BlockchainGandalf

A few days ago hackers made off with about a hundred thousand ETH due to a security flaw in a cross-chain bridge protocol called Wormhole.

The protocol bridges assets between a number of chains, including Ethereum and Solana.

In this episode, I explain how the heist was pulled off, using an analogy.

I've now talked to and heard enough reports from other smart contract developers who have encountered the same thing: web3 developers who don't understand one simple fact about the blockchain world.

And if you don't understand that fact, even if you know how to write ethers.js or web3.js code in your React website, you're not really a web3 developer.

Listen to this episode to find out what it is, and why it's concerning.

No, this is not me advertising an open position.

These are the kinds of job adverts I'm seeing in my inbox these days.

The salary ranges may be more realistic than they were three months ago, but the job descriptions have expanded to the point where they are longer than my resume.  And there are probably only ten people on the planet who could both do the job, and who would want to.

You can listen to the episode, or read this summary:  

Offering half a million dollars for a job that requires the applicant to a) have spent a decade researching and hacking away at blockchain programming, so they can b) help you recruit a team of blockchain developers, and then manage them, is going to be hard to fill.  Because people who have done the former, are probably not going to want to do the latter.

Welcome to the NFT metadata persistence problem.

Art NFTs and Collectible NFTs usually follow the same data pattern: the NFT points to a metadata file, which points to an image file.

The problem is that if the metadata and image file are hosted on a third-party server, and that server disappears, then the NFT points to nothing, and its perceived value will drop.

If the metadata and image file are on the IPFS, persistence is also not guaranteed. There still has to be someone out there with a copy of the files on their IPFS server.

In this epsode I talk about a simple insurance policy for data persistence, to make sure your NFT metadata and image can be found.

(This all assumes that the blockchain will last, but that's a different issue)

In which our intrepid hero talks about why, despite having no use and conferring no real ownership of the artwork, NFTs are still booming.

OpenSea hasn't just offered the world a rather average looking NFT trading platform. It's also provided us with an excellent set of lessons concerning the risks posed by smart contracts and bad design.

In this episode, I look at the recent problems they have faced, in which people's tokens are being bought at below-market prices and then instantly flipped for huge profits, due to a series of smart contract, web interface, and user experience design mistakes made by OpenSea.

As such, it offers a lesson in:

👍 what "approving transfers of tokens" is (and how it differs from actually transferring a token),

💵 how users will take the cheapest option when it comes to gas fees, even if it carries long-term risks,

🤔 why you need to think before you send instructions out to your users, and

🏃 what front-running is.

It's said that mistakes are the best teachers. But I prefer to learn from other people's mistakes whenever possible.

(Note: in the episode I imply that OpenSea had been running on a shoe-string budget until recently, which is wrong: their most recent funding round is their fourth, with 2.1M$ in 2018, 23M$ and then another 100M$ in 2021, and 300M$ in 2022.)

Collecting NFTs that point to artwork you like, and are part of a community you enjoy belonging to is lovely.

But there is so much more that NFTs can do. We're already seeing NFTs gain utility features, such as giving you access to members-only Discord channels.

In the future, I predict that NFTs will gain all sorts of other super-powers. But - problems arise when those super-powers are provided on centralized platforms.

More on that in this epiaode.

Today I gave a lecture on Blockchain for the Emerging Technologies group at Tampere University. 

The focus is less on how blockchain technology works, and more on the problems it aims to solve, and why it is significant, and so I talked more about the history, psychology and sociology of blockchain,  rather than going into computer science, cryptography, or consensus algorithms. 

I place a copy here for anybody who would like a gentle introduction to the topic (and for anyone who meant to be at the lecture, but overslept or forgot).

You've got your project sorted - tokenomics, value proposition. community building, marketing, and smart contract development are all in place. But you need a company or person to build the front end for you.

How do you determine whether they're competent or not when it comes to web3 work?

In this episode I provide a simple practical checklist that you can use to make your decision, which is summarized here:

📃 - do they have samples of previous work

✉️ - does the sample page handle the following well:

  * switches chain if your wallet is on the wrong one

  * shows the address you're connecting with

  * offers an "import this token" button if it's for an ERC20 project

  * actually works

💻 - will they give you access to the source code

🧪 - do they use the test deployment of the smart contract to check their pages before going live

If the answer to any of these is a no, you may want to consider using a different contractor.

We all know that proof-of-work is energy intensive, which means that cryptocurrencies such as Bitcoin and Ethereum currently have to defend themselves against charges that the environmental damage they are causing is not outweighed by the current or future benefits they offer.

This means that if someone sees no value in a decentralized currency/store of value/whatever the cryptocurrency is ... then you can't win the argument.

Ethereum has taken the approach that side-stepping to proof-of-stake, thereby removing the attack, is the best approach.

But how good is proof-of-stake as a replacement for proof-of-work?

Listen to this episode to see what I think.