted with this contract it did the approval for the NFT, and also an approval for aWETH a token associated with that project.

aWETH is the ticker symbol for a token that project created called Armstrong ETH. The namespace for ticker symbols has many collisions as there are many tokens. So people aren't too worried about that, a token's ID is its contract address which does not have collisions.

In this case, this was the actual phishing attempt.

Their project did indeed use a token called Armstrong ETH, but their approval was for aWETH which is Aave Eth, an asset collateralized by liquid valuable actual Ether. It is also redeemable for actual Ether.

So if Thomas approved the use of their project from his main account, the hacker would have been able to use another function written in their smart contract that leveraged the approval of aWETH (the Aave Eth) to take it all away from Thomas. He has $100m of that.

Very close one for him.

> a lot of people are developing extra things you actually can do with them

To be clear, the “thing” in this instance is NFT staking: a ponzi upon a ponzi where you buy a NFT and then lend it to a platform, which pays you fees. Platforms can advertise ridiculous yields (200% APY) because deposits go right out the door again as fees to people higher up in the pyramid.

https://learn.bybit.com/defi/what-is-nft-staking/

I have a feeling that it's all going to end really bad.

That often happens, yes.

Imagine if they got his $100m! That would be an article for a whole half of a week!

Thanks, this was a great explanation.

He had $130 million wrapped up in an ERC20 token called Aave wETH (aWETH). ERC20 tokens let you approve another address to spend those tokens on your behalf. Basically, the scammers tried to trick him into approving all of his Aave wETH by creating a fake website designed to make him think that he's approving a different token with the same aWETH symbol.

So he spent $130 million to buy the NFT in the first place?

He has loaned ETH to a money market. The NFT was a Trojan horse that tricked the user into giving away their loan claim tickets.

So besides getting scammed, what use are these ERC20 for?

They're basically receipts for putting money into a lending pool. In this case he's lending about $130 million, on which he's earning interest, and can get his money back by redeeming those tokens.

My apologies for being so ignorant on crypto lending, but I'm not even sure where I'd look up the details of how this system works.

When Thomas puts that money into the lending pool, what happens if the borrower defaults? Did the borrower put up some non-liquid collateral? Did someone do a background/credit check? Who takes the loss, is it split across the pool?

I understand how traditional bank loans work, I'm a little lost how much risk is being taken by the loan issuer here.

Aave's documentation [1] is pretty good if you're interested in doing a deeper dive. But yeah, it's a collateralized loan where the borrower stakes some ETH.

So the idea is that I can take $100 worth of ETH and put that up as collateral for a $75 loan. And if the value of my collateral drops due to the ETH<>USD exchange rate I have to stake more collateral. If I don't (or if the exchange rate moves below a certain point) then my collateral is automatically liquidated at a discount. So in this case, if the value of my collateral falls to $80 the contract will put it up for sale at $75 -- this creates an arbitrage opportunity, so the liquidation will likely happen very quickly.

There are other lending protocols where you can stake other assets (NFTs, other tokens, etc.), but this is my understanding of how Aave works.

[1] https://docs.aave.com/faq/

Let's use cash as an analogy.

Someone comes to you and says "I'll give you X Euro if you let me hold onto your Y Dollars until you give me X Euro back."

You think, well Euro are useful, maybe you need Euro specifically to invest in an European business. So you agree.

But when you review the contract presented it just says you give Y Dollars, so you go "wtf?" and refuse to sign.

Apparently, some people are dumb enough to hand over their cash without reading the contract, and an entire industry exists to fool people into doing so.

This is the best ELI5 in this thread. Thanks.

He has around $130mm of a token called aWETH, which stands for Aave Wrapped ETH and means he has that much ETH deposited into the Aave app. The attacker tried to trick him into giving their contract control over his aWETH under the guide of being a different, useless, token that they were just trying out.

If he approved their contract to be allowed to control his aWETH they'd take it all.

Reply on news.ycombinator.com