[ 3 / biz / cgl / ck / diy / fa / ic / jp / lit / sci / vr / vt ] [ index / top / reports ] [ become a patron ] [ status ]
2023-11: Warosu is now out of extended maintenance.

/biz/ - Business & Finance


View post   

File: 2.22 MB, 2186x1486, badORACLE.png [View same] [iqdb] [saucenao] [google]
17257895 No.17257895 [Reply] [Original]

BREAKING:

bZx got hacked because of their bad oracle system (they use Uniswap). System frozen by admins, ETH lost, users on the hook.

1. attacker shorted WBTC on bzx with 10,000 ETH
2. attacker sold 112 wbtc on uniswap to push down the price
3. profit from short ?
4. attacker paid back 10,000 ETH to dydx from flashloan used in attack

the TX
https://etherscan.io/tx/0xb5c8bd9430b6cc87a0e2fe110ece6bf527fa4f170a4bc8cd032f768fc5219838

Withdraw funds from bZx asap. Buy LINK. Don't ever use bZx again, ever. Even after they integrate LINK.

>> No.17257922

>>17257895
ya ya every single useful project will use link, im already all in, shut the fuck up no one cares

>> No.17257937

users not on the hook

>> No.17257939

>>17257895
ohnononono

>> No.17257942

>>17257895
I HAVE 20K IN FULCRUM
WHAT THE FUCK
WHAT THE FUCK
WHAT THE FUCK
WHAT THE FUCK

>> No.17257954

>>17257895
brazilians, amirite?

>> No.17257972

>>17257937

ETH got drained - everyone in BZX iETH screwed. you really think your team is gonna bail you out with their own money? they raised like $0 in their scam ICO

>> No.17257997

>>17257895
and allah, just like that.... ethereum falls back to $200

>> No.17258012
File: 1.23 MB, 1063x744, 78FC3E27-9D19-46C7-9418-CC920F764F79.png [View same] [iqdb] [saucenao] [google]
17258012

>>17257895
Defi

>> No.17258033

>>17257895
Praise be to kek. I used Aave instead.

>> No.17258111

Anyone using defi is asking for shit like this. I'm all in link but let's get real it'll get attacked too eventually. It's all a meme.

>> No.17258119

Fucking hell us linkies are going to be rich

>> No.17258135
File: 356 KB, 862x753, 1577162108918.jpg [View same] [iqdb] [saucenao] [google]
17258135

leave defi to me

>> No.17258272

Aave use ChainLink, Aave Ain't Got hacked, surprized?

>> No.17258285

>>17257895
Link is the next

>> No.17258293

>>17258111
It is 21 times as hard to attack the Chainlink ETH feed.

>> No.17258299

>>17258135
I can't stop laughing at this image

>> No.17258357

Does dYdX use Chainlink?

>> No.17258359
File: 77 KB, 1080x1080, 1540865462207.jpg [View same] [iqdb] [saucenao] [google]
17258359

>some people here think that Uniswap is better than ZRX

>> No.17258396

>>17258357
Only Aave uses LINK that's why they went from zero to 19M$ in a month.

>> No.17258645

Its manipulation of uniswap, kyber and fulcrum. Not a hack. Keep it on factsz

>> No.17259007

>>17258111
"It'll get attacked"
Well yeah. It needs to get iteratively improved with each successive attack under it becomes attack surface is considerably minimized with sufficient decentralization.

>> No.17259025

>>17259007
until its attack surface becomes*

(Phoneposting)

>> No.17259660

>>17257942
Same I was up all night trying to close a 4x leveraged position fuck defi and fuck dephli and fml

>> No.17260337
File: 287 KB, 400x414, 1536701843481.png [View same] [iqdb] [saucenao] [google]
17260337

>>17257895
sergey himself orchestrated this attack as a legendary marketing campaign for link

you just win!

>> No.17260349

>>17257895
lmao imagine not using LINK

>> No.17260753

These attacks will keep happening until everyone uses link. Integrate link or fail.

>> No.17260809

bullish for link, but at the same time I have Link locked up in Torque for collateral
*chuckles nervously*

>> No.17260822

>>17257895
How they can stop a contract? If they can stop it it isnt on ethereum right?

>> No.17260912
File: 102 KB, 674x674, 1562274298453.jpg [View same] [iqdb] [saucenao] [google]
17260912

>>17258135

>> No.17260918

I still have their useless locked scam bzrx tokens and they haven't done anything about them it 2 years and they just kept my eth. Fuck this team.

>> No.17261655

Damn, incompetent Fulcrum devs fucked the entire market

>> No.17261726

>>17258012
Oracles

>> No.17261781

>>17257895
I’m typing this very message using DeFi from bzx. Am I going to get hacked?

>> No.17261789
File: 189 KB, 904x427, hindug1.jpg [View same] [iqdb] [saucenao] [google]
17261789

this is so fucking typical its amazing. anyone remember the bad press just after 20k bitcoin? hacks and hacks and more hacks. same thing last august september with its share of hacks. same thing now. the market must go down. that is the law. its harvest time.

pic tip. number four from the left

>> No.17261876

Time for TEZOS to take over. ETH has failed

>> No.17261912

>>17258645
This. Nulinkers are stupid as fuck and will shoehorn chainlink into any discussion whether it's related or not. Shit really fucking pisses me off sometimes. None of these people understand the basics of how this stuff works yet will still make it.

>> No.17261995

how is this a hack?
he outsmarted some low IQ pajeets that shouldnt be involved in defi

>> No.17262114

>>17261995
it sounds like he gamed the ecosystem, not the end users. Manipulating these instruments to the point that they break has functionally the same outcome as a hack. Everyone leveraged up using defi gets Fucked and loses all of their money

>> No.17262165

>>17262114
code is law, what happened was exactly the intended functionality, deal with it

>> No.17262174

>>17262114
>Manipulating these instruments
the smart contracts were poorly coded without any error checking or fail-safes

ethereum is NOT ready for defi

>> No.17262234
File: 171 KB, 1080x1056, IMG_20200215_184544.jpg [View same] [iqdb] [saucenao] [google]
17262234

>> No.17262260

>>17262174
This was oracle exploit.

>> No.17262262
File: 55 KB, 686x526, Snapchat-2001938690.jpg [View same] [iqdb] [saucenao] [google]
17262262

>>17257895
Literally just sold 80% of my eth at 271 waiting for the blow off, can't fucking wait to buy between $240-200.

>> No.17262272

my dream is to pull a high IQ scam like this and retire into the sunset

>> No.17262273

>>17257895
https://cryptobriefing.com/trader-exploits-bzx-oracle-330000-profit/

>> No.17262303

>>17257922
Kek and check’d

>> No.17262323

>>17261912
>>17262114
The fact is there is not enough liquidity on uniswap for it to be a trusted oracle. Realistically you need an offchain oracle that gets a complete picture of the market, and obviously chainlink is the only decent option

>> No.17262346

>>17262323
nah the only fault is uniswap is an instant price

you need trailing price and this exploit wouldnt have been possible.

he just flash crashed and drained in same tx

>> No.17262350
File: 83 KB, 1024x1024, plush.jpg [View same] [iqdb] [saucenao] [google]
17262350

>defi based oracles

>> No.17262353

>>17262260
you can code the smart contracts to verify the oracle wasn't manipulated to detect flash crashes

>>17262272
he had 10k eth to begin with ($2.5M)
dude already made it

>> No.17262356

>smart contract
>is actually retarded

>> No.17262425

>>17262346
Right and uniswap therefore is not showing a true market value since it is so easily manipulated. It just straight up can’t be used as an oracle. Maybe when it has like 100x more liquidity pooled it will be less susceptible but right now using uniswap as an oracle is asking to be raped

>> No.17262432

>>17262353
>he had 10k eth to begin with ($2.5M)
Did he though?
I've never looked into what flash loans are and how they work, but isn't the point that they don't need collateral?

>> No.17262459

>>17262432
yep, flash loans = borrow infinite eth as long as you return more in same transaction

ripe for raping defi at its current form

will not be possible once most contracts upgrade to use trailing price and cleverer shiz

>> No.17262485
File: 115 KB, 598x711, 1550854042575.png [View same] [iqdb] [saucenao] [google]
17262485

>>17257895

>> No.17262486

>>17262425
This is why swapping tools like Uniswap are shit

>> No.17262550

>>17262485
yea what happened to this shit, I assumed they were already using link, and now the pajeets are making me get rekt on a 4x. Was going to close before bed and this shit happened. Fucking disgusting, I can’t wait for coinbase margin honestly.

>> No.17262562

I wonder if the attacker had the foresight to short the market as well, knowing the knock-on effect his actions would have.

>> No.17262628

>>17257895
this is not the fault of the oracle system, the same attack works with the best oracle in the world if you have enough funds, as you can dump prices on other exchanges.
The idea of infinite liquidity trading is just fucking retarded. Synthetix has the same problem.

>> No.17262631

>>17262425
Uniswap is fine. The problem is shit like WBTC doesn't have liquidity anywhere. Chainlink would not prevent this from happening in the slightest.

>> No.17262778

>>17262631
Still on an exchange you see whats going on

>> No.17262820

>>17262459
I can't believe all of this stuff was live without even rudimentary failsafe mechanisms.
I have brainlet IQ, but just from glancing at this small pile of defi tools, it seems extremely obvious that someone would do this?
Did no one think that a "flash" loan could cause a flash crash?

And what's going to happen when more, and more complex, defi instruments are introduced to this system?

>> No.17262896

>>17262778
learn how uniswap works. the whole point of liquidity pools is that arb bots immediately take it to the median exchange price.

>> No.17263008
File: 46 KB, 615x509, Capture.png [View same] [iqdb] [saucenao] [google]
17263008

>>17257972

only those who were Long BTC on fulcrum will lose ETH

>> No.17263038

>>17257895
so it's not a hack or an exploit, it's just someone with alot of money doing what he has to do for profit?

I mean it's the same as shorting btc on bitmex and dumping on the spot exhanges where bitmex gets it's data from, no?

>> No.17263049

>>17263038
so the protocoll works just like it has to and bernie sanders is right that rich people have too much power

>> No.17263094

>>17263038
it is exactly the same anon. fuckin link shills drive me absolutely nuts.

>> No.17263106

>>17262896
I know how it works you dipshit

>> No.17263204

>>17262631
>Chainlink would not prevent this from happening in the slightest.
Wrong.
The attack only worked because the attacker was able to manipulate the price on a low liquidity market, and the price from this market was used as a single data source.
If Fulcrum used Chainlink to get the aggregate price of wBTC across a number of exchanges the attacker would need to manipulate the prices on all of them (or one a single one to a much greater extent) to pull off the attack. Even with low liquidity shitcoins this would be much more difficult than dumping the price on a single dex.
So yes, Chainlink would absolutely have prevented this attack, or at least made it significantly less profitable and harder to pull off.

>> No.17263234

>>17263204
Look at the pajeet dev trying to say it wasn’t an oracle problem kristen or irsten or whatever the fuck his fake anglo name is. I want coinbase margin now, I just lost a lot of link

>> No.17263260

>>17263204
Wrong, chainlink oracles are frontrunnable. If they replaced their current solution with chainlink the contract could be emptied in minutes.

Synthetix has the same problem which is why they don't use chainlink for crypto prices. When they detect a trade they send an oracle transaction with higher gas price than the trade. A very centralized system but it works for the moment.

>> No.17263431

>>17263204
Dumb guy that thinks he's smart. The principle behind uniswap is that arb bots immediately adjust the median market price.

It's not an oracle attack. It's exactly like shorting on bitmex and then dumping btc spot price. It's exogenous to the oracle problem and can happen on any illiquid asset.

>> No.17263637

>>17258135
That smile
That fucking smile...

>> No.17264014

>>17262353


Incorrect. He used a flash loan to borrow 10k ETH, which is an uncollateralized loan.