Hacker News Reader

> it's got to be the biggest, most massive security hole I've ever seen brushed off.

Well said. This goes hand-in-hand with the victim blaming that goes on in cryptocurrency circles. Any time a story like this appears, defenders come out of the woodwork to insist that it's the victim's fault for doing something or not doing something else. Even the linked Twitter thread is full of replies from people suggesting that the author was "asking for it".

Crypto seems to appeal to people who like to think that they are smarter than the average person and therefore will succeed by self-managing their finances right down to the private keys. Adding smart contracts to the mix basically opens up a can of worms that makes it unrealistic to actually control every detail of your money unless you strictly limit each contract to a separate wallet and only transfer funds into that wallet before activating the contract. That's honestly a good strategy if you're sitting on $100mm+ in cryptocurrency and the transaction fees are negligible (as was the case with the Twitter user). However, when transaction fees are $10/each or more, the average crypto user isn't actually doing anything of the sort. They're clicking the buttons and hoping for the best.

> Crypto seems to appeal to people who like to think that they are smarter than the average person and therefore will succeed by self-managing their finances right down to the private keys.

I've been calling them Dunning Krugerrands for this reason, and I suggest others do as well.

I hereby award you five internet points. As part of your prize you Al's get to name this currency.

This isn’t how it works. With ERC20 you “approve” tokens. That allows the specific contract you approve to spend up to a specific tokens at that specific address. Things that a random smart contract cannot do:

1) Spend more tokens than the amount you approved. 2) Spend any other tokens besides the specific type that you approved. (E.g. can’t steal your NFT or USDC) 3) Spend tokens at any other wallet address even if you own those other addresses (and creating a new address for a specific purpose is trivially easy)

In addition the only approve() technology is already being replaced with the modern EIP-2612 standard. (USDC already implements it.) In this workflow instead of pre-approving a contract, you sign a specific transaction-specific message. With EIP-2612 you know exactly how much you’re spending on each transaction and there’s zero after the fact risk.

I'm very much aware of how ERC20 contracts work, I've written them.

I'm glad the standard for approval of control of wallets is being deprecated for one with more granularity and security, and I hope it solves this problem.

But that is how it works. The idea that I have a wallet as an extension in my web browser, and people can deliver me any transaction they like, with a "yes" button decorated however they like in the form of a web app, it absolutely does mean that I need to know how to read solidity to be safe and that I must audit every transaction I'm interested in signing. And an engineer would take that for granted, but if that's the standard UX, again, this isn't ready for grandma, not even close.

What ethereum should've done was be a little more slow moving with adding features and maintain mist so that a standard UI feature set could be expected by users.

Thank you, I was going to explain this.

I have seen contracts approve your entire supply though without mentioning it. That would allow the contract to come back at any time, with no user action, to take more coins out.

Just be wary of "Approving" contracts before using them on DeFi apps. That first approval confirmation is the most important as you're basically handing them that much coin and trusting them to give it all back.

Haha, I was never on board with crypto and this is far worse. It's like fast tracking the usual crypto scam.

Also this guy seems rather green in term of internet scams,

> Scammers are getting smarter. Before now, the best scam I've really encountered is basically "hi this is tech support please share your private key so we can help"

When it comes to code, we’re all in over our heads. I can reason about significantly more complexity than most developers I know and it’s still laughable how little complexity I can manage.

When I heard about Ethereum this was my exact fear. Programmable money sounds like a terrible idea from the perspective of business owner. Does this mean I have to check every transaction I enter to run arbitrary code with full access to my wallet? That is of course assuming the code isn't able to break out of any other protections there might be and pay for the ETH I'm getting with my data.

No, no, of course you don't have to check every contract you engage with. At least, not with the help of my conveniently-IPO'ing DAO wETH unwrapper leaser startup. We'll take care of the heavy lifting, you sit back, relax, and pay us no mind (really, please, do not look behind the curtain). We're a Series F company filling the totally coincidental grift-shaped hole where Ethereum left off - contact our sales team on Discord if you're interested!

Shut up and take my liquidity in your farming pools!!!

> Does this mean I have to check every transaction I enter to run arbitrary code with full access to my wallet?

No, for the same reason you don't check the code on every website you visit, if you want to be even more secure then just stick to blue chips like aave, curve, etc you can see how much is sitting in popular defi contracts here: https://www.defipulse.com/

You also don't give an ethereum contract full access to your wallet, you need to approve access to however much you want the contract to have access first then you get a second prompt to allow the contract to run.

You're talking like one accidental misclick and all your money is gone.

If you're super duper paranoid you might want to look at something like argent wallet (https://www.argent.xyz/) which lets you do common trades, defi, staking etc from within the app so you don't have to worry about random contracts and there's no seed phrase so no need to worry about that either.

This went on way longer than i expected

> You're talking like one accidental misclick and all your money is gone.

This is literally happening right now all over the place. Just go to any reddit cryptocurrency sub and do a search for "free token scam." People are finding free tokens in their wallets, trying to spend them and having their wallets emptied.

I don't check code on every website I visit because websites can't just empty my life savings with no recourse.

It boggles the mind that someone looked at money and thought "you know what, this is too simple, let's shoehorn in a Turing complete programming language - that'll fix it!"

It boggles the mind that someone is so lacking imagination that they couldn’t imagine a use for such technology.

Ignorance is unbecoming.

Can you share some uses? Genuinely interested.

Please explain to me how embedding a Turing complete programming language inextricably from a currency adds anything of value that is not offset by the pitfalls of regular users needing to not only know how to code but understand the entire ecosystem that the currency interacts with.

If you are always concerned about the pitfalls of your stupidest user, you will make a product that is only suitable for stupid users.

When you stop worrying about that, and can actually start to deploy advanced technology for your advanced users.

You can weight your argument however you want, all technology will fail some class of user. Me, I’ve been playing with this and various tech for a decade now and the sky is the limit for where this can go.

Okay, but you didn’t answer my question. I’m not talking about the "dumbest user" - I’m talking about a regular person who is currently paid in dollars and understands how to use a debit card. What benefits does making money programmable provide that is not offset by this person having to take time out of their day to audit every transaction and understand how the code making up the transaction interacts with all of the systems it touches?

You got me. The tech is useless, it’s actually a giant fraud perpetrated by public traded corporations to steal our precious fluids. The miners are actually watt vampires. Numbers don’t actually exist, it was a trick invented by the ancients. Blockchains just convert pudding into breakfast. Enjoy meat juice day!

You don't have to be so defensive. Clearly there are issues with things like what happened here. It's like interacting with the website of your bank by sending assembler programs to transfer money. People won't be able to understand what it's doing.

Yeah. And to take it one level further, a language that let's you lock up / burn a coin in any fashion other than a very explicit Burn() command is equally reckless. The platform needs to provide guardrails for developers too.

Think of all the scams happening over TCP/IP every day! They built this thing where anyone can pretend to be a bank website? No checks or security? It's laughable. I'm in disbelief. And this is the web?

There are checks in place to make difficult to buy an SSL certificate for the official domain of a bank.

At least Chrome tracks malicious websites.

By comparison, there seem to be no checks in place to prevent writing an ethereym contract that drains a victim’s wallet.

> There are checks in place to make difficult to buy an SSL certificate for the official domain of a bank.

Who said it needed to be a real bank?

> At least Chrome tracks malicious websites.

That's not TCP/IP, the chrome equivalent would be on Trustwallet, argent, metamask etc to implement.

The ACH banking protocol doesn't have these either.

This isn't Ethereum's job.

It's an L2's job. Whichever ones you choose to engage with. But, they'll all be interoperable.

Anyone that's sent crypto from Polygon to Coinbase would disagree about interoperability.

Polygon is a centralized project, and its problems are its own. Not a decentralized cryptocurrency.

There a number of services that provide blacklisted addresses to help people avoid scams or to prevent stolen funds from being laundered.

Actually most web3 wallets have their own version of "safe browsing" and track malicious/phishing web3 websites.

There isn't much point if domains and contracts are being setup for the sole purpose of spearfishing a handful of whales.

Alright, then same goes for the parent comment within the context of spear phishing...

I never said I expect ethereum or web3 or whatever to be entirely scam free. I said that having the ability to send anyone any transaction and to their eyes have it look like any other sort of interaction they like unless they can read solidity and audit the code themselves is a very very large security hole.