Skip to content

Latest commit

 

History

History
99 lines (92 loc) · 3.86 KB

2022-11-22-episode-51.md

File metadata and controls

99 lines (92 loc) · 3.86 KB
posted guid title subtitle description time itunes-explicit itunes-episode itunes-episodeType youtube-full discussion timeline enclosure-url enclosure-length enclosure-type itunes-duration badges
true
5ED3782C-BA50-4F22-A3A7-6F42AC332DDC
The Heist
A thrilling episode on the OlympusDAO hack and the two options for hacking in web3. Discover the pros and cons of white hat hacking and the new responsible disclosure in the world of cryptocurrencies.
2022-12-20 18:00:00 -0500
false
51
full
seconds title
0
Intro
seconds title
42
OlympusDAO hack
seconds title
97
Two options for hacking
seconds title
149
If you hack then you decide whether to return
seconds title
187
Should you "responsibly disclose"?
seconds title
925
Etherscan needs better source code view
seconds title
962
I support Tor
seconds title
1023
Tracing shell games of stolen tokens
25968415
audio/x-m4a
1211
type participant
stayed-to-end
fulldecent
type participant
stayed-to-end
dtedesco1
type participant
stayed-to-end
t012n4d0
type participant
stayed-to-end
rito_rhymes
type participant
stayed-to-end
cryptonerdylady
type participant
stayed-to-end
streetphoto_eth
type participant
stayed-to-end
merwyx
type participant
stayed-to-end
yodude38
  • On October 21, 2022 OlympusDAO lost and later recovered $292K due to an insufficient function parameter validation flaw.
    • Hack review
      • Set up another contract first
      • Exploit only used the transfer function
      • Looked up the transfer in Etherscan
      • Attack breakdown – bondexpiry contract has permission against
        • First call robot
        • Robot Look up balance
        • Redeem something against bondexpirycontract
        • Bondexpiry calls back to expire()
        • burn() (which seems to be ignored)
          • Function requires caller to be ‘teller’ – we ran out of time and didn’t figure out how robot got teller status
        • Bondexpiry called underlying(), asked robot
        • Robot lies about underlying
        • Bond contract then performs transfer for the balance amount
      • Should not have trusted bond contract
      • Should not let underlying() be updated–it should be set at the beginning
    • = "function is broken bad, anything can happen"
    • Options: don't hack, hack and get ALL the money; non-option: hack and get some of the money
      • If you don’t, someone else will finish the job right away (everything you do on-chain is public)
      • White hat – take the money and then you have the option to give it all back
        • What difference does intentionality make? How do governments address it when someone claims they are white hats?
        • It might not be obvious where to return the money
      • No hat – If you just tell the org, maybe they will just use the exploit for their own gain
      • “Taking all the money is the only way to prevent anyone (else) from taking all the money”
      • "Taking the money is the new responsible disclosure in web3"
    • Epic heist tips (even for white hats)
      • Don’t use home computer or wifi
      • Can’t go unTOR-ed or un-VPNed even once
      • Worry about MTG-like “fizzles”
      • Upleveled OpSec is required (i.e. always using yarn in docker)
      • “This isn’t being paranoid [pause] that’s what a paranoid person would say.”
      • Anonymity buys time
  • https://bitcoinmagazine.com/culture/if-you-love-bitcoin-you-should-help-tor