[HN Gopher] Beanstalk Farms stablecoin project loses $182M to ex...
___________________________________________________________________
Beanstalk Farms stablecoin project loses $182M to exploit
Author : _fizz_buzz_
Score : 84 points
Date : 2022-04-17 16:03 UTC (6 hours ago)
(HTM) web link (web3isgoinggreat.com)
(TXT) w3m dump (web3isgoinggreat.com)
| [deleted]
| nathanaldensr wrote:
| Just another day in cryptoland.
| elektor wrote:
| Another day, another collapse of a cryptocurrency.
| hesdeadjim wrote:
| You know it's bad when a loss this large isn't surprising or
| interesting in the slightest.
| Eddy_Viscosity2 wrote:
| A loss to some, but a huge win for the ones who took the
| money. The crypto evangelists should start promoting this
| aspect of the space: "It isn't really stealing if the code
| was bad!"
| sparksparkapach wrote:
| Should be the opposite, this is not even 1/10th of 1 percent
| of what's stored in defi. This shouldn't even be huge news. I
| don't even see any links to bug bounties on their site.
| stephencanon wrote:
| A $182M bug bounty was just claimed.
| himinlomax wrote:
| A loss of 0.1% of all the money NOT stored in crypto would
| be huge news.
| cinntaile wrote:
| This reminds me of the "If my grandma had wheels, she
| would be a bike." meme.
|
| Yes but that is irrelevant.
|
| It is unfortunate this happened of course, proper
| security audits of your smart contracts is very important
| in cases like these.
| cinntaile wrote:
| I should know better than to comment in crypto threads,
| the "discussions" are rarely interesting. Here's the
| meme, you'll understand why it's so fitting. There's
| probably a more proper name for this type of fallacy but
| I don't know it. https://youtu.be/A-RfHC91Ewc
| oliwarner wrote:
| It's news that a life-changing volume of cash can get
| hacked away from your wallet and just _vanish_.
|
| It's not better that there's actually a planet-changing
| volume elsewhere in similar jeopardy. We should be howling
| about the anti-features baked into these things that enable
| criminal enterprise.
| _fizz_buzz_ wrote:
| Ha, imagine 0.1% of all USD got stolen in one swoop.
| MR4D wrote:
| Interesting thought...
|
| Based on current US inflation rates, that's about 4 days
| worth of inflation. So, you could probably blame the Fed
| for "stealing" that much in one swoop.
| EL_Loco wrote:
| Maybe your money is pretty safe in your bank. My dad worked for
| 40+ years and paid every month his pension fund dues. When his
| company (a very big and old company in our country) went
| bankrupt, it was found that the pension fund was broke. They had
| been using money from the pension fund to cover whatever they had
| to cover due to corruption, bad administration, etc (it was
| illegally done so, by the way). Not only that, but the government
| knew about this, since it was a really, really big pension fund,
| and had stepped in as pension administrator for the past six or
| seven years. Didn't matter. The pension broke, the company broke,
| my dad and thousands of others were left without their retirement
| pay. This is not some outrageous story over here. It was so
| normal that it didn't make any headlines. Two years ago postal
| workers have started to take a pay cut to cover a hole in their
| pension fund. The mail here is state owned, by the way, and it
| didn't matter. The directors took their money, the workers had to
| pay up. I did my research, I wouldn't put money in Beanstalk
| Farms, or 99% of cryptocurrencies, but there are couple, two or
| three, crypto projects that I know are legitimate and secure, and
| I trust them more than the banks I have access to.
| verall wrote:
| There is an interesting false equivalence here between pension
| funds and banks. But it's a personal annecdote, so really it's
| up to you what made you lose faith in "the system".
| EL_Loco wrote:
| I know they're not equivalent. But banks have broken here
| too, and people lost a lot of their money. By the way, credit
| card interest here is over 300% annually. Can get up to 800
| depending on the bank.
| matheusmoreira wrote:
| In the 90s my country was plagued by out of control inflation.
| In a desperate attempt to control it, the government just froze
| everybody's bank accounts. Nearly everyone was left without
| money. Imagine logging into the bank and discovering that all
| your money had been confiscated. Some people saw it coming and
| cashed out beforehand, and suddenly became wealthy after
| everyone else's money was wiped out.
|
| I don't trust governments and I don't trust banks. I want an
| economy that's completely independent of them.
| emerged wrote:
| What's hilarious is to take your side, you have to imagine
| somebody saving into crypto for 40+ years and then cashing out.
| The odds of any crypto lasting that long, and that money having
| even remotely a predictable long term value, is pretty plainly
| absurd.
| louwrentius wrote:
| After thirteen years this is what crypto gives us. A few people
| get rich at the cost of all the rest. From coins getting
| hacked/stolen to ransomware, to just cryto-gambling.
|
| But there is something positive to say about crypto too.
|
| The failings of crypto teach a lot of people about how and why
| societies work the way they do. And that no amount of tech can
| ever replace our institutions and human trust.
|
| I'm 100% with Stephen Diehl on this one: the entire 100% of
| crypto needs to be burned down to the ground. It needs to go
| because of the enormous harm it does to people and our larger
| society, for no gains at all.
| rich_sasha wrote:
| I'm no crypto maximalist, and would struggle to argue against
| the position that crypto today is pretty much all scams,
| pump&dumps and pixie dust selling.
|
| To me it's a shame though, crypto _as a concept_ is very
| interesting in many ways. Algorithmic money, defined by
| serverless programs, not COBOL behemoths. Massively
| distributed, yet consistent mutable database. A space where you
| can bootstrap an idea on a shoestring budget. A bit like
| internet vs cable TV and trad banks.
|
| Except in this analogy, the "crypto" internet seems to have
| gone straight from Arpanet to nothing but ads, child porn, dark
| net and gambling, skipping past Wikipedia, Google, dotcoms
| (when they were plucky upstarts not to vil conglomerates).
| Shame.
| louwrentius wrote:
| > crypto as a concept is very interesting in many ways.
|
| The examples you give mean nothing to me. What real problem
| is being solved by any of your examples of 'interesting'?
|
| We already have something that allows you to bootstrap an
| idea on a shoestring budget: the cloud.
| tonguez wrote:
| "100% of crypto needs to be burned down to the ground. It needs
| to go because of the enormous harm it does to people and our
| larger society, for no gains at all."
|
| well you've convinced me
| JacKTrocinskI wrote:
| Every investment has risks, stocks are not that different from
| crypto in that regard.
|
| Regulation, once it comes, will help better protect retail
| investors.
|
| Crypto is still in the early stages, the technology is
| revolutionary though and I think it's here to stay.
| 1270018080 wrote:
| There is truly nothing revolutionary about an extremely
| inefficient write once read many linked list.
| josu wrote:
| >After forty years this is what the internet gives us. A few
| people get rich at the cost of all the rest.
|
| Sure, if you want to focus on the negative you can focus on the
| negative.
| [deleted]
| onion2k wrote:
| I wonder if this will turn out to be North Korea as well.
| charcircuit wrote:
| This tweet thread explains what happened:
| https://twitter.com/FrankResearcher/status/15156938958872944...
|
| The key step was: "Further, they deployed and voted for a fake
| BIP-18 that moved all funds from the protocol contract to the
| exploiter."
| the_mitsuhiko wrote:
| Lovely that loan providers legally? benefit from criminals in
| the crypto world.
| charcircuit wrote:
| So do the people in the liquidity pools, so do the miners,
| and probably a few more groups of people.
| josu wrote:
| What does "fake" mean in this context? Malicious? Or that the
| attacker made it look like a BIP so it would get executed? Or
| something completely unrelated?
|
| EDIT: More context here
| https://twitter.com/peckshield/status/1515692144190648322/ph...
| charcircuit wrote:
| My guess is that it just means it isn't from
| https://github.com/BeanstalkFarms/Beanstalk/tree/master/bips
| [deleted]
| x86_64Ubuntu wrote:
| >...However, they were later slightly more optimistic, writing,
| "it may also be the start of something good... there may be a
| path forward. We don't want to comment on next steps until that
| path is at least visible to us"
|
| How on earth can people just shake off a loss of $182MM? And is
| this one of those contracts? Have the courts ruled that code is
| law, and that a poorly implemented and exploitable contract is
| legal? There is so much wrong with this.
| JacKTrocinskI wrote:
| The same way Wallstreet does.
| [deleted]
| optimalsolver wrote:
| Exploit, or exit scam?
| px43 wrote:
| The fact that this dude literally sold millions of dollars of
| magic beans, which made the beanstalk, which suddenly
| disappeared, has got to be at least a little suspicious.
|
| It was a super basic flash loan oracle manipulation, which
| could have been done by anyone, so it probably was just another
| Waterloo kid finding their fortune, but really, who are these
| people who dumped millions of dollars into magic beans?
| MisterSandman wrote:
| As someone from Waterloo, this is a very weird reputation our
| university is getting.
| smrtinsert wrote:
| Great site. Bookmarking
| ohmanjjj wrote:
| Another "hack"
| formvoltron wrote:
| "exploit"
| grumpymouse wrote:
| It would be interesting to create a cryptocurrency where
| transactions take an additional time to settle based on amount
| from the time the transaction is requested.
|
| $20k? No delay other than getting the transaction through the
| mining pools or whatever. $500k? Maybe an hour to settle. $1m+?
| That's going to take a day (in which time big red warning lights
| can flash on your defi project wall boards).
| Georgelemental wrote:
| Instead of one large transaction, l33t haxx0r can just make
| plenty of small ones
| nscalf wrote:
| That can be solved by adding a delay for each subsequent
| transaction from a wallet. Solana has been considering this
| to solve some spam issues. t+(n*cooldown period), or
| something
| js4ever wrote:
| The more I read news about crypto the more I believe they
| delivered none of the promises (high transaction fees, slow,
| burning a lot of resources for nearly nothing) and bringing more
| problems
| bombingwinger wrote:
| Well they got big money to buy in. Sure Ethereum-based DeFi
| projects are scams, but the so-called blue chip currencies will
| probably stick around. Ultimately, the traceability of crypto
| is its unique selling proposition.
| matheusmoreira wrote:
| Monero is the closest to the original cryptocurrency dream.
| Enforced privacy, low transaction fees, fast transactions,
| mining viable on commodity hardware. I've gotten paid via XMR,
| it works great.
|
| Too bad nobody seems to care much about it because the numbers
| don't go up.
| criddell wrote:
| Does it beat Visa on transaction speed and fees?
| charcircuit wrote:
| Visa can take a few days to settle where with Monero you
| will typically want to wait for 10 confirmations which
| takes 20 minutes.
|
| Visa's fees are 1.4%-2.5% for the merchant where Monero's
| median fee over the last 100 transactions was $0.002.
| djbusby wrote:
| I've used XLM for some payments before. Fast, cheap to send.
| Sitting below $1 USD maybe keeps it out of the hype zone.
| gizajob wrote:
| Unstablecoin
| nullc wrote:
| The great ethereum meta-scam is continuing to perform exactly as
| designed.
___________________________________________________________________
(page generated 2022-04-17 23:02 UTC)