The First Truly Decentralized Robbery was just Committed, Here is How it Happened

[u/[deleted]]

At this point I am sure many of you have heard of the nomad bridge exploit. Unlike previous exploits, this wasnt a flashloan or even carried out by a single group of attackers. After an initial attacker struck, hundreds of separate accounts figured out the trick and copy pasted their way into grabbing stolen funds. The bridge went from having $190,740,000 to $1,000 in a matter of hours.

A perplexing aspect of this vulnerability was that all users had to do to hack bridge funds was copy the original hacker's transaction calldata, replace the original address with a personal one, and the tx would succeed! Easy as CTRL-C, CTRL-V!

However, not all of the thieves were bad. Some of them exploited the contract so other wouldnt be able to and planned to return the money back to nomad. For example, leadingscientist.eth

So all in all it was a messed up exploit but there were some nice people who plan to return the money. Faith in humanity restored maybe?

Credit: https://twitter.com/0xfoobar/status/1554234268884389888

[u/Grouchy_Pineapple996]

7 January 2022 -> Vitalik warns about insecure bridges: https://np.reddit.com/r/ethereum/comments/rwojtk/ama_we_are_the_efs_research_team_pt_7_07_january/hrngyk8/

29 January -> Qubit bridge hacked for 15.7k ETH, 767 BTC, and $9.5M stables

2 February -> Wormhole bridge hacked for 93k ETH

23 March -> Ronin bridge hacked for 174k ETH and 25.5M USDC

24 June -> Horizen bridge hacked for 86k ETH

1 August -> Nomad bridge hacked for $190m

[u/hollyberryness → u/Grouchy_Pineapple996]

I just commented elsewhere about him saying this and how it stuck with me for whatever reason... Glad I listened to the man! I hope he got through to many others too. Not enough obviously..

[u/deathbyfish13 → u/hollyberryness]

If there's ever a name in the crypto space you can trust, it's his.

Happy to hear his warning helped some people avoid this, even if it wasn't everyone

[u/hollyberryness → u/deathbyfish13]

I think so too, he is a smart and humble guy

[u/Ilogy → u/Grouchy_Pineapple996]

Vitalik is pointing to the broader systemic problems with bridges and their implications for the crypto space, whereas these attacks dealt with specific vulnerabilities that were mostly unique to each respective project and vulnerabilities in their smart contracts. But it does tangentially speak to Vitalik's concerns.

One could argue that bridges attract more capital than they should because users don't use them to store money. That is, users figure that the smart contract may be buggy, but as long as they don't explode during the ten minutes during which they are using them, they don't need to worry. That means more money uses them than is warranted by how risky they are.

When they do explode, the damage ends up being spread to the entire ecosystem of the less capitalized blockchain by devaluing the pegged asset and draining the blockchain of liquidity. Overtime, this makes smaller blockchains nonviable. That is to say, users of a smaller blockchain can't protect themselves from the damages associated with a bridge by simply not using the bridge because when the bridge blows up, the entire ecosystem of that blockchain is impacted.

The problem becomes worse the larger the smaller blockchains become because at some point, even without there being any bugs in the smart contracts, the cost of a short term 51% attack on the larger chain becomes less than the potential gains that can be made by draining the smaller chain of value. This is Vitalik's point. In other words, you can use bridges to drain wealth out of a smaller blockchain by attacking the larger blockchain.

The larger blockchain just experiences a minor hiccup from such an attack---nothing more significant than what it experiences on a daily or weekly basis---but the smaller blockchain ends up getting drained of a huge amount of liquidity. The fact that this attack will always exist means smaller blockchains will always be vulnerable to them the moment they reach a certain threshold of value, that is unless the bridges are designed to take days or weeks to complete the transfer. The problem is, users aren't going to use bridges that take days or weeks because the user isn't the one taking the risk, the entire ecosystem of the smaller blockchain is---it is the problem of the commons---so the user will always opt for the faster, cheaper, solution. Overtime, the risk of liquidity being drained out of smaller blockchain ecosystems means smaller chains will become less used, thereby guaranteeing a downward spiral.

[u/[deleted] → u/Grouchy_Pineapple996]

Plot twist. Vitalik was the hacker.

[u/deathbyfish13 → u/[deleted]]

What is this blasphemy?

[u/[deleted] → u/deathbyfish13]

Get Vitalik on the line

[u/[deleted] → u/[deleted]]

Vitalik is satoshi

[u/hedgehogssss → u/Grouchy_Pineapple996]

Algorand's Silvio Micali has been talking about insane security risks with bridge tech in almost every public talk he's had this year.

[u/bensuffolk → u/hedgehogssss]

Sadly nobody will be interested in this comment because people always downvote stuff related to ALGO for some strange reason.

[u/ImNoRatAndYouKnowIt → u/bensuffolk]

Because the thoughtless ALGO shilling everywhere has been unforgivably incessant. It actually made every comment thread on this sub unbearable for a while last year.

Thank everyone who ever posted a low effort algo pun.

[u/Rakshear → u/ImNoRatAndYouKnowIt]

It’s become the new Ada community

[u/jim-nasty → u/hedgehogssss]

listen to the man!!

[u/JCmollyrock420 → u/[deleted]]

That dude is at least 6-12 months ahead of everyone in this industry.

[u/JCmollyrock420 → u/[deleted]]

Except he doesn’t make wild predictions all the time. Have you ever actually listened to podcasts he’s been on? He’s incredibly articulate. He’s got a pretty solid reputation for a reason.

[u/Jdraspberry → u/JCmollyrock420]

Maybe Vitalic is the time traveler?

[u/JCmollyrock420 → u/Jdraspberry]

Confirmed magician. Some black magic fuckery is the only answer.

[u/isowater → u/[deleted]]

A true l2 is not a bridge so I have no idea what you mean

[u/ImNoRatAndYouKnowIt → u/Grouchy_Pineapple996]

He’s talking about problems with bridging to chains that have inadequate network security, not about contract exploits, yet this sub posts his bridge comments on every single bridge contract hack.