Hacker News Reader

Comment by crypt1d | Hacker News Reader

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

View on HN

Auditors have never fully prevented bugs in any other computing domain, i dont know why cryptocurrency would be any different.

Can't the same be said that auditors have never fully prevented fraud in the real-world?

The real world has ways to reverse fraudulent actions. Crypto does not.

Sure i guess, but im not sure i see what point you're trying to make. Nobody is claiming that auditors will prevent all financial fraud.

It’s very hard to take this claim seriously in this thread, which details a huge (and somewhat obvious) security vulnerability in a currency worth at least $600m (an amount anyone would assume is “first-tier”).

Yeah I can understand that. Once you dive into crypto however, you quickly realize that $600m is just not that much money (especially not if we are talking about digital assets valued at current ticker price). And that lots of money isn't necessarily the right measure of quality of the project.

Lol, even 1% of $600M is $6M. That's a lot of money. You'd have to have garbage liquidity to only get back 1%.

It’s valued at 600 million that does not mean it can be liquidated for 600 million.

That is literally what that means. Market caps are what they are because everyone who thinks it is worth less has sold and everyone who thinks it’s worth that or more will buy. There’s some outliers but in general these coins are trading their entire market cap over the course of maybe a month or less. Liquid generally means short term, if you can sell it for cash in under a year then it is liquid. Sure if you tried to sell all coin today in the same minute you won’t find a buyer but over a month this happens all the time.

I had never heard of this bridge before the attack. The fact that a project manages to attract half a billion in capital unfortunately doesn't say all that much, since so much capital is flowing in so fast to every project with a pulse.

And the bug wasn't really obvious, although the lack of input sanitation is something an auditor (given enough time) would probably point out.

As this space evolves, I think there will be insurance and basic best practice safety measures. Also considering that almost all blockchains are open by design, it's no trivial task to liquidate a large sum of stolen tokens. So its not exactly a straight path from writing a script at Starbucks to making hundreds of millions of dollars.

I agree. There are already some insurance protocols in place - see Cover Protocol or Unslashed Finance. Its still very early in this space, but things are definitely developing!

There already are a number of insurance options.

Do you have some sources for this claim? Or just a belief?

High quality protocols like PoolTogether for example have this: https://docs.pooltogether.com/security/audits-and-testing

Most people have never heard of PoolTogether, so I’m not sure if your definition of “first tier” and “high quality” is objective.

Regardless, this quote from your link stands out: “it should never be expected that 100% of the deployed code has been formally audited.”

It has $175 M locked in the protocol, it is also featured on https://ethereum.org/en/dapps/, and is one of the oldest DeFI projects. By my definition, it is both "first tier" and "high quality". We can of course have the philosophical debate of objectivity and if such thing even exists, not sure if it's needed here though.

The audits of this protocol is also continuous.

175M$ is like 1/4th of the hack that this thread is discussing.

Also, they specifically state that not everything is audited? Nowhere do they mention continuous audits.

You are right, it's not mentioned, but they do in fact spend hundreds of thousands every few months for audits. You'll find more info here: https://gov.pooltogether.com/

Here are some examples I'm aware of, I haven't personally verified these.

Uniswap: https://uniswap.org/audit.html

Sushi Swap: https://github.com/peckshield/publications/blob/master/audit...

Alpaca Finance (high complexity in my opinion): https://docs.alpacafinance.org/transparency

A lot of projects provide their source and you can verify that what you're interacting with matches the source.

Not sure what you mean by source, but its fairly easy to find out if any official audits were done as this is always announced and documented by the involved parties (for example, I couldn't find any detailed audit info for Poly). It's not like the audit is mandated by law, its initiated by the SC owners to put the investors at ease. A lot of companies like Certik, Consensys, ZK Labs, etc. provide auditing services for this purpose explicitly.

Reply on news.ycombinator.com