Discover and read the best of Twitter Threads about #MoneroKon2022
Most recents (2)
Another day, another disclosure. This isn't isn't as exciting, as it was only in... unreleased software 😱
But it does provide a comment on the intricacies of working with #Monero, along with @HavenXHV's ( $XHV ) work on integrating with @THORChain.
But it does provide a comment on the intricacies of working with #Monero, along with @HavenXHV's ( $XHV ) work on integrating with @THORChain.
This does start with the $XMR side of things, and the considerations that must go into building wallets. There are two main issues people don't realize:
1) Lying about the transaction amount
2) The burning bug
1) Lying about the transaction amount
2) The burning bug
Since Monero transactions are private, they don't tell you, or anyone, the amount. Instead, they have all the data needed for nodes to verify them, as well as for you to, and the sender attaches a short encrypted memo including the amount.
August, 2021. The largest hack ever before in DeFi happens. >600m USD is stolen from @PolyNetwork2. A couple of weeks later, it's returned. Life's normal, for a bit. December, 2021? It was all at risk again, and this time, I was on the other end, with a new critical exploit.
So, how did we get here? A bit of background. Poly Network operates a set of SCs on each chain, to hold the bridge's funds, yet Poly Network itself is a Ontology fork which manages TXs and has its validators submit signatures. It's these signatures used in the SCs.
I first noticed a few simple lines of code.
github.com/polynetwork/po…
All transactions must be by whitelisted actors. The catch? It's RPC validated, not by the mempool. This means anyone connected over P2P would be able to submit TXs. I thought this'd be enough to crash it down.
github.com/polynetwork/po…
All transactions must be by whitelisted actors. The catch? It's RPC validated, not by the mempool. This means anyone connected over P2P would be able to submit TXs. I thought this'd be enough to crash it down.
