Hacker News new | ask | show | jobs
by postcynical 1329 days ago
Bitcoin. Ethereum. Etc.

They don't go down if you turn off your Raspberry Pi.

I also can be 99.9999% sure that they run correctly and Ethereum itself is pretty unhackable, as proven by the multi-billion bug-bounties.

The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable, i'm sure no malicious person/business can hack or change it, and if they do it has an auditable backlog.

4 comments

> Bitcoin. Ethereum. Etc.

This is tech. Not its applications.

> The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable,

Ah, to once again have a child's wonder and belief in magic. Just add th incantation "blockchain ethereum smart contracts", and all is right with the world.

Meanwhile reality [1] just in the past ten days:

--- start quote ---

Insufficient validation on an OHM smart contract at Bond Protocol allowed an attacker to drain 30,437 OHM (~$300,000) from the Olympus DAO defi protocol.

Olympus DAO wrote in an announcement that "This bug was not found by 3 auditors, nor by our internal code review, nor reported via our Immunefi bug bounty."

---

On October 14, Ethereum reached a milestone that alarms many who have pushed for blockchains as "censorship-proof" technology. More than 51% of blocks produced in the preceding 24 hours were processed by relays that filtered out transactions involving Tornado Cash

---

The defi project Earning.Farm lost 748 ETH (~$971,000) to a hacker using a flash loan attack. The project contract was missing a check that a flash loan was initiated by the protocol, so the attacker was able to instruct the project to withdraw large amounts of funds

---

Rabby Swap, a feature of the Rabby crypto wallet, was exploited a month after it was first rolled out. An attacker discovered an apparent vulnerability in the Rabby Swap smart contract that enabled them to arbitrarily transfer other users' funds.

--- end quote ---

[1] https://web3isgoinggreat.com/

> The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable, i'm sure no malicious person/business can hack or change it

And equally sure that any bug in there (and there will be bugs in there) is unfixable and any funds stolen through it unretrievable.

"smart contracts" are neither.

> i'm sure no malicious person/business can hack or change it

Words that precede every DeFi hack with a ridiculous nominal dollar value.

Wrong conclusion. The hacks never targeted the underlying platforms and security. It was always the bugs on the smart contract level. The same way you can't blame Java/Ruby/Python being insecure because of SQL injection attacks.
What useful thing do those smart contracts achieve in practice? The only place they have authority over is their respective blockchain. They are powerless in the real world, always relying on some centralized entity to sync real-world state with blockchain state, but doing so inherently throws away all the benefits of running on a blockchain, so you may as well just let the centralized entity run a good old database and call it a day.