[HN Gopher] OpenSea administrators can take any tokens minted on...
___________________________________________________________________
OpenSea administrators can take any tokens minted on OpenSea Shared
Storefront
Author : fulldecent2
Score : 116 points
Date : 2022-11-07 16:18 UTC (6 hours ago)
(HTM) web link (blog.phor.net)
(TXT) w3m dump (blog.phor.net)
| kuratkull wrote:
| I have been keeping tabs on digital currency/NFT news just out of
| sheer malicious curiosity. The "positive" news mostly seem to be
| "company X is trying out NFTs!". The high profiles cases don't
| seem to end up with a usable product or are outright cancelled Y
| months later with the whole thing labeledd as an "experiment".
| The negative news on the other-hand are pretty scarring - insane
| amounts of theft, bankruptcies, price drops, dead-end ideas,
| echo-chambers. I hope this keeps up.
| CaptainZapp wrote:
| In a way it's like watching a freight train, loaded with
| nitroglycerin, running downhill with all breaks failing.
|
| You know that you shouldn't watch, but you just can't help it.
|
| The sad thing is that a lot of people will get burned by this.
| ok_dad wrote:
| The train blew up a while ago and we're now watching the
| ruins smoldering until they eventually go out and we can go
| in and clean up.
| CaptainZapp wrote:
| Damn! And I thought that I have a great metaphor going
| here.
|
| But yours is more on point, I dare say.
| hypertele-Xii wrote:
| https://en.wikipedia.org/wiki/Unstoppable_(2010_film)
| adynaton wrote:
| Great movie. RIP Tony Scott.
| onlyrealcuzzo wrote:
| Sales volume dropped from >$150M per day in the beginning of
| the year to ~$8M today (and the trend is still going down).
|
| Keeping in mind this is an established market now (5+ years
| old) - and that the vast majority of sales are known to be wash
| trades - this is a small, extremely insignificant market.
|
| Magic the Gathering, at this point, is substantially larger
| than the non-wash trade NFT market.
| mjr00 wrote:
| My barometer for this stuff is the UFC, which is the perfect
| platform to market to this crowd. They're already very loudly
| sponsored by vechain and crypto.com, plus a ton of crypto
| gambling sites that have come and gone.
|
| Last year there was an NFT advertisement every 10 minutes
| during UFC broadcasts, telling you to pick up the latest UFC
| NFT packs. For the past 6 months I haven't heard the
| announcers mention NFTs a single time.
|
| If you can't even market this stuff to the UFC crowd, it's
| completely dead.
| glofish wrote:
| I find it really weird that they had to decompile the smart
| contract.
|
| That surprised, me I thought the whole point of these smart
| contracts were that everyone could see them like the transactions
| that take place.
| Karliss wrote:
| Seeing the contract doesn't mean it's in easy to read format.
| Any software of sufficient size becomes something which you
| need to put in effort to analyze even if you have source code.
| And that's ignoring possibility of obfuscation. The stuff that
| uploaded to Etherium blockchain and executed is bytecode for
| Etherium virtual machine. Which makes sense, because it's much
| easier to precisely define semantics and ensure that multiple
| different implementations behave exactly the same for a small
| vm than it is for higher level programming languages.
|
| Some websites like etherscan show the the source code with the
| version of compiler which was used to compile it. I assume that
| it works by author of contract uploading original source to the
| website as gesture that there is nothing to hide. But not every
| author does that. Assuming a reproducible build the website and
| anyone else who wants can then verify that it's the original
| (ore equivalent to original) source code by compiling it with
| specified compiler version. If the compiled output matches with
| what's on blockchain, it's then relatively safe to assume it's
| the original source code and analyze that instead of
| decompiling bytecode.There is still a chance that clever person
| hid a backdoor by exploiting a bug or quirk of compiler, making
| it harder to find unless you reverse engineer compiled bytecode
| or aware of specific bug in that version of compiler.
| drtz wrote:
| This is the result of optimizing for storage constraints.
| Storage is expensive on the ETH blockchain, so compiled
| bytecode is sent to the blockchain instead of raw source.
| drtz wrote:
| There has been a move toward centralization in the NFT space with
| Opensea and Magiceden marketplaces completely dominating the
| space, largely to the detriment of projects and / or users. One
| recent example: project royalties are now optional, so projects
| relying on these royalties from sales have had the rug pulled out
| from under them.
|
| I expect we'll start to see some backlash where major new NFT
| projects build more safeguards into their contracts to try and
| reel back in some of the control the marketplaces have gained.
| AlexandrB wrote:
| The way NFT royalties were marketed was always highly
| misleading IMHO. A lot of the news articles made it sound like
| royalties were a property of NFTs themselves via some kind of
| smart contract. But it is in fact a feature of some NFT
| _exchanges_ and you always had the option of trading the NFT
| via other means if you wanted to avoid the royalty payment. So
| royalties were _always_ optional. The marketing just made it
| sound like they were not[1].
|
| Given this, it must be asked how NFTs are in any way different
| from the traditional art markets for the artists themselves.
|
| [1] https://techcrunch.com/2022/11/02/whats-going-on-with-nft-
| ro...
| RcouF1uZ4gsC wrote:
| I guess a back door does qualify as "Open".
| MichaelCollins wrote:
| With some legacy exceptions, anything called "Open[Something]"
| is a farce.
| zomglings wrote:
| This is a bad title on the HN submission. I suspect the title is
| intentionally designed to capture people's attention and mislead
| them. The article title is much better: _Does OpenSea Shared
| Storefront have a backdoor?_
|
| The submission title does not specify _who_ can take anybody 's
| tokens. Anyone who reads the article can see that the author
| claims that Open Sea _administrators_ can seize anybody 's
| tokens, and questions whether it is legal for them to retain this
| ability. This is much more of a nuanced situation than "omg open
| sea has a backdoor all your nfts are belong to us". The author
| also says that they will write more about this in a follow-up
| post.
|
| I believe the author is correct. This is behaviour pertinent to
| Open Sea's ERC1155 contract (called the Open Sea Shared
| Storefront), and not their marketplace as a whole.
| cmeacham98 wrote:
| I'm not sure if it's intentional, but the title is written in
| such as way that it is very easy to misparse as something like
| "Backdoor in OpenSea allows anybody to take tokens..."
|
| That actually is how I first read it. Not saying that doesn't
| make this a bad thing, but the HN title should really be
| reverted to the article title.
| throwaw20221107 wrote:
| This title rewrite is really bad. One interpretation of it is
| basically slandering opensea. I suspect OP (the person who
| decided to make up a title instead of using the article
| title) is not a native English speaker, and there are two
| ways to interpret their title and intentions:
|
| 1. they meant it as a question " _does_ backdoor in opensea
| allow to take anyone 's tokens?".
|
| 2. they meant it as a statement "backdoor in opensea allows
| _you_ to take anyone 's tokens"
|
| Obviously #2 is a lot worse. Hopefully they just forgot the
| question mark and weren't intentionally being malicious.
| codetrotter wrote:
| The original title is bad as well, because it is clickbaity.
|
| Best title for submission would be: OpenSea administrators can
| take any tokens minted on the OpenSea Shared Storefront
| dang wrote:
| Ok, done. (Submitted title was "Backdoor in OpenSea allows to
| take anybody's tokens".) Thanks!
| PestoDiRucola wrote:
| nithayakumar wrote:
| No but even if true, being stupid doesn't mean they should get
| scammed
| gerikson wrote:
| Actual title: "Does OpenSea Shared Storefront have a backdoor?"
|
| Please don't spread FUD.
| Herbstluft wrote:
| Please read things before you accuse.
|
| To quote the beginning of the post:
|
| _This project demonstrates how OpenSea administrators can take
| any tokens minted on the OpenSea Shared Storefront. This is a
| previously-undocumented backdoor._
| mirashii wrote:
| I agree that the title is editorialized, but calling it FUD
| seems a bit dismissive. From the intro to the article:
|
| >This project demonstrates how OpenSea administrators can take
| any tokens minted on the OpenSea Shared Storefront. This is a
| previously-undocumented backdoor.
| dwohnitmok wrote:
| Fun violation of Betteridge's law.
| sroussey wrote:
| Well, immediately after they say yes, so it actually seems a
| little (not much) less clickbait.
| rank0 wrote:
| Did you read the article?
| chrisco255 wrote:
| The Shared Storefront is OpenSea's proprietary NFT contract that
| artists can use to create for free on. OpenSea will allow you to
| create NFTs for free using their centralized servers as a
| temporary backend and they only get minted on-chain if they sell.
| It's understood that the Shared Storefront is controlled by
| OpenSea. While it's a nice feature for beginner artists it is
| also frequently abused by scams and copyright violators and
| unoriginal dupes. High quality NFTs issue their own contracts and
| open source the code.
|
| I think they should open source the code for the contract and be
| transparent about it, but it's not surprising they maintain
| control over it.
| nradov wrote:
| K0balt wrote:
| The only thing I've seen attempting to give legitimacy to
| tokenization is the pruf protocol.
| Kiro wrote:
| Why is low-effort bait like this being upvoted? Do people
| seriously want to have another off-topic flame war? It's like
| people are compelled to upvote generic sarcasm. Extremely
| disappointing.
| jrm4 wrote:
| I get that it's simple, but at this stage, it's hard for me
| to suggest that it isn't true? It strikes me as presently
| generally accurate.
| davidcbc wrote:
| Because it is accurate
| Kiro wrote:
| I agree but it's noise and has nothing to do with the
| topic. Why do you want to encourage that instead of
| actually discussing the article?
|
| I was glad to see it flagged and dead after my comment,
| but then someone even vouched for it. Like it's such an
| important comment that it needs to be heard. Even the
| premise is questionable (does quality presuppose it is
| moral?) but it's obvious what the parent means and
| commenting on it is just bait.
| sdiacom wrote:
| The article is about the low-quality implementation of
| platforms selling NFTs. I don't see how discussing the
| lack of quality of NFTs themselves, the "product" they
| sell, falls too far off the tree.
| Kiro wrote:
| That's a really far-fetched and generous interpretation.
| The comment is obviously just sarcastic NFT bashing,
| picking up on the lowest denominator in the parent
| comment and not talking about the platform or article at
| all. Come on, we can do better. Instigating another
| generic NFT flame war is pointless and off-topic.
| throwaway98797 wrote:
| luddit3 wrote:
| Who hasn't been hurt if you invested in NFTs in the past
| year.
| throwaway98797 wrote:
| adults made adult decisions
|
| most lost money, some did not
|
| i don't see anyone complaining about the millions of
| people losing their paychecks to state lotteries
|
| and i think that's cool, they are adults. decisions have
| consequences.
|
| so to op, grow up and take responsibility for your
| actions.
| AlexandrB wrote:
| Does this also apply to some of the founders like Do Kwon
| or do they get an exception because they're rich?
| smegsicle wrote:
| this is a grudge he still holds after overpaying for a pog
| back in 1998
| gilleain wrote:
| What makes a 'high quality' NFT, in your opinion or experience?
| smegsicle wrote:
| i assume the implication is that successful/desirable nfts
| also tend to have a well-thought-out implementation, the
| union of which being hqnft
| gilleain wrote:
| perhaps, but isn't the desirability of something due to its
| (high) quality? how can its quality be measured from its
| desirability?
|
| seems the wrong way around
| chrisco255 wrote:
| I am not talking about high quality art. That is fairly
| subjective.
|
| I am referring mainly to the smart contract itself. One
| should be able to audit the contract to understand the
| transfer mechanics. Most NFT contracts are forks of
| popular open source implementations of ERC721 such as
| OpenZeppelin's
| (https://docs.openzeppelin.com/contracts/4.x/erc721). You
| want to know things like max supply, mint mechanics,
| transfer mechanics, etc. And you want to be able to
| inspect the contract, such as this example: https://ether
| scan.io/token/0x1CB1A5e65610AEFF2551A50f76a87a7...
| gilleain wrote:
| I did not mention art :)
|
| Ok, sure so 'quality' here is literally just the
| technical implementation of this pointer to a thing. Good
| to know, thanks.
| next_xibalba wrote:
| I sense a trap...
| chrisco255 wrote:
| An open source contract that adheres to the ERC721 or ERC1155
| standard. I'm indifferent to the metadata URI, but some
| collectors prefer metadata to be fully on-chain or IPFS
| based. There's trade-offs with each one, so it really
| depends.
___________________________________________________________________
(page generated 2022-11-07 23:02 UTC)