Have a friend who lost more than $12k in the process of buying a house. Scammers sent the wiring instructions a few hours before the legit closing attorney sent the real instructions. The email looked <i>exactly</i> right except for a minor change to the domain name from address.<p>After one hour, wire transfers sent in error are no more recoverable than crypto.<p>How the thieves knew so much about the process and timing is supposedly being investigated, but no one is holding out much hope. And the attorneys have a strong incentive to cover up any evidence of intrusion on their side, assuming it was their infrastructure infiltrated.
I really think that all of this DeFi stuff is playing with fire. If these tools scale large enough, it's easy to imagine breaking the right link in the system at the right time to cause catastrophic failures.<p>Remember that all complex systems operate in a degraded state. If there's ever a way that only part of a complicated swap executes correctly the trade can get really far out of position. People in Ethereum land will say things like "the smart contracts can't possibly execute if all of these conditions aren't met!", but I can assure you that lots of extremely fault-tolerant systems built by very smart people (like electronic stock exchanges) have failed in very surprising ways.<p>Weakly collateralized flash loans are just faster leveraged tools with all of the tradeoffs that entails.<p>YMMV, there's definitely a lot of money to be made.<p><a href="https://www.youtube.com/watch?v=SjbPi00k_ME" rel="nofollow">https://www.youtube.com/watch?v=SjbPi00k_ME</a> << Relevant.
As an elaborate real-money PVP system, Etherum is amazing. As a means of doing relatively normal business, being sniped, frontrun, or exploited is hugely off-putting.
I can't imagine running (or investing) in a software-based company here without also having an automatic model checking layer for verifying all runs + 24/7 monitoring for disabling any live contract. If you're going to put $10M+, years of your life, and who knows how much customer money into this, why not spend $500K of it so you're running with the blockchain equiv of CI testing? You'd be able to deploy <i>faster</i>, with more confidence and less stress, and fewer of these weird midnight Europe phone calls.<p>Viable model checkers for basic software contracts existed since the 80's, and the modern incarnations are insanely powerful (Z3, ...) + quite approachable (Rosette, ...). They're used to tackle software verification problems magnitudes harder than "money can only go from here to there in this tiny software contract": race detection in distributed file systems, bugs in hardware circuits, security holes in big javascript libraries, etc. I think of these same not-very-secret tools every time I see one of these articles, and yet the engineering fails keep happening.<p>A few teams deploy tech here, including built on the above, but it seems like most do not. I'd say mind-blowing, but at this point... mind-numbing?<p>I do appreciate the author being frank about how bad the status quo is.<p>EDIT: To give a sense of this -- the same people will talk about meticulous cold storage key exchanges with someone always being there to watch, driving into the desert for bootstrapping secrets, and then for their actual operations, deploy unverified contracts.
"Better yet, if you happen to know a miner (we didn’t), you could have them include the transaction directly in a block, skipping the mempool—and the monsters—entirely."<p>ugh. It's not what you know, it's who you know<p>That said, this looks like a very interesting and rewarding system to hack. But it seems to serve little purpose. The other comments comparing it to Eve Online are spot on
The environment described in this article is horrifying and definitely sounds worse than our current financial system. That person just lost $12k to fraud and has no recourse at all.<p>I agree with the other comments on here. Blockchain/crypto has always made me uncomfortable. I think it's a mix of the slimy get rich quick aspect of it that draws a lot of people and the cyberpunk/dystopian rhetoric around it.<p>I also think it's telling that even though Blockchain has been this hyped thing for 6+ years at this point, we haven't really seen it actually be used for anything outside of cryptocurrency, which in and of itself isn't used for much outside of speculation. On the other hand, machine learning is used in everything now and makes a lot of stuff better.<p>It definitely sounds like there's an additional major innovation that needs to happen with this stuff before it's really usable.
> Because I’m a professional DeFi thought leader, I had never actually deployed a contract to Ethereum before.<p>As a developer that uses the EVM quite often, this had me laughing out loud!<p>That matches my experience with pretty much everyone!<p>And yet there are still the people doing things I could never think of doing and doing it very quickly. I want to get to that place.
Makes me think of the book Accelerando, where sentient viral corporations and Economics 2.0 posthuman intelligences running amok in virtual space, trading uploaded human constructs as currency.
I wonder how these bots perform the shorting. Do they take the modified instruction and increase miner reward to make it more prioritized than the original transaction? Such a bot would be hard to counter as if you set some reward value, even if it's extremely high, it would take it and increase it by 1. Even if you saw that value yourself and increased it yourself, they could counter your counter by inceasing again, the process continuing until everything is eaten up by miner rewards.<p>If you have multiple such bots, would they fight over the loot, increasing the reward until it's all given to the miners?<p>Are there any logs of rejected transactions that existed in the mempool? Is there evidence of such fighting?
Writing this sort of bot seems like a legitimately fun and interesting thing to work on, but somehow I have less than zero interest in actually doing it. There's just something intrinsically repulsive about the entire blockchain world to me where I just don't want to touch it.<p>I don't mean to offend people who do love blockchain tech, in many ways I don't blame you. But is this feeling I have somewhat common? I'm not even sure how to justify it.
> On Wednesday afternoon, someone asked whether it was possible to recover Uniswap liquidity tokens that had been accidentally sent to the pair contract itself.<p>Uniswap itself is a pretty interesting protocol:<p>> Uniswap is an exchange protocol that allows users to trustlessly swap ERC20 tokens. Rather using the traditional order book model, Uniswap pools tokens into smart contracts and users trade against these liquidity pools. Anyone can swap tokens, add tokens to a pool to earn fees, or list a token on Uniswap.<p><a href="https://docs.ethhub.io/guides/graphical-guide-for-understanding-uniswap/" rel="nofollow">https://docs.ethhub.io/guides/graphical-guide-for-understand...</a>
I didn't study the specific contract in detail, so I could be way off base here, but...<p>It seems like the money could have been safely claimed using a tiny amount of crypto. Something like creating this contract:<p><pre><code> contract Example {
function Example() public {
if (keccak256(msg.sender) == HARD_CODED) {
do_transfer();
} else {
do_something_terrible();
}
}
</code></pre>
Would be bots be able to automatically determine that they need to swap out HARD_CODED with the hash of their own address?
Fantastic story and analogy to Liu Cixin's novel.<p>Writing bug-free code is hard enough, but this adversarial environment is fascinating and takes it to another level.
Did the author get permission for this attempted Good Samaritan deed? Or did he go out on his own and screw up the implementation without the contract owner's knowledge?<p>If it's the latter, that's kind of a shit move.
Nothing in this article seem to make any sense, does the gibberish pseudo-code actually mean something for anyone?<p>I feel like the dumbest of all (and maybe it's normal it's far away from my area of expertise). But seriously this sound more like a sci-fi plot that actual engineering.
I have literally no idea what all of the stuff in the article means, but it sounds like the whole thing was broken from the start.<p>If someone can take the transaction you just sent and somehow jump in front of you to execute the same one, your system seems fundamentally broken.
I have dabbled extensively in the "traditional" *coin scene, but always shied from eth and the associated ecosystem. Stories like this are the reason why.<p>While I could articulate -and genuinely believe in- a raison d'être for the alt-finance tools created by blockchain systems, the premise and concrete value of the exceedingly sophisticated mechanisms in ethereum continue to elude me.<p>Given the primitives of account & transactions through distributed ledgers, one can construct a wide variety of services and use cases that interface with the real world on the user side and on the 3rd party service side.<p>Are there any services and use cases in ethereum-land that are actually oriented towards users? Because it seems to me that the only group getting measurable value beyond education are actors seeking to extract profit from "legitimate" value store or flow.<p>And I thought getting away from them was the entire point of Bitcoin et al. for the ordinary man.
In the article: "Better yet, if you happen to know a miner (we didn’t), you could have them include the transaction directly in a block"<p>But how could you guarantee the miner was trustworthy, and wouldn't just take the money after you told them.<p>Hmm...what if we could come up with some sort of smart contract...<p>(recursion ensues)
The whole thing is a complicated, wacky game. The DeFi stuff is especially fun right now. Opportunities (and danger) abound. There is so much money locked up in DeFi.<p>It's not necessarily always good for the bots either. They can be exploited and tricked as well.
Why did they try rescuing the $12,000 pot on their very first attempt instead of planting a bunch of $10 dummies and rescuing those instead? Once they perfected how to rescue the dummies, then move onto the real target.
This paper is really worth a read, if only because it shows how much smart contracts is a brand new territory, mostly unexplored, full of opportunities (and therefore dangers).<p>If you're a blockchain naysayer [1], I'd invite you to go read this paper to measure how deep, rich and complex the world of smart contracts is, and at the very least get a feeling that you may simply not know how uninformed your negative opinion is.<p>[1] <a href="https://en.wikiquote.org/wiki/Incorrect_predictions" rel="nofollow">https://en.wikiquote.org/wiki/Incorrect_predictions</a>
I'm not sure when Ethereum supporters would wake up. Ethereum's design creates this kind of Dark Forest problem. When it is programmable, you are at risk of being overpowered by bots. Computers are far more efficient than humans. Smart contracts are not smart. If they're too complicated (smart), humans can't comprehend them. So they're mostly dumb. Bots will overrun humans. With Ethereum, you know you're entering a digital Dark Forest. But you still want to explore it. You venture into the Dark Forest and got attacked. It does make an interesting story. But it's a fairly useless system.<p>With cryptocurrencies, you want to "slow" the system down. You want more redundancy. You want less efficiency. It's the only way to fight the automation monsters. Bitcoin is money. Ethereum is a fun and experimental Dark Forest.
Does anyone else think that Solidity is far too low-level for the purpose it serves? I really don't think connecting to ports (as an example) should be something in a financial contract.
IMO this is why anyone dumb enough to spend time building trading algos for crypto should really just use that time looking for vulnerable smart-contracts / projects if they actually want to see returns LMAO.<p>I used to work in the space in the blockchain tracing space - I helped build one of the first intelligent tracing systems that could handle tokenized assets on ETH.<p>I have zero regrets leaving the space...
Similar things happen with real money all the time. Many players can hack, over charge, short, manipulate etc. It may be less obvious, or somehow perceived legit, but we are not really shielded from other players taking our invested money with all kinds of "financial tools" that are hard to understand. Ethereum is just more direct, more feasible
Perhaps due to a certain naivete I enjoy almost all discussions on HN. There are few exceptions and discussions under blockchain-related posts are the a prime example. I will disclose right away that I wholeheartedly think that blockchains are here to stay and to solve many problems. The general sentiment on HN, and this thread so far is an example, seems to be animosity toward the idea in general lightly veiled by pretext of pointing out technical challenges (which are numerous, I do not think the most ardent blockchain proponent will deny). Every time I try to point some great ability of "smart contracts" in return I hear blanket unthoughtful responses like "well how is it better than a database" or "how is it better than a REST call" (for example this exchange about the Baseline protocol <a href="https://news.ycombinator.com/item?id=23824584" rel="nofollow">https://news.ycombinator.com/item?id=23824584</a>).<p>Perhaps starting with a general accusation of the community is not the best method. But I'll move on... There are things that are very important to understand about blockchain. The most important one is that the technology and the systems built on it are _extremely_ young. Blockchain is like the 80s of computing. I would compare it to editing Unix system settings with "nano" to adjust a basic setting of your operating system - lots of horror stories for sure. The big difference is that people are out there to make money off of your mistakes. Yes, it can be a hostile environment. As the article alludes to - full anonymity of transactions is still in the pipeline! I do no know a single blockchain project out there that allows to interact with contracts anonymously yet. If blockchain is still alive a few years from now (and I have little doubt about that) then things like Optimism (mentioned in the article) will have made a whole array of shortcomings obsolete. Awesomeness does not happen overnight, it took _decades_ for the internet to become the ubiquitous integral thing that it is now.<p>Actually, I'm glad the author used Uniswap as an example, because it is a simple and powerful system that would not have been possible without blockchain. (Aside: Uniswap is actually one of the first products to create a POC of running on top of Optimism's Optimistic rollups, so they are no unaware of issues). It was conceived initially by Vitalik himself and implemented as an Ethereum grant. The basic idea is that a contract controls two pools of tokenized assets. The assets are provided by people who get a cut when a trade happens. The price of assets being exchanged is equal to the ratio of their quantities in every pool. That is it!!<p>Now, why do I think that a system as Uniswap is awesome. Right now most tokens are either tokens for other projects or USD. As the variety of tokenized assets grows (for example some Japanese banks are looking to create a digital Yen, and there are clues that suggest it might be on Ethereum) what you get is an extremely simple no-middlemen system for exchanging things of value. Now, in theory, any programmer can write a program, say, for currency exchange in one evening - no middlemen, no 3rd parties to trust, no banks, no clearing houses and a basic API anybody can integrate. The system is not perfect, and that's what the article is about. But the concept can be revolutionary.<p>The blockchain money-grab is disgusting to look at. But do not throw the baby out with the bathwater.
This is fascinating. I never thought of writing a bot to watch the mempool for exploitable transactions. Perhaps in the future it will be more common to send your transactions privately to a miner instead of putting them in the mempool.
I turned that blog post into a video<p>A visual explanation of how someone made 12,000 USD in a single Ethereum transaction with front-running.<p><a href="https://youtu.be/vP5hVkH_1gs" rel="nofollow">https://youtu.be/vP5hVkH_1gs</a>
In additional to the "Dark Forest" analogy here, there's another hilarious analogy of Ethereum I've heard of - it's a game of Core War, but with money in it.
Ok, I got the part with the arbitrage bots and frontrunners - but could someone ELI5 to me what the uniswap contract was supposed to do in the first place?
I have rarely seen so much effort and intellect expended for something so wildly pointless... conspicuously missing from these whole shenanigans: anyone doing anything that a normal person could recognise as being of practical use.