Hacker News Reader

Comment by herodotus | Hacker News Reader

So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked for major computer companies; I was a computer science professor; I have apps on the App Store. In spite of all of this, I have not the foggiest idea, even after reading the thread, how someone who offers to give me something can use the gift to steal from me. Surely this says that the world at least of ETH (whatever that is) is really really broken!

View on HN

According to this talk about NFTs, an NFT can contain code and the execution of that code can be triggered to do unsafe things.

at 1:22:50 Smart contracts are just code, they’re software, there’s no reason they can’t be viruses or worms, the primary limitation is processing power. But, also, it’s a virus that someone can drop directly into your bankless bank account and just wait for you to activate it. And, yeah, that’s right, there’s no offer/confirmation step in sending tokens back and forth, someone who knows your wallet can just drop stuff right into it, so, like, pin that somewhere in your brain.

Line Goes Up – The Problem With NFTs

https://youtu.be/YQ_xWvX1n9g?t=4970

FWIW it doesn't seem that's what happened in this case. It seems the NFT was just part of the attacker's ruse, where they told a story about some NFT staking dapp they launched. Then the malicious dapp asked for permission to transfer the victim's aWETH tokens. This is just part of the ERC-20 API, unrelated to NFTs.

While it's true that NFTs can be sent without permission and can contain code, users normally invoke contracts via (hopefully trusted) dapp websites, such as app.uniswap.org. Invoking code from an NFT I found in my wallet is possible, but not part of any normal/legitimate workflow that I'm aware of.

I don't think the NFT is very important here; basically the scammer's website asked the victim's wallet to sign a message, using the private key that holds their ETH.

It looks like the message in this case would have given the attacker permission to transfer the victim's aWETH, which represents ETH that has been deposited into an Aave lending pool. These transfer permissions are something all ERC-20 tokens support.

Typically users will only sign messages sent from trusted websites, just as they would only install software from trusted sources. Or they can sign a questionable message from a separate wallet which doesn't hold much value, as the victim did here.

Granted, this isn't a great situation. It can be hard to know which websites to trust, and even trusted websites can be hacked and then send malicious messages to unsuspecting users.

Basically it was the smart contract[1] that came with the NFT where the victim is essentially executing foreign code that gets granted access to their digital wallet. That's the reason the scammers were so insistent that he did it on his main wallet (i.e. where the funds were)

[1] Think of these as being similar to Word or Excel macros embedded in a document... nothing bad ever happened with them, did it? ;-)

It wasn't just giving something. The NFT was given, but this in itself does nothing. The victim was then asked to stake that NFT. To stake an NFT, the smart contract that does the staking needs access to your wallet. This too is normal. Except that the permission prompt asked for approval on another smart contract by means of a misleading name.

There's nothing broken here. A smart contract is just a piece of code that moves money. You better be sure about what it's doing before you allow it to run. There's blue chip smart contracts that are proven and thoroughly audited, but anything else you need to read the code. Same as reading a contract before you sign it.

This kind of thing always reminds me of one of those articles that used to pop up from time to time about some massive coup in EVE Online. I wouldn't have any idea what they were talking about or why it was showing up on my radar, and moreover, it would be clear that the money, time, and energy required to begin to have even a neophyte's understanding would not be worthwhile.

I'm still not convinced that Ethereum isn't just a strange RPG that people who don't really want to play are accidentally getting involved in.

> but stories like this make me think that crypto can never become mainstream.

We had illegal p2p sharing where you could download a virus from bad people and then Jobs came along and made iTunes which set the standard for streaming. I am sure someone will come along in the crypto space and make crypto easy for the rest of us.

itunes isnt p2p

You missed the point.

People wanted easy access to music, itunes provided that service.

Right now with the world of crypto is confusing to the average guy, so hopefully in the future someone will create a good UX and the underlying to protocol for instant decentralised payments.

> Right now with the world of crypto is confusing to the average guy, so hopefully in the future someone will create a good UX and the underlying to protocol for instant decentralised payments.

So... Napster and LimeWire?

You can't break cryptocurrency's weakness for this kind of adoption without dropping decentralization. Same conclusion that iTunes came to. People wanted downloadable music, not a specific implementation detail about how that music is delivered.

I, for one, don't want easy access to crypto "currencies". No matter if it can be made safe.

I wouldn't touch it with a ten foot pole. I just don't see any sense or reason in the concept.

It's mighty arrogant from crypto enthusiasts to assume that everybody will jump on it as soon it just can be made mainstream and "safe".

Thanks, but no thanks

The subtleties of crypto are inscrutably intricate, but for simple transfer between two parties, Coinbase exists and its UX is easy enough. Of course, it's the opposite of decentralized, which defeats the point.

Or they could use a bank. They generally have fine UIs and secure protocols.

and how are you going to pay when the bank closes your account because you broke their terms and conditions. That is where you need decentralized payments.

This simply doesn’t happen at a rate nearly high enough to make griftocurrency a “need”

Reply on news.ycombinator.com