Another day, another cryptocurrency fail

[AndyBeez]

I've been taking a look at the 'smart contract' rust language code that's behind Monday's hack and, in my opinion, the complexity and detail means the malicious actor/s would have needed developer level knowledge and project exposure. In other words, an 'inside' job; if such a thing is possible in a world of open source decentralized finance?

[ataradov]

No, the hack is absolutely explainable. There are a ton of people constantly looking for exploits. Furthermore, the developers were notified in a disclose that this attack would be possible, but ignored it (possibly not understanding what the issue is). So, the issue was known, anyone with a bit of technical knowledge reading that could have created this attack after reading the disclosure.

[AndyBeez]

No, the hack is absolutely explainable. There are a ton of people constantly looking for exploits. Furthermore, the developers were notified in a disclose that this attack would be possible, but ignored it (possibly not understanding what the issue is). So, the issue was known, anyone with a bit of technical knowledge reading that could have created this attack after reading the disclosure.

So what do you call a zero day exploit that's already been identified: Zero+ day exploit?

Sadly open source developer community responses to such a slack disclosure may include, but not limited to, one of the following: Don't be ***** stupid. No ***** way dude. I'll close the ticket if you ***** open one. That's not how it ***** works you ***** idiot. Not ***** possible. Why didn't you ***** tell me? Why didn't someone else ***** test it. Not my ***** problem. It was a ***** fork that broke. It's free open source code provided AS IS so what did you ***** expect was going to happen?

[ataradov]

What does open source has to do with this? Microsoft took 3 patches over half a year to fix readily exploitable printer vulnerability. They just kept patching so that exact exploit code did not work without addressing the actual issue. And researchers kept submitting patched exploits. 

It service is not open source either.

[AndyBeez]

What does open source has to do with this? Microsoft took 3 patches over half a year to fix readily exploitable printer vulnerability. They just kept patching so that exact exploit code did not work without addressing the actual issue. And researchers kept submitting patched exploits. 

It service is not open source either.

A vexed issue with open source code: When it comes to a known exploit causing thousands of people to lose millions of dollars, who exactly do they sue for damages? So who was it exactly who failed to show due diligence? And do they have any liability if it was their responsibility?

Open hosted projects are made from a loose conglomerate of core developers and others who are have some technical or other aluturistic motive for joining in. Whether they give their expertise for free or are on someone's payroll, they are still providing a product AS-IS per the MIT License. There maybe a governance corporation at the center of the project which owns the branding (name, logo, ringtone, keyring, gonk), but they do not own the IP rights to anything else. With the decentralized nature of the blockchain Web 3.0 paradigm, they don't have to.

In the case of this hack, where exactly did the responsibility for patching that exploit lay? Whose job was it? Who gets sued. Who gets fired? Who gets exonerated?

The thinkers behind Web 3.0 need to start thinking this out - before our dumb government lawyers come up with another box of fudge.

[james_s]

Why are you so focused on finding blame and punishing somebody? Who cares whose fault it is, just get it fixed.

[ataradov]

who exactly do they sue for damages?

And who do you sue for the closed source software? It all comes with EULAs and you have to agree not to sue.

In the case of this hack, where exactly did the responsibility for patching that exploit lay?

People working at that company. But it is their right not to fix anything. Companies are free to do whatever.

Also, it is not a coding issue, it is a design issue. The system was coded as designed. So, they would have to change parts of the design to address this, and that may have other consequences.

Same reason why Microsoft can't fix the printer stuff - it is not the coding issue, it is the design from the 90s that does not hold anymore, but they can't change it because customers rely on it. So, eventually they just chose to keep it as is.

[Haenk]

These gift cards and precharged credit cards actually are a thing. AFAIR it was a short sidenote about a drug dealer being arrested, wo carried stacks of those cards with him.
Of course stronger regulations will not help against criminals.

[pcprogrammer]

These gift cards and precharged credit cards actually are a thing. AFAIR it was a short sidenote about a drug dealer being arrested, wo carried stacks of those cards with him.
Of course stronger regulations will not help against criminals.

One of the issues with gift cards is that companies hand them out as a Christmas bonus and when they are above the allowed limit it should be declared as income.

Criminals will move on to other methods of handling dirty money.

[Stray Electron]

One of the issues with gift cards is that companies hand them out as a Christmas bonus and when they are above the allowed limit it should be declared as income.

Criminals will move on to other methods of handling dirty money.

   Not sure what your point was but in the U.S. ANY income is supposed to be reported regardless what form it was in. To the IRS five hundred $1 gift cards are considered the same as one $500 gift card.


    That's true, and it always will be.

[Halcyon]

There is no doubt in my mind that governments will impose further regulations on crypto currency so that they can make money of it too.

In Europe there is now talk about gift cards and coupons needing identification and registration when bought and exchanged, all under the launder and terrorism act. The real reason is more likely that they feel they miss out on taxes.

Governments want full control over our lives and our money, and they sell it under the "it is all to protect you" theme. Sure we need rules and regulations, but to me they are driving it to far.

In Australia, they don't sugar coat it... If you make money off investments, you pay tax on it. Taxation and anti-money laundering are two different beasts. Crypto is no different to any other capital gains, so why pretend it is? As much as I hate paying tax, I tend to agree.

[pcprogrammer]

One of the issues with gift cards is that companies hand them out as a Christmas bonus and when they are above the allowed limit it should be declared as income.

Criminals will move on to other methods of handling dirty money.

   Not sure what your point was but in the U.S. ANY income is supposed to be reported regardless what form it was in. To the IRS five hundred $1 gift cards are considered the same as one $500 gift card.


    That's true, and it always will be.

In the Netherlands gift cards up to 40 euro are exempt from taxes. But the post was as a follow up on my earlier post

There is no doubt in my mind that governments will impose further regulations on crypto currency so that they can make money of it too.

In Europe there is now talk about gift cards and coupons needing identification and registration when bought and exchanged, all under the launder and terrorism act. The real reason is more likely that they feel they miss out on taxes.

Governments want full control over our lives and our money, and they sell it under the "it is all to protect you" theme. Sure we need rules and regulations, but to me they are driving it to far.

In Australia, they don't sugar coat it... If you make money off investments, you pay tax on it. Taxation and anti-money laundering are two different beasts. Crypto is no different to any other capital gains, so why pretend it is? As much as I hate paying tax, I tend to agree.

This differs throughout the world. In the Netherlands gain on investments are exempt, but dividend from them are not. A problem with gain on investments is when is it that you actually made money of it. When the tax authorities take samples of your assets at the end of the year, and the stock exchanges drop 30% the next day is it then fair that you have to pay tax on what you don't have any more? So then you would have to asses every sale on the stock market you make and pay tax on that, but again what if you make a bad investment after it?

Of course taxation and anti-money laundering are two different beasts, because on the first the government makes money, where on the latter it does not. And that is what the government does not like.

Tax paying is needed for sure. Governments can't exist without it, but they always want more, and it becomes a heavy burden.

[ataradov]

A problem with gain on investments is when is it that you actually made money of it.

Is not it logical to count them when you sell the shares and get the cash back? This is not without drawbacks too, since this is what lets rich people to not pay taxes. But at least this is a consistent way to count gains on investment.

[pcprogrammer]

A problem with gain on investments is when is it that you actually made money of it.

Is not it logical to count them when you sell the shares and get the cash back? This is not without drawbacks too, since this is what lets rich people to not pay taxes. But at least this is a consistent way to count gains on investment.

Since income taxes are an annual thing I would say a total tally of wins and losses on investments over the whole year would be a more fair way to do it.

[ataradov]

Yes, but you only gain or lose if you turn things into cash. Otherwise the value of your holdings changes literally every millisecond. It is impossible to account for this and has some possibility for arbitrage.

And it is generally impossible to use your holdings for payments. Although again, if you are really rich, you can use them as a collateral to get a loan, thus having cash but avoiding paying taxes on it.

[pcprogrammer]

Yes that is what I meant.

Takes a lot of accounting when you are a day trader. You have to note down the gains and losses of every transaction you make.

[tszaboo]

Yes that is what I meant.

Takes a lot of accounting when you are a day trader. You have to note down the gains and losses of every transaction you make.

Especially for cryptocurrency. In smaller cheaper chains, you can easily rack up thousands of transactions in a year, good luck keeping track of pricing of each buy and sell.
And then there are the technical issues with it.  Also, how are you supposed to know how much the value is of the token? Is it the price of it in USD? You cannot exchange it to USD, you might be able to exchange it to BUSD or USDT or other token. If at the exact transaction, 1BUSD = 0.98 USD then what? What if you keep track of it in TUSD, which is 0.028USD, but it is supposed to be 1 USD?

[pcprogrammer]

I was not aiming at crypto transactions but investment transactions in general.

Selling a house that you bought to renovate and flip is also a transaction. As a company you have to keep track of everything when doing this, as a private person you might be exempt, at least in the Netherlands I think. Here in France you have "plus value". When you buy a second house and renovate it and sell it the only expenses you can deduct are those done by professionals. When you do the work yourself you can't deduct the materials used, for as far as I understood. And then you pay taxes over the difference between buy and sell price.

But for crypto the moment you sell some of the tokens I think the money received from the transaction is added to your account in a regular currency being it dollars or euros, and you can use that. Sure it becomes a huge pain in the bum, because you can then also see exchanging dollars for euros or vice versa as a transaction. So where does it end?

One way of doing it is to take balance on January 1st and then again on December 31st. If there is gain, tax that.

[AndyBeez]

School essay time: Who actually decides how much crypto currency is worth in USD? Is it the exchanges, blockchain miners, hodlers, churners, programmers, hackers, day traders, trading bots, venture capitalists or social media influencers?

Reality check, investors have no influence on the crypto markets because the cypto markets fail to function as real fiscal markets do. There are no fiscal instruments such as quantitative easing or bond rates to stabilise fluctuating currency markets. Instead, it's all governed by the reflex actions of the hoard. And they can click faster than you.

Crypto trading is like sitting in the car of a roller coaster and claiming you are going upwards because of your own powers of levitation. Rides go down as well as up. Unless that car goes off the rails.

[thm_w]

Saying "investors have no influence" just because crypto markets fluctuate wildly is not a valid statement.

[Bud]

A problem with gain on investments is when is it that you actually made money of it. When the tax authorities take samples of your assets at the end of the year, and the stock exchanges drop 30% the next day is it then fair that you have to pay tax on what you don't have any more? So then you would have to asses every sale on the stock market you make and pay tax on that,

There is Unrealized gain (the one before you sell) and Realized gain (when you sell). Double check your country's tax rules, i would be surprized if they tax Unrealized gain.

but again what if you make a bad investment after it?.

Here we can offset your investment loss against the tax you owe so you pay less tax. But you have to have tax you owe, otherwise you can't claim a loss.

[AndyBeez]

Saying "investors have no influence" just because crypto markets fluctuate wildly is not a valid statement.

You're correct. Whales can rug pull a token's liquidity at the cost of the little guy's life savings. Like with Terra-Luna. So yes, select investors can and do influence market volatility, but only for their own personal gain.

[james_s]

IMHO anyone who has their life savings in crypto, or any other single investment really then I think they are kind of an idiot.

[Sal Ammoniac]

And yes, while I kinda like the decentralized idea

How much is a Bitcoin worth?