The usecases for this EIP are endless - I review it for the next @hoprnet staking program (with NFT boosts for community supporters) and decouple economic from technical risks
But you can really use it for any sort of tokenized deposits, lending platforms, yield assets...
🧵8/9
As always, this is the frontier and there be dragons 🐉
You are not alone, we're in this together but as with all new shiny things, there WILL be exploits and significant losses of funds, so please be careful 🙏
🧵9/9
• • •
Missing some Tweet in this thread? You can try to
force a refresh
We made derp.hoprnet.org so that you can watch them watching you
Here's 3.5 surprises 👇
Reminder that for 99% of all Ethereum users "RPC provider" simply means "a computer in Uncle Joe's basement that I blindly trust. I blindly trust the data that it delivers to me and I also blindly trust their pinky promise to not log everything they see about me"
So what does your RPC provider actually see?
Pretty much everything that you request "from Ethereum" - and more
The core of the issue was being too nice to the user (claiming rewards during unstake) followed by too strict validations (rewards were `require`d to be >0)
Our whitehat contract to reduce the potential for locking further funds and unlocking some of the dead-locked token was then utilizing 1. `owner` privileges 2. re-entrancy (srsly, ERC777 re-entrancy is rough) 3. an accounting bug allowing privileged partial double-spends