Nomad drained of $150m due to a coding mistake

https://twitter.com/samczsun/status/1554252024723546112

by onion2k • 4 years ago

301 287 4 years ago

The international obfuscated c contest has taught me that programmers can make small mistakes on purpose and its almost impossible to identify legit mistakes from malfeasance.

If we have a situation where:

* Its hard to tell, after the fact, 'a mistake' was a bad actor.

* The programmers are, by and large, anonymous.

* The benefit of making 'a mistake' could be hundreds of millions of dollars that are not easily traced.

This situation seems rife for abuse and bad actors. Not saying it happened in this case. . . but how would you know?

nubb4• 4 years ago

if you enjoy obfuscated c, we have this https://underhanded.soliditylang.org/

OrangeMonkey3• 4 years ago

I am 98% anti-crypto, but this is awesome.

Thank you man!

tgv• 4 years ago

I've always enjoyed the underhanded C contest, but I don't think it's active anymore. Thanks for this. The 2022 entry that I saw was very much in the same spirit.

nyanpasu64• 4 years ago

Reading https://blog.soliditylang.org/2022/04/09/announcing-the-unde...:

In Solidity, the order of evaluation of sub-expressions is unspecified. This means that in f(g(), h()), g() might get evaluated before h() or h() might get evaluated before g(). Practically, this order is predictable, but Solidity code shouldn’t depend on that behavior between compiler versions. In most circumstances g() is evaluated before h() (left-to-right order), which is also the behavior that most languages specify in their standards. However, in the case of emitting an event with indexed arguments, the arguments are evaluated right-to-left.

I feel that order-of-evaluation dependence is a special case of the general conflict between expression-oriented (functional-style) programming, and impure operations requiring sequential reasoning. Another case of this conflict is temporary values (expressions) with side-effectful destructors (sequential reasoning), for example https://fasterthanli.me/articles/a-rust-match-made-in-hell#w....

At this point, is it good practice to avoid using side-effectful procedure calls as parameters to other expressions (especially those with multiple inputs), but instead first assign to a temporary value to make order of operations explicit?

jpmonette• 4 years ago

Isn't the same thing for oss contributions, npm packages, etc.?

cmeacham98• 4 years ago

Slipping an exploit into an npm package doesn't let you easily run away with tens/hundreds of millions of dollars in the same way web3 projects do.

That said, I personally doubt this happens much if at all, because if you want to scam on web3 you can just do a good old-fashioned pump&dump and nobody seems to be receiving any legal/criminal consequences as of yet.

Destiner2• 4 years ago

"Never attribute to malice that which is adequately explained by stupidity"

rmbyrro9• 4 years ago

hundreds of millions of dollars that are not easily traced

If they keep it in blockchains only, it's hard to connect to a real identity. But if they cross the line (which is everybody's goal eventually) to the real world, they can get caught as easy or even easier than in traditional financial system.

chernevik• 4 years ago

This.

I don't how anyone would commit anything more than pocket change to a scheme where an insider could deliberately introduce a weakness and then exploit that weakness to walk off with all the funds committed.

rapsey• 4 years ago

Well done and congrats to the hackers. One step closer of ridding the world of web3 nonesense.

Kiro• 4 years ago

Web3 is all about these heists. That's what makes it fun and interesting. We're living the cyberpunk dream.

wollsmoth• 4 years ago

I do really enjoy reading about these heists and it does seem like a lot of fun.

dagw5• 4 years ago

No! We need more "web3 nonsense" like this. This is the closest the internet has felt to the cyberpunk dreams of the 90s. Outlaw Hackers exploiting bugs in automated smart contract to hijack cryptocurrency is the future Gibson promised us.

wishfish• 4 years ago

True, but it's funny how all these hijinks seemed so cool in the books. Jacking in while in a grimy Tokyo nightclub as your friend, the assassin with razorblades, watches your back. But in reality, it's just all so pathetic. Sometimes I feel like a cyberpunk fan in 1988 found a monkey's paw. Made a wish that it would all come true. And it did, but in a much more banal & sad way than the fan would have thought possible.

powerhour• 4 years ago

I don't remember Gibson but I wonder if we can get to the point that outlaw hackers limit damage to the wealthy and send "refunds" to the exploited. That would be worth celebrating.

rchaud5• 4 years ago

The numbers talked about in crypto exploits are in the hundreds of millions, if not billions. I would have thoughts the 'cyberpunks' chasing these would be completely outnumbered by state-backed information warfare groups.

shreyshnaccount7• 4 years ago

the real fun of "cyberpunk" is supposed to be open source hardware, modular phones, cyber decks, laptops with six folding displays, ipads with gpio pins and its not a step closer to reality. sad. :( instead we get this web3 nonsense. hate it.

radicaldreamer3• 4 years ago

People are losing their life savings and families are being set back a decade or more, but the aesthetic sure is cool!

qbasic_forever• 4 years ago

You do realize that much of the 'cyberpunk dream' science fiction of the 90's was actually harshly critical satire and dystopia of what the world would look like when technocrats and technology rule people, right? Like you realize William Gibson books and such aren't just cyberspace opera/Stars Wars in VR... it's showing the real suffering that was possible when you blindly trust technology to rule society. Gibson is honestly a bit of a luddite in his mistrust of technology.

jollybean3• 4 years ago

That's a great point actually.

So long as people aren't running around with too much bad money.

kyruzic• 4 years ago

That's like saying each train robbery during the settlement of the west was getting us one step closer to ending the settlement.

If anything these heists prove interest in web3 remains high.

colechristensen3• 4 years ago

This is about like saying the Hindenburg proved the popularity of zeppelins.

jxi2• 4 years ago

Bad news for you that web3 isn’t going away. That’s like wishing for REST to go away.

rmbyrro9• 4 years ago

If you don't like banks and someone robs a bank, do you celebrate the robber?

rideontime2• 4 years ago

Yes, I do.

dang2• 4 years ago

Please don't post flamebait to HN. It's not what this site is for, and it destroys what it is for.

https://news.ycombinator.com/newsguidelines.html

Edit: it should be obvious, but this moderation point has zero to do with how any of us feel about web3 or whatever.

choppaface• 4 years ago

Couldn’t you send this sort of message privately? The post gained a number of replies and the sentiment that “web3 is trash” is about as commmon today as “McKinsey is trash.” I would advocate HN send warnings in private as, respectfully, public warnings look like flamebait IMO to me.

latchkey13• 4 years ago

If developers could make a small mistake that caused this, imagine what could happen when The Merge goes through.

TacticalCoder• 4 years ago

If developers could make a small mistake that caused this, imagine what could happen when The Merge goes through.

I don't get your comment: Ethereum itself has worked without any issue since it came out, in 2015 (?) or so. Many smart contracts, not built by the core Ethereum devs, have been exploited, but from Ethereum's point of view everything worked flawlessly.

Why would the Ethereum devs, which have create a blockchain working perfectly fine since seven years (including many upgrades), suddenly screw up the merge to PoS badly?

I mean: I don't doubt we'll see many more hacks (and I don't know why so many people are so keen on putting so much money in smart contracts) but the people in charge of Ethereum itself seems to be quite competent and have a track records of several years without any exploit to prove it.

lesuorac• 4 years ago

Not just that but if somebody bad were to happen they can hardfork like they did in the past ...

https://en.wikipedia.org/wiki/The_DAO_(organization) https://en.wikipedia.org/wiki/Ethereum#Launch_and_the_DAO_ev... https://en.wikipedia.org/wiki/Ethereum_Classic

latchkey13• 4 years ago

ETH had the benefit of PoW working and proven for years prior to deployment.

Switching to an entirely new consensus model, that has never been done before, is complicated and a big reason why it has taken as long as it has.

Furthermore, there is a giant target (huge sum of money) on ETH's back now. If you had an exploit for PoS, why would you reveal it early?

As the person below also states... they could just fork and fix things, but this time, it will be a lot harder to do so without entirely destroying the value of ETH.

This is a massively risky venture that takes more than just hope and prayers. As we've seen in many many hacks over the last few years, even the most competent developers can miss something crucial.

tremarley• 4 years ago

Ethereum has had many bugs, mistakes and flaws.

Before 2018, Ethereum has a similar downtime to Solana

Ethereum is continuously developed to remove bugs.

For example: Until 2017, it was possible to sent a specifically signed transaction (without the correct private key) that resulted in the msg.sender having null sender address. This was fixed in EIP-86

676234e11718• 4 years ago

What you are describing is a protocol-level bug, rather than smart contract bug. The merge has already occurred successfully a number of times on test networks, so it seems unlikely at this point. But if a catastrophic failure were to occur on mainnet, clients would just revert or fork to a working state.

The reason you cannot just roll back a smart contract exploit like Nomad's is that it is very hard to build consensus across the entire protocol unless it is something that affects many users. The only time this happened was with the DAO which held something like 15% of all Ethers at the time, and so it affected the entire network. Compare this to Nomad which held something like 0.1% of Eth's total circulating supply.

latchkey13• 4 years ago

if a catastrophic failure were to occur on mainnet, clients would just revert or fork to a working state.

Except with PoS, it is different. People keep applying the PoW mentality of a fork to PoS and it just doesn't work that way. Jeff wrote a good blog post [1] on this a while back that took me a long time to come to terms with. It boils down to this paragraph:

  Proof-of-stake is inherently self-referential. It is possible to have two perfectly consistent, equally valid chains - perhaps with different stakers. Since “stake” is defined within a blockchain, it cannot be used to pick between two blockchains. Under the right kind of stress, the real, unwritten meta-consensus protocol that determines "which blockchain do we pay attention to?" will be revealed. Exactly what that is will depend on the nature of the fork.

This is untested on ETH PoS and could result in a significant loss in value for ETH holders. Not only that, but it gets even more complicated with stablecoins that are on ETH. What makes all of this quite interesting is the exchanges who get to decide which USDC on ETH they sell to you. Likely a big reason why exchanges, like Coinbase, are some of the largest ETH stakers.

[1] https://github.com/stickfigure/blog/wiki/Proof-Of-Stake-Wear...

bombcar2• 4 years ago

Apparently the coding mistake was identified and deemed "impossible to exploit": https://certificate.quantstamp.com/full/nomad

QSP-19 Proving With An Empty Leaf
Recommendation: Validate that the input of the function is not empty
The Nomad team responded that "We consider it to be effectively impossible to find the preimage of the empty leaf".
We believe the Nomad team has misunderstood the issue. It is not related to finding the pre-image of the empty bytes. Instead, it is about being able to prove that empty bytes are included in the tree (empty bytes are the default nodes of a sparse Merkle tree). Therefore, anyone can call the function with an empty leaf and update the status to be proven.

jxi2• 4 years ago

Quantstamp said it was exploitable. Nomad falsely claimed it wasn’t.

mhluongo3• 4 years ago

They're two distinct issues in two distinct contracts, AFAICT.

treis• 4 years ago

It seems like it was (at least arguably) impossible to exploit until they introduced a second issue:

It turns out that during a routine upgrade, the Nomad team initialized the trusted root to be 0x00. To be clear, using zero values as initialization values is a common practice. Unfortunately, in this case it had a tiny side effect of auto-proving every message

EDIT:

Reading and noodling I'm 99% sure these are separate issues. The vulnerability talks about passing in an empty leaf to the prove function. But that's not what the exploit is.

The exploit is using an unproven message. So they are passing in an actual leaf to prove. The problem is that unproven messages have 0x00 as root and some jabroni set 0x00 as the trusted root. So every message was treated as proven by default when it should be the opposite.

mouzogu• 4 years ago

routine upgrade

yes, a routine upgrade. that's what it was..... (→_→)

bombcar2• 4 years ago

Anyone who's studied NTSB reports knows this is almost always how they go; a single failure that is no problem becomes one because of some other issue that doesn't normally happen, or couldn't happen because normally a third thing is always done ...

klodolph3• 4 years ago

I'm not completely sure the mechanics of this exploit, but I've recently adopted the personal guideline of "all enums and integer IDs start at 1", and 0 is simply an invalid value.

Not a hard and fast rule, and not something that will catch tons of problems, but now and again it does help me catch an uninitialized value.

danielvf3• 4 years ago

I don't think this is the same issue as the exploit.

The real issue was half-caught in a review on a pull request however. https://github.com/nomad-xyz/monorepo/pull/289/files

If this legacy enum value had been handled later in the code, there would not have been a vulnerability.

(This isn't to say that the developers were bad. The person who wrote the code was extremely knowledgeable. It's just really hard to be perfect every time. )

bigcat12345678• 4 years ago

No, they are bad.

They are bad because they are not competent to write the decent code required by their profession and job environment.

In normal software writing trade, such engineers are called low performers and routinely managed out of any organization.

Sure, the mistake is not unusual from the perspective of general software engineering. But let's not forget what software they are working on.

I am totally fine with a bartender dropping a glass... I'll put a surgeon on trial if he cannot make his hands steady during a heart surgery...

drog• 4 years ago

That's common misinformation. The issue discussed in the review has no connection to what happened, and the narrative that it is the same issue, but it became exploitable after the update is incorrect too. It affects different part of smart-contract logic. Yes, it's pretty close at a glance—because you have zero-by-default problem somewhere close to Merkle tree.

apu• 4 years ago

lol. lmao.

NelsonMinar2• 4 years ago

One explanation is this wasn't a mistake at all, but rather a deliberate bug introduced to let someone steal all the money.

brabel• 4 years ago

With 150 million dollars in the line, that's actually highly plausible.

sva_• 4 years ago

I feel like they would have introduced a more sophisticated bug that is harder to find/exploit.

NaturalPhallacy5• 4 years ago

Completely agree, yet initializing a value to zero ain't no smoking gun.

rmbyrro9• 4 years ago

C'mon, haven't you seen the mistakes developers can do in real life?

This is plausibly a mistake.

FabHK2• 4 years ago

Yes, that's the beauty of it.

dcolkitt3• 4 years ago

Seems very unlikely. If it was a deliberate bug, the contract wouldn’t have been slowly drained over hours. The attacker would have known how to exploit well ahead of time, and had transactions/contracts/infra ready to grab the full $190 million inside one or two blocks.

NelsonMinar2• 4 years ago

As SomeCallMeTim says in another comment, the other withdrawals make great cover.

I have zero evidence for my "deliberate sabotage" theory. OTOH it seems entirely plausible and in line with the general scamminess of many cryptocurrency systems. OrangeMonkey's comment expounds better on the social and legal aspects that make deliberate fraud such an attractive possibility: https://news.ycombinator.com/item?id=32318939

ricardobeat• 4 years ago

Does this even qualify as 'hacking'? It's the equivalent of a bank having a public `GET http://bank.com/send?from=123&to=677&amount=200` endpoint.

Destiner2• 4 years ago

If that endpoint was made public by mistake, anyone using it might be held responsible.

rchaud5• 4 years ago

Kids used to call the act of editing Facebook posts via the element inspector and taking a screenshot "hacking". Considering the triviality of most web3 exploits, I think the descriptor still applies.

edm0nd2• 4 years ago

I'd say it falls under exploiting/bug bounty hunting so yeah it counts as hacking.

stillbourne• 4 years ago

But code is law therefore this is good for bitcoin.

cuteboy192• 4 years ago

No, if enough rich people are affected we can always roll back the blockchain, just ask etherium

Analemma_• 4 years ago

The funniest part of all these stories is the part where they announce that they've "notified law enforcement". Yeah, this space is all, "woohoo, we're free from the Man! Code is law!", until an exploit is found and then they have to call on the State to enforce that "no, no, we need the people with guns to undo this transaction because it's not what we meant." It's like a living demonstration of why libertarianism fails.

676234e11718• 4 years ago

This might be surprising, but not every crypto user is a pure libertarian, or believes that code is law. A significant amount of funds extracted from this exploit were from whitehat hackers who took the funds and plan to return them, to avoid them being taken by malicious actors.

cityzen• 4 years ago

There is an entertaining documentary series on HBO Max right now called The Anarchists which has the same types of scenarios. In fact in one scene a guy says, "we're anarchists, we can't call the cops!". It has some crossover with crypto as well.

ChicagoDave• 4 years ago

I’m still confused as to why web3 hasn’t come up with an “undo transaction” when shit like this happens.

yieldcrv3• 4 years ago

the areas being bridged to often do have an undo transaction and is a real threat to a heist, which is why people try to get funds across the bridge as fast as possible, or only exploit the other side of the bridge

Ekaros4• 4 years ago

The failure of these undo steps is that what if transactions downstream have already happened. Possibly with physical goods or real money. Unroll those too? And on whose cost?

shadowgovt• 4 years ago

Fundamentally, smart contracts as a technology are pretty doomed if their function requires the assumption of perfect code with no stop-gap when that assumption inevitably breaks.

We can't expect widespread public adoption of a system like that; even lay people are too familiar with how unreliable software is.

mw888• 4 years ago

I’m not holistically recommending the currencies they were designed alongside, but I fully believe that there is a right way to build smart contract languages, and that they look a lot more like Pact or Plutus than an EVM compilable dialect.

Both are functional, which means easier to read, and Pact is non-Turing complete and strictly typed, making it even easier, so much so that formal verification tools can assess what a contract is capable of automatically - a much smaller search space than EVM bytecode.

When code is not permanent and backing millions of dollars or more of value, the trade offs may favor more powerful or flexible languages, but the ability to read and understand code and what it can do it so wildly important for smart contracts that I don’t see a world where Pact isn’t moving the right direction contrary to the EVM.

gadders• 4 years ago

Who was it who described Eth etc as "self-funding bug bounties"?

efitz• 4 years ago

Reason #5734 why cryptocurrency is a non starter for real people.

Challenge: explain to a normie that their life savings is gone forever because of a zero initialization vector.

gillesjacobs2• 4 years ago

Challenge: explain to a normie that their life savings is gone forever because of mortgage backed derivatives.

happytoexplain2• 4 years ago

Bad analogy. This explanation has actually been done pretty reasonably by a few people. Further than that - after such explanations, it's clear even to normal people who's to blame, whereas software and cryptography are much more esoteric in that department.

Of course there is no justice in either case, but at least normal people can see who is most appropriate to behead in the case of the traditional financial catastrophes, in the purely theoretical revolution.

davewritescode• 4 years ago

What a dumb retort

If you got burned by mortgage backed derivatives and lost your life savings, it's ultimately because you were (knowingly or not) speculating on the value of real estate assets and making an assumption about future values of said assets.

In the case of Nomad, it's that you put yourself at risk by using their service you could've lost everything you put in.

TomVDB• 4 years ago

The first challenge is to find those normies.

Somebody who directly invested in MBS is by definition not a normie.

quickthrowman• 4 years ago

‘Normies’ didn’t lose all of their money selling credit default options and swaps on mortgage-backed bonds. They wouldn’t have access to the markets for those instruments or the capital to do so, and if they had access or capital, they weren’t a normie.

g8oz• 4 years ago

"The Big Short" did it pretty well.

scottiebarnes3• 4 years ago

Why are "normies" keeping their life savings on platforms whose express purpose and utility is cross network token swapping?

Vespasian4• 4 years ago

Because their loved ones, or peers or Facebook advertisement told them it's safe and a good way to stick it to the man.

Usually just depositing money in a bank doesn't get it stolen so the assumption isn't unreasonable.

Even if it's only 0.25*life saving that's still devastating for most people.

dcolkitt3• 4 years ago

They’re not. The vast majority of early liquidity in this and most DeFi protocols is raised from institutions, VCs, and trading firms.

This is especially the case for protocols like Nomad that don’t yet have a native token. They’ll get liquidity commitments through over-the-counter SAFT agreements that give the VCs a percent of the future tokens.

NaturalPhallacy5• 4 years ago

Challenge: explain to a normie that their life savings is gone forever because of a zero initialization vector.

You mistook a currency for an investment opportunity, and gambled your life savings on one thing. Currencies have always and will always fluctuate against each other. Diversify your investments.

onion2k• 4 years ago

I don't think that helps. Saying "5% of your money is gone because a developer fucked up, and you have no recourse." isn't going to go down well with anyone.

676234e11718• 4 years ago

It is important that users come to better understand the different risk profiles between:

1. Owning ETH with a non-custodial wallet.

2. Owning ETH on a CEX.

3. Depositing ETH into a smart contract to receive a wrapped asset. This includes rollups and L2s.

The majority of major crypto hacks[1] are in the 3rd group, and almost all of these hacks are related to protocol updates and governance. Either: the developers update their code, and accidentally push a bug, or one address or a group of addresses are allow-listed some privileged actions in the contract and that can become a weak point.

Proxying and governance isn't the only way to design contracts. Two examples counter to this that are more robust are WETH ($6B) [2] and ETH2 Deposit ($20B) [3] which cannot be attacked in this way. If users wanted a new feature from the WETH contract, they would have to manually migrate over to the new address. Eventually we might see this kind of design be applied to bridges and rollups.

[1] https://rekt.news/leaderboard/

[2] https://etherscan.io/address/0xc02aaa39b223fe8d0a0e5c4f27ead...

[3] https://etherscan.io/address/0x00000000219ab540356cbb839cbe0...

rchaud5• 4 years ago

How does this much money get 'lost' without heads rolling?

I understand that some of the deposits are from retail 'investors' who are poorly organized more interested in token appreciation or yield than the safety of their funds. But even getting to $150m would take forever if it came from individuals.

Surely there are large investors that provided the bulk of the capital. Shouldn't they intervene in some way? Or do these whales have so much to waste that they throw money into each of these projects knowing that they'll never see a cent back from 50% of them?

Dma54rhs• 4 years ago

Someone else here claimed they don't yet have a public token and it's all vc/institutional money.

paulpauper• 4 years ago

There must be thousands of people scanning contracts and defi protocols for any updates or changes and then trying to exploit it. A single exploit is equal to 1000s of years of income even at a regular tech job. This is happening every few weeks now it seems.

Fargoan• 4 years ago

I lost ~$400 worth of Nomad USDC in this attack AMA

edm0nd2• 4 years ago

Another ouch

Messages popping up in public Discord servers of random people grabbing $3K-$20K from the Nomad bridge - all one had to do was copy the first hacker's transaction and change the address, then hit send through Etherscan. In true crypto fashion - the first decentralized robbery.

https://twitter.com/FatManTerra/status/1554258880380772352

wnevets2• 4 years ago

Since "code is law" doesn't that mean it wasn't a robbery? They were just following the law.

adrr• 4 years ago

It will be interesting to see if they can prosecute people. They are called smart contracts and talked about being the actual contract.

Vespasian4• 4 years ago

Contracts (smart or not) cannot override the law.

I'm not a lawyer but I would be very surprised if courts in most countries would buy this argument.

Spelling or grammatical mistakes usually don't invalidate contracts in the real world and robbing a poorly secured vault is still illegal.

The thief was obviously trying to get other people's money without their consent.

TrapLord_Rhodo• 4 years ago

Nope - It's not a robbery.

The old mantra of possession is 9/10ths of the law is and always has been false. If i have something i own it. That is the one fundamental truth. Now someone can come and try and take it back from me by force (Person, Court System, Rebels, Corporations) if they can exert more violence on 'me' than i can exert on 'Them'.

The problem with crypto is the 'keys' are what crypto is. No nationstate can come and take that away from me. They can kill/imprison/fine me, but then neither of us will have it. You would have to hack/fork the chain for that to happen (Which has happened) or find some social way around it (If i have it on a centralized exchange, if i have a hackable hard drive, found my keys on AWS, etc etc.) Additionally, with things like Monero, and tornado swap good luck trying to find them.

rmbyrro9• 4 years ago

the first decentralized robbery

thanks for the loud laugh

chatmasta• 4 years ago

It looks like somebody had a bridge to sell them.

some_random• 4 years ago

the first decentralized robbery

This is the funniest thing I've read all day

cellis• 4 years ago

It wasn’t a robbery! It was engineers dutifully executing the smart contract according to its terms!

kwertyoowiyop• 4 years ago

DeFi meets DeRob.

mikeyouse2• 4 years ago

All these Web3 companies have a seriously difficult problem to solve -- you want to hire the best and brightest engineers to really lock-down your systems, but how would you prevent a core dev from 'accidentally' enabling some obscure attack and then going home that night and exploiting it? Hackers here are going to clear tens of millions of dollars.. an A++ rockstar engineer maybe makes $1M/year in total comp? How would you ever prevent insider attacks? How can you or the police tell the difference between a coding mistake and an intentional exploit?

latchkey13• 4 years ago

multisig. no different than any other large company. Even our finance department uses multiple real signatures to sign off on large invoices.

mikeyouse2• 4 years ago

As does ours - but they manually review things to give them a 'sense check'. That doesn't scale at all to the crypto world where the concept is permissionless and instant transfers. Said differently, how would you implement multisig in a setup like Nomad and prevent this type of attack?

Ekaros4• 4 years ago

So how come there was 150 million in this? Haven't the people "investing" done their due diligence and reviewed the code? Shouldn't that be the expected behaviour like we all do with transitive dependencies?

rmbyrro9• 4 years ago

They've exercised the same diligence as usual [1]

[1] https://en.wikipedia.org/wiki/Madoff_investment_scandal

yieldcrv3• 4 years ago

The contract was fine until an upgrade

Often times the market doesn’t like upgradeable contracts for this reason, ironically the misunderstood idea of smart contracts not being upgradeable is paraded as a bug

but its all situational

washbrain2• 4 years ago

Anyone who unironically believes "code is law" or "code is the contact" should be taking a hard look at this and realizing how terrible those ideas are.

shadycuz• 4 years ago

Really? Even with all the data showing how biased Human judges are?

At my day job, I automate everything because humans can't reliably perform basic tasks.

I'm not a believer in web3 or crypto but believe computers to be more impartial and would rather see them eventually take over certain aspects of legal work.

washbrain2• 4 years ago

Judges are there to provide judgement. It's literally in the name. Judges are deliberately put in positions to make nuanced decisions. Yes, bias exists, but the solution isn't dogmatic and inflexible application of law.

malkia2• 4 years ago

Apart from blockchain, nft, crypto, web3 - is Solidity, the language, worth exploring - can it be used (for fun) outside it's main purpose? Just curious...

danielvf3• 4 years ago

As someone who writes Solidity full time - it's probably not useful for anything outside its current use case.

The EVM, that it compiles to is a lot of fun though, if you like small understandable virtual machines. I like it a lot.

malkia2• 4 years ago

Thanks - I took a brief look, but as soon as I saw certain crypto/eth specific things into decided not to go further (at least for now). Personally I'm very skeptical of everything crypto, but with time it may get to some better goals. It's not the technology really that detracts me, but it's use.

doopy1• 4 years ago

It can be used for fun if you find EVM development fun.

rhacker• 4 years ago

What's Web3?

superjan• 4 years ago

Or Moonbeam? Replica? WBTC? acceptableRoot()? I don’t get any of this. If I get it correctly, Web3 would use crypto technology to let you buy a digital costume that get to wear both while playing fortnite and on Facebook when chilling online with your real friends, that is unless fb switches to building a tiktok clone because it is easier money than the “metaverse”.

civilized• 4 years ago

I know next to nothing about crypto, but I do know this is not the first time I've heard of a huge crypto hack involving security flaws in something called a "bridge".

People should look into those!

throitallaway• 4 years ago

Off topic, but I refuse to read stuff like this in tweet format. It's nice that threadreader exists, but this short format shit has to go.

what-imright• 4 years ago

Are you kidding me? They lost 150 million dollars and the only penalty is to write up the bug on twitter? These children are playing with peoples lives. There’s a body count to losing that much money

yieldcrv3• 4 years ago

People are often in a prisoner’s dilemma, where they are relying on the developers/team to spearhead the investigation including the judicial investigation against the perpetrators with the chance of their being a financial remedy

and so therefore nobody is trying to kill or impair the developers/team

if you were referring to people committing suicide or being suicided by the people they borrowed money from, thats not everyone’s problem and people in those circumstances should re-evaluate to avoid that risk or accept that risk

andrewia• 4 years ago

This is a really severe heist, but the latter part of your comment seems rather dramatic. Crypto is still generally not a medium of exchange, and most users are still speculative investors. Most of these investors have a hedge (or are using crypto as their hedge), except for the foolish.

sosodev• 4 years ago

Most perhaps, but stories of people committing suicide after every crypto crash are far too common...

fanf2• 4 years ago

But when someone wisely observes that crypto is useless for anything except scams, some cryptoenthusiast answers, but no, it is useful as a medium of exchange for people in third world countries with difficult foreign exchange restrictions.

perlgeek• 4 years ago

There a monetary value you can attach to a human's life, as much as that seems to be taboo.

Depending on how you measure, that value is (in the US and Europe) typically in the order of 1..5 Mio USD.

So it's not outrageous to assume that losing 150m comes with a body count, even if the funds wouldn't have bee used to directly save or improve lives otherwise.

cuteboy192• 4 years ago

Read the crypto subreddit. Most are fools

woah• 4 years ago

The reason this happened is that Nomad's contract was "upgradable". This is a pattern where the source code of a contract is able to be replaced by a privileged developer account. This was not how Ethereum was intended to work and it actually needs some pretty convoluted stuff to make it work (see the UpgradeBeacon related code here: https://etherscan.io/address/0x88a69b4e698a4b090df6cf5bd7b2d...)

The reason developers make their contracts "upgradable" is simple greed- they want to be able to launch more quickly than other projects without needing to ensure their code will stand the test of time. This may be OK for a social networking app MVP, but it's not OK for a smart contract which a user ideally should be able to audit and understand (or at least rely on the audit of someone else). "Upgradable" smart contracts can always be changed after the fact, as happened here, which means that any audit is meaningless.

Top tier projects still do use simple un-upgradable smart contracts. Uniswap first wrote v1, then improved it and launched v2, then v3. The Uniswap v1 and v2 contracts are still running and usable, and will be for as long as Ethereum is around. Their security properties will always be the same as they were the day they launched.

"Upgradable" contracts mean that you are trusting your money to some anonymous fat fingered (or at worst, criminal) dev, and it could disappear at any minute. They defeat the entire purpose of even using a blockchain.

artdigital• 4 years ago

Yes - but not having them upgradeable means that if your contract is dealing with a lot of money and a small bug was discovered, you are unable to patch it after the fact, even if people are actively abusing that bug

It’s not really about greed. Deploying a program and having it unchangeable forever comes with risks, and more often when dealing with very complex applications, those aren’t worth it

cypress662• 4 years ago

People should NEVER touch any upgradable contract. It is literally centralized, and defeats the whole purpose of DeFi.

Yes, writing perfect code is very hard. But smart contracts are an example of code that must be extremely thoroughly tested, formally verified and so on.

But that doesn't go well with being first to market, move fast break things, etc.

drcongo• 4 years ago

I don't understand why people writing smart contracts don't also write tests.

skeeter2020• 4 years ago

I'm not smart enough to follow all the jargon and references in this tweet stream, but then I also didn't loose $150M so we'll call it a wash.

ChrisMarshallNY• 4 years ago

I liked the visualization...

saurabh20n• 4 years ago

For the curious, here are direct links:

* Initialization was done 42 days ago: https://etherscan.io/tx/0x53fd92771d2084a9bf39a6477015ef53b7... -- "Click to see More" and notice "Input Data" parameter [2] which sets _committedRoot to 0x00.

* Click through the To contract to get to the code (click on Contract tab): https://etherscan.io/address/0xb92336759618f55bd0f8313bd8436...

Just adding direct links to what samczsun and 0xfoobar are talking about in https://twitter.com/samczsun/status/1554260106107179010 and https://twitter.com/0xfoobar/status/1554269071214088193/phot...

indigodaddy• 4 years ago

I know literally 0 about crypto so please communicate as if I were a 5th grader (actually they may perhaps be more knowledgeable than I).

Any chance for the exploiters to be prosecuted, or is it essentially all anonymous?

che_shirecat• 4 years ago

alot of the exploit wallets are doxxed, e.g. they have an initial deposit into wallet from a centralized crypto exchange like coinbase or FTX that investigators can request info from. its actually pretty hard to get a "clean" wallet, and even if you have one, mixing the crypto back out to fiat is tricky as well. what's worse, all transactions are permanently on the blockchain so if they don't catch you now they can always catch you later.

MBCook• 4 years ago

Trying to speculate my immediate question is: what court gets jurisdiction over this and why?

* The one where the investor lives?

* The alleged thief?

* The creators of the contract?

* Some 4th option?

tmpz22• 4 years ago

Everytime I see a story like this I wonder if the exploit was left intentionally for the founders and developers to exploit one way or another. Even if they themselves do not take the money it would be trivial to sell the exploit for some form of delayed (and more easy to launder) payment.

yuan43• 4 years ago

tl;dr a routine upgrade marked the zero hash as a valid root, which had the effect of allowing messages to be spoofed on Nomad. Attackers abused this to copy/paste transactions and quickly drained the bridge in a frenzied free-for-all

From this explainer:

It’s [Nomad is] built to address security first The Nomad team has been building secure bridges as a team for 4+ years and has studied the pitfalls of multi-sig and validator-based bridges.

https://medium.com/imperator-guide/nomad-a-cross-chain-inter...

Assuming this is true, and assuming the team is not incompetent or composed of the typical grifters, perhaps it's time to draw the inevitable conclusion. No amount of experience is sufficient to safeguard an Ethereum protocol of any interesting complexity.

It's a reasonable question to ask, WTF is Nomad for? After all, isn't Ethereum supposed to be the World Computer, Turing complete and ready for any task? Nope. Never was.

I think a good chunk of the answer can be found on the home page:

Nomad reduces gas fees by a factor of 10x relative to traditional header relay systems, while remaining decentralized.

https://www.nomad.xyz

That world computer is choked to the gills with accumulated waste. The proliferation of chains is the response. Each one is less secure than its forebear. Gobbledygook like Nomad is the "connective tissue" to get the various organs of this science project talking to each other.

Dive deeply enough down and you find the root of it all: everybody wants to make the next Bitcoin, Ethereum, Cardano, Polkadot, and so on. With each turn of the crank a new crop of Barnums springs up to take the money of an unending supply of digital rubes.

woojoo6662• 4 years ago

Im starting to get the feeling that security by obscurity is a good thing. There's a reason why banks don't open source their infra, or why Google/Facebook/Twitter don't open source their algorithms. No matter how smart your engineers are, they are going to make mistakes, and if the incentive is high enough then people will find and exploit those mistakes. It's honestly amazing that L1 blockchains (like bitcoin, ethereum, monero) have lasted this long at all

cypress662• 4 years ago

The difference isn't open vs closed source.

The difference is that banks can reverse stuff.

zxspectrum1982• 4 years ago

How can Nomad afford to lose $150M and go on like nothing happened? Same for other exchanges which have lost hundreds of millions. It seems really weird. Any real-world company which would lose $150M would have a lot of pressure on it, investigations, dismissals, etc.

philippz• 4 years ago

Pity to see. Nomad's team is a really strong one, and their cross-chain bridge design is one of the best out there.

Nomad drained of $150m due to a coding mistake

Related Stories