Ronin bridge hacked, Polygon ID revealed and more - The Daily Gwei Refuel #344 - Ethereum Updates

Transcript

hello everyone and welcome to another episode of delegate refuel where you cap the latest news the ethereum ecosystem i'm your host anthony sosano and today's the 30th of march 2022 all right everyone let's get into it so you guys know that i'm heading to amsterdam next month for uh the ethereum foundation run devconnect event which is a bunch of kind of like smaller events happening around amsterdam hoping to see a lot of you there but i put out this tweet before that basically showing or telling everyone what my devconnect plans are going to be so far so i'm going to be going to a bunch of these different kind of like events here so i just wanted to kind of point this out to you guys i'll be at eighth day staking gathering later to amsterdam shelling point in eighth amsterdam hackathon uh so far i don't

know where else i'm gonna be i'm just gonna be around like i have a i'm staying at a hotel in like literally the heart of amsterdam like right on the canals there so i'm gonna be around i'm i'm open to meeting meeting up with people if i've got the time um but hoping to see a lot of you at the actual events and yeah just to have a really really good time i'm gonna be in amsterdam from basically i think the 16th uh or i fly out i believe the 15th and then because of the time zone changes yeah and because of jet lag probably the 16th let's say the 16th of april there but uh and then i'll i'll be there until around the 26th uh so yeah basically the whole kind of like length of the event they're hoping to to go and

and see and meet as many people as possible uh i'm sure they'll be kind of like people just all over the place like i'm i'm expecting like amsterdam like the around the kind of like conference centers because there's two main ones to just be crypto people or ethereum people everywhere which is gonna be pretty funny to see but uh but yeah if you wanna know which days i'm gonna be out these are the ones i'm speaking at staking gathering and uh the amsterdam hackathon i'll be judging at so far um i may be speaking at some of the others maybe shelling point things like that but yeah that's kind of like the gist of it uh so far i'll keep you guys updated if i decide to go to any uh go to any of the other events uh because there's plenty of events happening i just had to

pick you know obviously which ones i wanted to go to and which ones that i thought were going to be the best for me personally but you guys might you know decide something else is good for you and you can check the schedule on the devconnect website and choose which events you want to go to hopefully you can get tickets because the spaces are limited but even if you can't get tickets it's not a big deal because as i said there's gonna be people everywhere so i wouldn't fret too much about that but um but yeah definitely go to the dev connect website to check all that out all right so the biggest news from the last 24 hours has obviously been this ronin network bridge exploit now for those of you who don't know the roano network is basically an evm uh side chain that uh that the creators behind

axe infinity spun up in order to kind of like scale up their game now they've been wanting to do layer 2 stuff for a while but it just wasn't ready for them so that's why they went with the sidechain first and they've been talking about doing roll-ups for quite a while now obviously actually infinity block in popularity and and got like really really really popular right so anyway back to the i guess like export here this is i believe the largest uh exploit in in bridge history um that has hasn't been returned yet so it was a 625 million dollar exploit about 170 000 eighth and the sad thing is well there's actually a lot of sad things to this but the saddest thing to me was that no one noticed for six days that means there was no monitoring in place no one was

actually checking the chain or looking at the completely transparent uh kind of like blockchain no one noticed that uh that 170 000 eighth was was stolen from this bridge until someone tried to go back from the roano network to ethereum and realize that they weren't able to do so because as you guys know these bridges a lot of them are just ious so if the iou is no longer there um if if the bridge can't actually give you the um the assets that it owes you in this case the real eath then you're out of luck basically there's nothing you can do about that there's actually a massive hole now where all the eighth i think i believe all of the ether at least you know pretty much all of it on the roano network is pretty is basically worthless now um along with some uh a usdc that

was stolen as well because those assets actually existed on ethereum and just existed as an iou on the ronin network now the second thing that was sad about this was that the ronin bridge is actually secured by a five of nine multi-sig so you only need five people to sign off for things to happen for transactions to go through now apparently uh five uh five of these things uh for sorry five of the um the the validator keys or whatever you wanna call them the private keys were compromised and the attacker was able to drain it using the 509 validator bridge so they didn't need to exploit the bridge there was no bug uh they just basically got to hold the five of the keys and were able to to take the funds out as far as i know there is no time lock on this there is no limit to how

much funds can be taken out at once uh by the um by the multisig so just opsec fails all around like i mean to me the biggest fail is just not having any monitoring on your bridge like that's just insane to me and i'm actually wondering how many of these bridges actually have any monitoring at this point in time because we you know and that's not transparent if a bridge is being monitored by kind of like the teams that run the bridges or the teams that manage the bridges so those are the two i think saddest things that came out of this if you want a full breakdown of it of the whole thing you can read this thread from calvin victor here which i'll link in the youtube description um but what i wanted to talk about was bridges in general here guys like i've

been warning about bridges for months now like i'm not going to say i told you so but like i told you so like the bridges are the single biggest point of failure in this industry right now there is so much capital that gets locked up in these things it is just a massive honey pot especially the ones that are protected by things like five of nine multi-stick which obviously isn't ideal now i know there are other bridges protected by stuff like this like the polygon pos chain bridge uh that's protected by by this multisig and they've gone through their reasoning for it before um but also that um from what i know they don't actually have um uh they don't have control of the keys uh concentrated in the polygon kind of like company a lot of them is outsourced and it's actually public who the key

holders are whereas in this case i think with the ronan network there were four validators on the bridge that were controlled by uh sky mavis the company behind axi now i i think that's the case if i'm remembering correctly i may be wrong there so don't don't take that as gospel um but uh but yeah guys like and i said before like not all bridges are created equal either and i shared the blog post that i uh that i've shared before here from um from dimitri berenson here called blockchain bridges building networks of crypto networks i talked about this on the refill when he first published it but this is a lengthy blog post about all the types of bridges i mean it's a little bit outdated now but basically all types of bridges how they work how they differ all that sorts of stuff there and i've explained to you

guys before how there really is only a kind of like a small set of of bridge types there's obviously the multi-sig bridge kind of like contract then there are the native uh kind of like bridges like the l the l two ones which are currently centralized but the way they work is that they don't rely on kind of like this um these trust assumptions they they effectively are as secure as ethereum when they don't have a centralized admin key are kind of controlling it um and then there are kind of like the cross chain um bridges like connext and and and hop protocol which is kind of basically putting all the risk on the liquidity providers to do cross chain decentralized exchanges and and all that sort of stuff there so as i've said before plenty of times not all bridges are created equal obviously

we need to get off of these really insecure multi-sig bridges or kind of like five of nine validated bridges i mean it's more accurate to say that it's a five of nine validated bridge because there are validators kind of like being run on the bridge uh sorry in order to validate the bridge but the thing is is that like it only needs five of nine to collude in order to to steal the funds as as as evidenced here so hopefully you know you guys didn't have much funds in in this bridge or if you did you weren't kind of like too affected by it uh obviously your funds are gone right now i'm not sure what the response is going to be here in terms of like how to plug this hole we saw the wormhole kind of like uh bridge get hacked a few weeks

ago and the way the hole was plugged was that a massive market maker known as jump capital came in and basically backfilled all of the ether in there now obviously uh sky mavis the creators of ronin and axi have a big bankroll they raised the recent round the axx token has gone up a lot they have a big treasury i'm wondering if they're gonna backstop it this is a lot of money guys 625 million dollars worth of eighth they're 170 thousand eighth are they going to backstop but are they going to go out there and buy that eighth and put it into the bridge in order to save their save their network basically and save their community i think if they don't it could be very long term damaging because i mean who's going to trust their funds in this thing anymore right like who's

going to actually like they've burned so many people at this point like that's a lot of people's eat that is just poof gone right um maybe they catch the attackers i mean there's a bit of weird things going on with the attacker they apparently funded their wallet from from binance um whether they did that through a bought account because obviously binance doesn't doesn't allow withdrawals without kyc or a fake kyc account and they had a few deposits to ftx and things like that so there's a bit of weird stuff going on with the address but i mean you would have to think that it's either kind of like bought accounts and mules essentially that they're sending these funds to or fake kyc accounts um if they're using their real identity and doing this then it's like the biggest amateur hour ever uh but yeah i'm curious to see what

happens and what the fallout is from this but you know i think that like it's always funny when these things happen like these big hacks you'd think that the the most logical thing to do for the hacker would be to return basically 90 95 of the funds and then keep five percent or ten percent as a bug bounty for themselves the the um the sky matters would probably stop pursuing them in that case there would be no kind of like law enforcement going after them um everyone will be happy i mean mostly happy uh and maybe sky matters would plug the rest the five to ten percent hole with their own funds and then the attacker makes off with the funds and they don't they don't even have to worry about how to cash it out then because it's kind of like clean money from from then on it's a it's a

it's a fairly paid bug bounty uh program there i think that is the better thing to do because imagine if you take 10 percent as a bug bandit that's still 62.5 million dollars five percent is like 30 million dollars right like come on i mean there's no way they're going to be able to cash out all this all this money all these addresses are going to get tagged chain analysis is going to be all over this there's no way for them to go to fiat here yes they can go to stable coins but even going to centralized stable coins is very dangerous because those could be frozen at any moment you know we've seen usdsc and usdt be frozen in in addresses before so what are they gonna do keep it an eighth i mean sure you can keep it an eighth and maybe you

can find ways to spend it but like it's gonna be kind of difficult right uh at least now maybe in the future it won't be when eighth becomes more ubiquitous um in kind of like the offline world to be used as money but i just feel like instead of having this massive thing over your head the rest of your life as a hacker being like oh you know the authority's going to come after me they're going to catch me blah blah and being pursued just keep 30 million dollars as a bug bounty give the rest back and you're you'd probably be fine right so i i i don't know this is this is overall a weird kind of like hack to me to be honest and like how it's all played out i'm curious to see if anything comes of this as time goes on if that eighth just

kind of like continues to get washed and they try to kind of like you know cash it out in some way i don't know i don't know like i i it could go either way at this point in time but uh but yeah i figured obviously i'd talk about it because it was the most topical thing happening today i woke up to this and was just like oh wow another bridge hack like i mean i wasn't even surprised guys like this is gonna keep happening i'll be honest with you this is not the last one that we've seen i'm pretty sure i said this for the wormhole bridge so anytime that this happens i'm not surprised at all and really if you want the maximum security of your assets keeping them on ethereum using one of the kind of like layer 2 bridges is probably the best way to go about it now

as i've said before the layer 2 bridges are controlled by a centralized kind of like um key as well i don't know if they have time locks on them or anything like that i haven't looked at them specifically but at the end of the day keeping your funds on ethereum layer 1 is the is the safest thing to do but i know that's expensive for for a lot of people um obviously because the gas fees are still relatively high uh and then i've obviously been encouraging people to move to layer twos but as a i've encouraged you to move to layer two but also said that there are risks involved with that at these early stages too so look i mean you're never gonna be able to get a reward without taking risk no matter what you do in crypto like you can basically sit on your ear in cold

storage on ethereum layer one and you'll probably get a reward over the long term from that because you're just kind of like you know sitting on it and appreciate some value but if you want to do yield farming if you want to do general d5 stuff if you want to do nft stuff there's always going to be risk involved like even with the nft stuff if you approve the wrong contract your nfts can just get drained from your address so and some people kind of like bring this issue up a lot and say oh how are we going to get mainstream adoption if this if this always happens i actually think that each one of these hacks and attacks makes the ecosystem stronger yes the the value is really high for these sorts of things but the thing is is that there was the um the bug that happened

with the dao in uh 2016 and what it was called then what the attack was called was a reentrancy attack we as far as i know haven't really seen any of those since then uh and that's because all the developers know about this bug they're like okay well you know let's not repeat that let's not do this and and they've gotten better because of that and obviously over time you know security practices get much better for a lot of these things but there are still going to be amateurs out there and honestly like i like the sky mavis team i like the axe infinity people i think it's an awesome community but this was amateur hour like this is not something that should be happening on a billion dollar project not even 100 million dollar project like even on small projects i mean it doesn't take

much to set up a monitoring service right like you can just monitor you can use the the api on even etherscan to monitor these sorts of things you can set up your own infrastructure and do it and all it takes is a you know okay like let's monitor for this and if something happens like let's respond to it and then even going a little bit further than that put a time lock on this thing put a you know so that when the monitoring comes through you can actually see that something has happened the keys have been compromised and you can try and fix it um set limits right to how much can be withdrawn at once from the bridge like if a whale really wants to withdraw from you know 100 million dollars from the bridge basically tell them hey you're withdrawing a lot of money you're

gonna have to wait for that and then have monitoring that shows a large withdrawal has happened in order for you to go and uh go and review that and see if whether it's an attack or a legitimate withdrawal like this is basic stuff guys this is not super advanced crypt you know cryptography that we need to learn how to do this again no there's basic stuff i expect this to to keep happening sorry i expect this every team that with a bridge to kind of like set up monitoring infrastructure and maybe this is what was needed maybe the other bridge teams don't have monitoring infrastructure and now they will because of this as i said before guys every one of these attacks actually does make the ecosystem stronger it may not be obvious or apparent at first but i i believe it does and the

reason why these hacks are so big is because of the fact that the money's just there sitting in a contract in a pool right and the more this ecosystem grows the the more the market cap of crypto grows as a whole obviously the more lucrative these things become so if you see a 10 billion dollar bridge hack eventually right like that to be honest like i think there's a high chance of that happening if you if you see that happening uh maybe in a couple of years the ecosystem's probably much larger from from there it's just going to be kind of like uh unfortunately uh something that you know we should have expected but you know depending on what the bridge is depending on if it's just kind of like a bunch of kind of like uh and it happens in the bull market as

well like people could be just like aping into something without even caring about if the code is audited or if there's monitoring infrastructure or anything like that so obviously not ideal guys but uh but yeah anyway i read this thread from from calvin for a full breakdown on what happened with ronan network today uh but yeah and be careful around those bridges that's for sure all right so uh tim biker put out a little tweet today uh basically saying what are the most important things to get right in the next two to three years for ethereum to thrive and he received a bunch of really good replies here i want to go through a couple of them and then i want to go through my own reply but basically pulling out was right in there with a bunch of the technical stuff that needs to go right in the next two to

three years obviously we want a smooth merge to happen that's a given at this point in time guys like if if the merge doesn't go smoothly it's gonna be really bad i think just in the short term maybe even medium term for general morale around ethereum um and it's going to kind of like shake a lot of confidence in ethereum so we obviously want that to go to go right we want ford erp 4488 and and and 4490 and 4844 and withdrawals uh right after it in in shanghai you know i've talked about those eips before we want vocal trees and stateless clients to go well that's got to do with the stateless ethereum approach that i've talked about before with basically having it so that the chain doesn't grow to like an infinite size we can we can kind of like prune old things and vocal

trees makes the blockchain or at least makes the network more efficient from my understanding and obviously we want dank sharding and pbs or public block um producers there sorry pbs um not public block producers i can't remember what it stands for right now i've gone blank on it um uh but yeah i mean bank shining in pbs we obviously want to go really well as well uh and then ossifying and waiting till zkp's mature and battle tested uh with roll ups as well so that's on the technical side of things what we need to get right in the next two to three years in ethereum a lot of big things to get right there obviously a lot of um critical things to ethereum's roadmap but i think polynomial hit hit the head um hit the nail on the head there with with those things uh the second thing

was this tweet from fubar who had three three different things to get right uh running a light client from my mobile phone so i've talked about like clients before guys basically what a light clan allows you to do is basically is basically verify uh only the small portion of a of a kind of like transaction that you want to verify rather than needing a whole full node to verify it and to make sure that it's you know it all goes well it's all trustless um no lido dominance for staked eighth i would expand that and say no kind of like um none of these centralized tagging providers or no no slaving provider in general should have a large share of the network and large is kind of like hard to define here i in an ideal world we wouldn't want any to have over five

percent but we already have stuff that already has over five percent of the network i mean i'm pretty sure lighter has over five percent of the network i think they're up to 10 percent uh but i think we don't want it to be 33 or more because that becomes like a censorship uh uh risk there uh but yeah i mean i've talked about this a lot before but definitely don't we don't want that and then third one which i actually disagree with is base layer privacy by default now the reason i disagree with this is i've discussed it before that when you do privacy by default on layer 1 especially built into the protocol you lose sight of of things happening such as inflation bugs now what i mean by this is that imagine if there's an inflation bug within ethereum where

someone is able to mint as much ether as they want if there is privacy by default if you're not able to basically uh kind of like look at everything like you can today you would potentially not be able to even tell that there's an inflation bug and then it has been exploited now that is obviously really really bad especially the fact that you couldn't be able to tell if it's been exploited or not maybe you discover the bug and patch it but you'll never know until the coins actually move that that it was exploited on this actually happened with zcash i believe um and it's kind of like a big concern there so i'm all for privacy by default but at layer two it doesn't actually make sense to have it on layer one by default because eventually layer one's just gonna be roll up transactions

and roll up cool data and proofs and all that sort of stuff anyway so it makes much more sense to just do it all later too uh but that was a good tweet from fubar there and then finally just my my kind of like tweet here where i said i believe and this isn't just technical stuff at all but i basically say i said i believe maintaining ethereum's strong social layer as the network continues to grow and scale up to be the most important thing because i strongly believe that without a strong social layer everything else is meaningless i've talked about ethereum social air a lot before or just social layers in general look the way i view blockchains is i view them as a social kind of like community first thing rather than like a tech first thing and that's because who's running the full nodes who's

managing the network who's putting in changes into the network who's keeping the network decentralized it's all humans guys like it doesn't have anything to do with the technical stuff um kind of like the social layout and then from there you can kind of like layer on the technical stuff which gets us all the properties that we want but without a strong and healthy social layer none of that matters like it doesn't matter that ethereum like let me give you an example here if else if ethereum social air was really if we had a if we had a really bad community our community didn't care about decentralization didn't care about network health none of that sort of stuff and then it doesn't matter what tech things we put in place the network itself would in my eyes be uh be compromised would be essentially worthless because it would

be open to a much more open to attack much more open to being corrupted by special interests uh there'll be much less people building on the network there'll be much less people kind of building on not not only just on the network but building the core protocol infrastructure themselves uh and it would just lead to a lot of bad outcomes so as as i've said plenty of times on the refuel without a strong social layer you have like just a really shitty database honestly like you don't have what i would consider a blockchain you have a database that has a bunch of people kind of like working on it but you don't have any anything you don't have what makes some kind of like a crypto network special there so that was my take and i just saw that uh trent vanepts actually replied with a

bunch of different things here where he says uh you know here are the smaller ones that he believes continue to improve the dev experience maintain healthy multi-client ecosystem making clients stupid simple to run including one-click staking improving the eip process ef transparency learning to live on chain improving like client constructions and actual usage in products and maintaining the social layer cohesion through regular exercise of agency see consensus client diversity campaign will need the same for the execution side i totally agree with everything trent said here those are very important points especially on i i really like him highlighting the um the social layer cohesion here that i was you know i was just talking about the social layer around client diversity guys the only reason we were able to improve consensus layer client diversity

and get it below 66 is because of this massive social campaign that's been running the last few months uh speed headed by the east staker group specifically super fears and as trent mentioned we do need this on the execution side as well because as i said yesterday geth still has 80 of the network we want to get that below you know ideally kind of like the super majority threshold as well there so so yeah anyway you can go read the rest of the replies uh to team biko's tweet i'll link it in the youtube description below all right some news out of visa today so apparently visa has launched a program to help help creators grow their businesses with nfts so you remember that visa has actually been responsible for purchasing some nfts a crypto punk included they did this last year and they've been very big on crypto they're

building a layer 2 um on top of ethereum as well so they're just very very involved in crypto so now they're basically making uh a further kind of like jump into helping creators grow their businesses with nfts obviously as payment rails and as a payments network which is really really cool so just want to kind of highlight this and kind of like highlight that visa i think is the most forward-looking of these payment companies they definitely are doing a lot of stuff in the crypto space that a lot of other payment companies aren't obviously the other week stripe announced like full integration across their entire suite shopify has also announced integrations all these web 2 tried fi kind of like i guess um what's that what's the word for it kind of um fintech companies are all integrating crypto very very awesome to see that um very very exciting as well

all right so polygon announced what they've been teasing over the last couple days finally which is polygon id a self-sovereign identity solution powered by zk cryptography that i mean guys this is like the holy grail stuff when it comes to id so they're saying that it's going to you're going to allow complete user privacy scalable on-chain verification and open attestation ecosystem and there's a tldr and kind of like how this all works in this tweet thread here um and you know some of the highlights of polygon id it reduces complexity and compiles zk snark circuits so this isn't stacked versus zk snark which is different but in the same family onboarding includes native apps sdks and white label solutions and an on-chain private verification is done using zk zk query language so this is really cool i

mean some of the practical implications here of this are decentralized kyc for icos air drops and access to dexes so you could do this in in a way where you could kyc without having to reveal your kyc because of zk zk magic which i think is really awesome like i think kyc is obviously not great but if you want to do uh kind of like an ico and a cyber resistant way or an air drop in a sub a resistant way you kind of need to do kyc because you can't do it in any other way really and be i mean you can and you can't it's kind of really hard but kyc is kind of like that obvious solution there not that i'm a big proponent of kyc or or a kind of like a champion of it but i think if you can do kyc while protecting

user privacy with zk technology that's that's a huge win there so anyway give this thread a read there's also a blog post to read about um basically what polygon id is and what they envision it to be you can see here you know they're going to be doing um so the roadmap here they've got a polygon id wallet app we've put integrating for custom applications polygon id platform and a polygon id connect as well so all this uh and more all the information on this and more is available in this blog post here which i'll link in the youtube description for you to check out as well but just another exciting i guess kind of like tool from the polygon ecosystem on top of everything they already have there all right so speaking of zk stuff zk pad analytics this twitter account basically have put together a stock net ecosystem

map now i have been telling you guys lately that the slightness ecosystem is growing really really quickly about 100 projects are currently being built and this isn't including the ones in stealth mode either and you can kind of see this map of the stack net ecosystem here which i'll link in the youtube description but just some kind of like highlights you can see while it's already supporting it such as argent and and ledger a bunch of nft projects on there d5 projects uh on there as well new and older like like rv is coming but there's also new ones like jedi swap and zk land and zigzag and then there's a bunch of tools already kind of like spun up such as their nethermine tools and l2b and things like that as well but definitely go check out this graphic i'll link it in the youtube description for you to do

so super exciting stuff out of the stark net ecosystem all right finally here i just wanted to give another quick shout out to ethereum.org because guys i mean for anyone who's been around for longer than maybe the last two three years you'll know just how bad ethereum dot org used to be well i mean it's completely opposite these days i said in my tweet here you can literally spend hundreds of hours going down a million different rabbit holes on this website i mean look at it go just i'm just clicking through the website right now go click learn click on if you know ethereum upgrades scroll down and you have all this information uh available to you and then you have links to more information i mean you can just go here and kind of like explore upgrades the beacon chain uh you know it's been shipped obviously

everything happening here links to ever i mean there's so many links on this website guys it's insane like look at all look at all this stuff energy consumption uh learning about the eip process how that all works like if you want to learn everything there is to know about ethereum this is where you go like seriously the ethereum.org team has done an absolutely fantastic job creating all this information more so than any other resource out there so if you want to just sit there and learn as much as you can about ethereum uh and dive deeper into basically all of it uh across basically everything happening in the ethereum ecosystem and doing it in dark mode too i have a light mode on but you can switch to dark mode here then definitely go check out the ethereum.org website i can't think of a better resource than

this and the good thing is that they they link to a bunch of other resources as well so you know even if you um aren't finding what you want on the website itself there's probably a resource that they're linking to that linking to that has that information as as well there so definitely go check that out uh um uh of course you can just go to ethereum.org i don't need to need to link that for you guys but i think on that note that's gonna be it for today so thank everyone for listening and watching be sure to subscribe to the channel if you haven't yet give the video a thumbs up subscribe to the newsletter join the discord channel and i'll catch you all tomorrow thanks everyone