How all the TOP TIER apes were stolen: 1. get ape enthusiast to install your NFTTrader app. 2. lol. (threadreaderapp.com)
from dgerard@awful.systems to buttcoin@awful.systems on 20 Dec 2023 02:09
https://awful.systems/post/710128

#buttcoin

threaded - newest

AcausalRobotGod@awful.systems on 20 Dec 2023 03:37 next collapse

Code is law.

sc_griffith@awful.systems on 20 Dec 2023 19:45 collapse

code is lol

self@awful.systems on 20 Dec 2023 04:29 next collapse

(TLDR; combination of reentrancy + old approvals that were never removed)

smart contracts are a genius-level invention! with the exact same security and threading model as a 90s PHP site, where every built-in function you can call has a laundry list of potential security issues, and fastening a new language and type system to the same broken API appears to provably be doing nothing to the combinatorial explosion of possible security issues

because none of this was ever about computer science; it was all always just affinity fraud targeted towards mediocre nerds

Architeuthis@awful.systems on 20 Dec 2023 07:56 next collapse

The best part is that because of blockchain immutability fixing a buggy contract is simply not a thing, you need to deploy a new one, as well as replace any other contracts that refer to the original since they are now compromised as well, all the while paying for gas fees out the ass.

And also as far as I can tell you can’t actually stop your users/exploiters from using the broken contract, you can only try to politely tell them not to.

dgerard@awful.systems on 20 Dec 2023 11:51 next collapse

all implemented as fucking database triggers, a thing you only know what it is from poor life choices

Soyweiser@awful.systems on 20 Dec 2023 17:44 next collapse

Is that? Googles Oh

bitofhope@awful.systems on 20 Dec 2023 18:07 next collapse

Triggers, the exact thing you want more of when already working with footguns.

self@awful.systems on 20 Dec 2023 19:00 collapse

also urgent client calls because the database they rely on for literally every part of their business is slow and unreliable “for no reason” and you pop open the database and see the sheer volume of PL/SQL and immediately double your hourly rate

it’s worth noting that SQL as a language is basically an embedded COBOL data definition DSL. somehow it’s always arbitrary COBOL with financial programmers

dgerard@awful.systems on 20 Dec 2023 19:04 collapse

i learned PL/SQL thirty years ago. thankfully i have forgotten every trace.

self@awful.systems on 20 Dec 2023 19:12 collapse

the last thing I did in college was learn COBOL as a joke, and I’ve been hiding it from my employers ever since

dgerard@awful.systems on 20 Dec 2023 19:25 collapse

I learnt COBOL in the same august institution I learnt PL/SQL

given y2k pay rates i almost wish i’d kept it up a bit longer

jonhendry@awful.systems on 20 Dec 2023 18:32 next collapse

I’m glad I’ve never been a good enough programmer to believe I was a genius programmer.

self@awful.systems on 20 Dec 2023 19:25 collapse

destroy imposter syndrome by realizing that there is no original

68x@lemmy.world on 23 Dec 2023 15:17 collapse

But code is law. /s

bitofhope@awful.systems on 20 Dec 2023 07:26 collapse

Someone needs to add a community note that the hack did not in fact result in “millions of dollars worth of NFTs stolen”. It resulted in zero dollars worth of NFTs being legitimately transferred to another holder as specified in the smart contract approved by parties involved.