(TLDR; combination of reentrancy + old approvals that were never removed)
smart contracts are a genius-level invention! with the exact same security and threading model as a 90s PHP site, where every built-in function you can call has a laundry list of potential security issues, and fastening a new language and type system to the same broken API appears to provably be doing nothing to the combinatorial explosion of possible security issues
because none of this was ever about computer science; it was all always just affinity fraud targeted towards mediocre nerds
The best part is that because of blockchain immutability fixing a buggy contract is simply not a thing, you need to deploy a new one, as well as replace any other contracts that refer to the original since they are now compromised as well, all the while paying for gas fees out the ass.
And also as far as I can tell you can’t actually stop your users/exploiters from using the broken contract, you can only try to politely tell them not to.
all implemented as fucking database triggers, a thing you only know what it is from poor life choices
Triggers, the exact thing you want more of when already working with footguns.
Is that? Googles Oh
also urgent client calls because the database they rely on for literally every part of their business is slow and unreliable “for no reason” and you pop open the database and see the sheer volume of PL/SQL and immediately double your hourly rate
it’s worth noting that SQL as a language is basically an embedded COBOL data definition DSL. somehow it’s always arbitrary COBOL with financial programmers
i learned PL/SQL thirty years ago. thankfully i have forgotten every trace.
the last thing I did in college was learn COBOL as a joke, and I’ve been hiding it from my employers ever since
I learnt COBOL in the same august institution I learnt PL/SQL
given y2k pay rates i almost wish i’d kept it up a bit longer
I’m glad I’ve never been a good enough programmer to believe I was a genius programmer.
destroy imposter syndrome by realizing that there is no original
But code is law. /s
Someone needs to add a community note that the hack did not in fact result in “millions of dollars worth of NFTs stolen”. It resulted in zero dollars worth of NFTs being legitimately transferred to another holder as specified in the smart contract approved by parties involved.
Code is law.
code is lol
