• @selfA
    link
    English
    1711 months ago

    (TLDR; combination of reentrancy + old approvals that were never removed)

    smart contracts are a genius-level invention! with the exact same security and threading model as a 90s PHP site, where every built-in function you can call has a laundry list of potential security issues, and fastening a new language and type system to the same broken API appears to provably be doing nothing to the combinatorial explosion of possible security issues

    because none of this was ever about computer science; it was all always just affinity fraud targeted towards mediocre nerds

    • @Architeuthis
      link
      English
      1111 months ago

      The best part is that because of blockchain immutability fixing a buggy contract is simply not a thing, you need to deploy a new one, as well as replace any other contracts that refer to the original since they are now compromised as well, all the while paying for gas fees out the ass.

      And also as far as I can tell you can’t actually stop your users/exploiters from using the broken contract, you can only try to politely tell them not to.

    • David GerardOPMA
      link
      English
      911 months ago

      all implemented as fucking database triggers, a thing you only know what it is from poor life choices

      • @bitofhope
        link
        English
        811 months ago

        Triggers, the exact thing you want more of when already working with footguns.

      • @selfA
        link
        English
        411 months ago

        also urgent client calls because the database they rely on for literally every part of their business is slow and unreliable “for no reason” and you pop open the database and see the sheer volume of PL/SQL and immediately double your hourly rate

        it’s worth noting that SQL as a language is basically an embedded COBOL data definition DSL. somehow it’s always arbitrary COBOL with financial programmers

        • David GerardOPMA
          link
          English
          411 months ago

          i learned PL/SQL thirty years ago. thankfully i have forgotten every trace.

          • @selfA
            link
            English
            511 months ago

            the last thing I did in college was learn COBOL as a joke, and I’ve been hiding it from my employers ever since

            • David GerardOPMA
              link
              English
              411 months ago

              I learnt COBOL in the same august institution I learnt PL/SQL

              given y2k pay rates i almost wish i’d kept it up a bit longer

    • @jonhendry
      link
      English
      611 months ago

      I’m glad I’ve never been a good enough programmer to believe I was a genius programmer.

      • @selfA
        link
        English
        711 months ago

        destroy imposter syndrome by realizing that there is no original

  • @bitofhope
    link
    English
    1311 months ago

    Someone needs to add a community note that the hack did not in fact result in “millions of dollars worth of NFTs stolen”. It resulted in zero dollars worth of NFTs being legitimately transferred to another holder as specified in the smart contract approved by parties involved.