I, Degen

By Zak & HuntNews Technology Tech News

I, Degen episodes

August 24, 2022E12 - Ethereums Fight to Remain Censorship Resistant - 8/24/2022
I, Degen - E12: Ethereum Fights to Remain Censorship Resistant - 8/24/2022
Listen at: idegen.fm
Contact us: @idegenfm

Intro
Welcome to I, Degen - Each week, we track down and explore the most exciting crypto stories. Hacks, mysteries, exploits, and anything that feeds our crypto curiosity. We dig in, cutting through the misinformation and hype in search of a signal in the noise.

Episode Summary
This week we have a bunch of weekly news updates. Then we take a deep dive into the upcoming Ethereum merge and rippling effects on Ethereum protocol level censorship from the OFAC Tornado Cash sanctions.

I,Degen - Weekly Stories
1.The Chicago Mercantile Exchange (CME) Group will launch Ethereum option contracts on its platform on September 12. The company announced that it’s waiting for regulatory review, and if approved, these new investment products will join its ETH futures and mini futures contracts.

2.Alleged Russian Money Launderer Extradited from the Netherlands to U.S.

According to court documents, Dubnikov and his co-conspirators laundered the proceeds of ransomware attacks on individuals and organizations throughout the United States and abroad. Specifically, Dubnikov and his accomplices laundered ransom payments extracted from victims of Ryuk ransomware attacks.
3.Reaper Farm Yield Aggregator Owned

4.TikTok monitoring all keyboard inputs and taps

When you open any link on the TikTok iOS app, it’s opened inside their in-app browser. While interacting with the website, TikTok subscribes to all keyboard inputs (including passwords, credit card information, etc.) and every tap on the screen, like which buttons and links you click.
5.Wrench Attack - 3 men targeted an Indian realtor they knew held bitcoin and abducted him while posing as sellers of a plot of land. They tortured him for 3 hours until he gave them 8 BTC. - [r/CryptoCurrency post]
Victim was not hurt, according to his wife
The suspect was caught using a trap to lure them back to the kidnapping spot Note: These attacks are rare but often receive much media attention. Nonetheless, it’s essential to be aware. Often, you see comments like, “yeah, this is why you keep your crypto a secret!”, which happened on the Reddit post. However, is that advice practical for 'mainstream adoption?
6.Hackers steal crypto from Bitcoin ATMs by exploiting zero-day bug - via Bleepingcomputer, August 20, 2022
Hackers have exploited a zero-day vulnerability in General Bytes Bitcoin ATM servers to steal cryptocurrency from customers.When customers would deposit or purchase cryptocurrency via the ATM, the funds would instead be siphoned off by the hackers.The attacker was able to create an admin user remotely via CAS administrative interface via a URL call on the page that is used for the default installation on the server and creating the first administration user. This vulnerability has been present in CAS software since version December 2020. General Bytes Official Advisory
7.iOS VPNS have leaked traffic for years, Proton CEO says.

Apple notified more than two years ago
claim/issue: any connections established BEFORE activating the VPN are not tunneled
janky trick that may or may not fully work: Turn on your VPN, then turn on airplane mode off and on.
8.U.S. Lawmaker Questions Treasury Over Tornado Cash Sanctions August 23, 2022 via CryptoBriefing.com

Rep. Tom Emmer (R-MN) raised questions over the decision to sanction Tornado Cash in a letter sent to the Treasury Department today.Emmer called the ban of a “neutral, open-source, decentralized technology” a “divergence” from historical precedent.Among other things, Emmer asked what recourse law-abiding users of Tornado Cash may have to claim funds trapped in the protocol.

I, Degen - Deep Dive - The Merge & Ethereum censorship in a post-sanctioned TC world.
What is the merge TLDR?

The Merge represents the joining of the existing execution layer of Ethereum (the Mainnet we use today) with its new proof-of-stake consensus layer, the Beacon Chain. It eliminates the need for energy-intensive mining and instead secures the network using staked ETH. A truly exciting step in realizing the Ethereum vision – more scalability, security, and sustainability.
- https://ethereum.org/en/upgrades/merge/
What's the problem? OFAC Tornado Cash sanctions fallout continues.
Ethermine, the largest Ethereum pool, has refused to pack Tornado Cash-related transactions into blocks in the past week. Several pool technicians also confirmed the news and said it was the first time in history.
— @WUBLOCKCHAIN AUGUST 20, 2022 - https://t.co/XLC3ZjddLR
Individual miners can refuse to include whatever they want, but it has little effect; the transaction just gets into the next block. Need a 51% attack (so, reverting blocks and not just excluding txs) to fully prevent txs from being included.— @VitalikButerin August 19, 2022
The Case for Social Slashing <-- Best dive in Ethereum Censorship via OFAC
So, what’s the issue here?Well, one of the absolute core purposes for blockchains such as Ethereum is to provide neutrality and censorship resistance. That’s why we tolerate that the system is slow and expensive to use at times—because of these unique qualities. A threat to censorship resistance is a threat to the system’s raison d’être.
Other censorship & merge-related stuff Centralized censorship of privacy protocols outside of Tornado Cash

Recently, FTX froze a user account who sent coins to @aztecnetwork’s zkmoney. According to FTX, Aztec Connect - Aztec network / zk money has been identified as a mixing service, which is a high-risk activity prohibited by FTX.
55 min
August 19, 2022E11 - Acala DeFi Bug Exploited & Exploration of Popular Anti-crypto Sentiment - 8/18/2022
show notes here -->https://hackmd.io/@idegen/E11-Acala-hack-and-anti-crypto-sentiment
I, Degen - E11 - Acala Bug Exploited & Exploration of Popular Anti-crypto Sentiment - 8/18/2022
Comment
Listen at: idegen.fm
Contact us: @idegenfm

Intro
Welcome to I, Degen - We track down and explore the most exciting crypto hacks, mysteries, exploits, and anything that feeds our crypto curiosity each week. We dig in, cutting through the misinformation and hype in search of a signal in the noise.

Episode Summary
This week we talk about the strange story of an Acala DeFi liquidity pool bug being exploited, leading to the minting of billions of illegitimate aUSD.
We also dive into an articulate Reddit comment that hits on a number of the more popular anti-crypto arguments floating around right now.
I,Degen - Weekly
Coinbase says it will pause deposits and withdraws temporarily during Ethereum merge as a saftey precaution. Stock drops 8%. Bloomberg Law
Pig Butchering Scams on the rise - Coinbase TripWire
South Korea to block 16 unregulated exchanges
According to the report, the law prevents unregistered crypto exchanges from operating without a license, but the 16 firms have been providing crypto services for Koreans and hosting events targeting Koreans.
Canadian exchanges limit purchases to 30k a year in altcoins that are not BTC, ETH, LTC and BCH
Celer Protocol DNS poisoning
“The Celer protocol and smart contracts were not affected during the breach. Celer DNS root record was not compromised and was never modified.”“DNS poisoning can happen to any DeFi app frontend regardless of the protocol’s own security and we strongly suggest the entire blockchain community to turn on Secure DNS option in your web browser to reduce the such possibility to get affected.”

I, Degen - Deep Dive Acala
Acala (the ‘DeFi hub’ of Polkadot)bug exploited to mint stable coins Rekt coindesk

Anti-crypto sentiment appears to be rising rapidly.
[image]
I, Degen - Most creative personal hack attempt of the week?
Zak: nothing too crazy, standard SMS ‘wrong number’ with a mild twist.
We do our best to report accurately on the topics we discuss, but we won’t always get everything correctly. Please comment here or reach out to us @idegenfm with corrections or comments!
57 min
August 13, 2022E10 - Tornado Cash Sanctions, Sable Protocol Unmasked - 8/12/2022
https://hackmd.io/@idegen/E10-Tornado-Cash-Sanctioned-Saber-Protocol-Unmasked
I, Degen - E10: Tornado Cash Sanctioned, Saber Protocol Unmasked - 8/11/2022
Listen at: idegen.fm
Contact us: @idegenfm

Intro
Welcome to I, Degen - We track down and explore the most exciting crypto hacks, mysteries, exploits, and anything that feeds our crypto curiosity each week. We dig in, cutting through the misinformation and hype in search of a signal in the noise.

Episode Summary
This week we dive into the unprecedented Tornado Cash sanctions, including the arrest of a suspected developer. We also spent some time on the fascinating story of two brothers that operated 11 anon personas to fake a thriving DeFi ecosystem on Solana with the popular Saber protocol.

Weekly Thought
What’s your crypto narrative, and how is it defined/created?

I,Degen - Weekly
Nomad Bridge Hack Update
Nomad announces bounty:
CoinTelegraph reports that 88% of the exploiters were copycats
Excellent technical breakdown by Coinbase Threat Intel
Report of a consensus level attack on Ethereum

Curve.fi DNS hijack results in theft of 570K - some stolen funds frozen on the move though FixedFloat

Ethereum POS merge scheduled for September 15-16
Master of Anons: How a Crypto Developer Faked a DeFi Ecosystem from Coindesk
The Macalinao brothers used a web of bogus identities to create the illusion of a dev community, juicing value on the Saber protocol and Solana blockchain. Now they’re moving to Aptos.
Ian Macalinao says that Saber and Sunny comprised $7.5 billion of the total Solana TVL of $10.5 billion at their peak. He believes this contributed to SOL’s meteoric rise when the token reached a record high of $188.
11 devs all the same person
protocols built on Saber, used to artificially inflate TVL
Crypto data website DeFiLlama has changed the way it presents key decentralized finance (DeFi) metric metric in response to this news

I, Degen - Deep Dive Tornado Cash Sanctioned
What: U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash

What is TC, and how does it work?
Tornado Cash is a decentralized application launched on the Ethereum blockchain in 2019 that allows someone to un-link the source and destination of coins. That is to say, provide privacy or ‘mix’ coins.
When you deposit your 1 ETH on the contract, you have to provide a “commitment”. This commitment is stored by the smart contract. When you withdraw 1 ETH on the other side, you have to provide a “nullifier” and a zero-knowledge proof. The nullifier is a unique ID that is in connection with the commitment and the ZKP proves the connection, but nobody knows which nullifier is assigned to which commitment (except the owner of the depositor/withdrawal account). - Understanding Zero-Knowledge Proofs Through the Source Code of Tornado Cash
Why sanctions?
Tornado Cash, which has been used to launder more than $7 billion worth of virtual currency since its creation in 2019. - Treasury.gov
We should point out that statement is not factually accurate, as not all coins moving through TC were being laundered.
“Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks. Treasury will continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them.”
- Brian E. Nelson - Secretary of the Treasury for Terrorism and Financial Intelligence
Let’s look at a breakdown of funds received by TC from Chainanalysis:

- https://blog.chainalysis.com/reports/tornado-cash-ofac-designation-sanctions/

Points of interest
38 Addresses sanctioned
TC dev arrested in the Netherlands on 8/10.
“suspected of involvement in concealing criminal financial flows and facilitating money laundering,” and that “multiple arrests are not ruled out” as investigations into Tornado Cash continue. The Verge
first smart contract sanctioned
Famous accounts dusted by TC coin
TC Withdrawals increase (but how does increase in WDs == increate in usage?) - Maybe an attempt to get coins out before the platform updates blacklists?
as with most things crypto, there are lots of uninformed opinions on this one
TORN (DAO token for TC) down from ~$30 to ~$14

The Resistance
-https://twitter.com/jchervinsky/status/1557804087856570368
The tornado cash opportunity. How we can learn from this attack to prevent it from happening again

I, Degen - Most creative personal hack attempt of the week?

References/Links
Curve.fi DNS hack
https://twitter.com/FixedFloat/status/1557116267378708481
TC Feature
https://decrypt.co/107075/ethereum-cofounder-used-blacklisted-tornado-cash-donate-ukraine
https://twitter.com/decryptmedia/status/1557042485091831817?s=21&t=SMK4-GTe2D8y0_zA8p67NA
https://blog.chainalysis.com/reports/torna...
1 hr 5 min
August 04, 2022E9 - Chaos In Crypto | Nomad Bridge Rekt, 9K Solana Wallets Hacked, Nirvana Finance Crushed, & more - 8/4/2022
Full show notes:
https://hackmd.io/@idegen/E9-Nomad-owned-Solana-wallets-hacked-8-4-2022
I, Degen - E9: Chaos In Crypto - Nomad Owned, Solana Wallets Hacked, Nirvance Finanace Crushed, & more - 8/4/2022
Listen at: idegen.fm
Contact us: @idegenfm

Intro
Welcome to I, Degen - We track down and explore the most exciting crypto hacks, mysteries, exploits, and anything that feeds our crypto curiosity each week. We dig in, cutting through the misinformation and hype in search of signal from the noise.

Episode Summary
The word of the week is chaos. From the first-of-its-kind decentralized looting mob destroying Nomad to the mysterious draining of more than 8K Solana wallets, it’s been a crazy week. Sadly, there is more.
**Quick word on signal **
I,Degen - Weekly
Reaper Finance - FTM based hacked for 1.7MM Audit, Significant code update, no audit, owned.
The SEC is accusing 11 individuals of running the Forsage Ponzi that generated more than 300 million from users on several blockchains (ETH, BNB,Tron) https://defi-planet.com/2022/08/officials-of-forsage-crypto-accused-of-running-a-300-million-ponzi-scheme/
Two founders pled guilty to securites fraud from a 2017 ICO called “Dropl” for scamming users out of 1.9 million. The founders were sentenced to 2.5 and 3 years for their crimes (https://coinfomania.com/two-men-bag-three-years-in-prison-ico-fraud/)
A bill reaches the Senate that would classify Bitcoin and Ethereum as commodities and put their regulation under the CFTC. (https://www.wsj.com/articles/senate-plan-would-put-bitcoin-ether-under-commodity-regulators-watch-11659499261)
Texas based mining firm Riot Blockchain earned 9.5 MILLION in credits after agreeing to temporarily shut down their mining operation during a recent heat wave and power struggles. (https://www.bloomberg.com/news/articles/2022-08-03/bitcoin-miner-made-millions-by-shutting-rigs-during-texas-heat)
Nirvana Flash Loan Attack - mini deep dive
What is Nirvana? Buddhist state of bliss? Iconic 90’s band? Nope in this context, Solana Based Yield Protocol (what even is a ‘yield protocol’?). Also, a stablecoin.
@Huntfrye Nirvana Finance, a Solana-based yield protocol. Nirvana allowed users to earn annual yields on their locked assets by creating and destroying tokens based on user demand as the ANA tokens were bought from and sold to the protocol.
Looks pretty similar to some other algorithmic coins that rebase or change supply daily due to demand
Is this Similar to the Beanstock flash loan attack we talked about on I Degen a few episodes back?
Hacked for 3.5 MM using FlashLoans
What’s a Flash Loan?

The loans enable merchants to obtain unsecured loans from lenders using smart contracts in place of intermediaries. No collateral is required because the contract only considers the transaction complete when the borrower pays the lender.If a borrower fails to repay a flash loan, the smart contract will halt the transaction and repay the lender’s money. – DeFi Planet

I, Degen - Deep Dives

1) Nomad looted for 190MM by a decentralized mob
What is Nomad?
Nomad is a bridge that allows you to move assets from chain to chain, such as avalanche, Ethereum, Moonbeam, EVMOS, and Milkomeda. “Wow I haven’t even heard of a couple of those”
What happened?
TLDR; ~190 MM, ~2.5 Hours, Initial TX exploiting the bridge, then a swarm of copycats loot the protocol.
Hunt: why not take it all at once? Good question.
Zak: let’s talk about how the hack worked.
How did it happen?

Bridge stores funds - deposit ETH, receive XYZ on Moonbeam
Merkel Tree used to validate cross-chain transactions
After a failed first attempt (costing $350k in gas), the original attacker’s exploit tx, which was copied by those that followed, was able to call the process() function directly, without having first ‘proved’ its validity. rekt.newsThis meant any process() calls could be executed as valid. In fact, a more sophisticated exploiter could have written a contract to drain the whole bridge for themselves.
Initial reports claim the root of the issue was called out in the audit; however, that seems incorrect. Perhaps it was the audit the led the attacker to look at this section of the code. Still, the vulnerability that was exploited appears to have been introduced to the repository on May 23rd and then pushed to the blockchain with an update in June.
DeFi Dominos
The collateral damage from the unbacked assets is also severely affecting the chains that depended on Nomad. Moonbeam, EVMOS and Milkomeda have all taken a significant hit to their TVLs. rekt.news
Hunt: The most interesting and crazy part about this hack to me was that other people noticed the hack going on in real-time, joined in the fun, and were able to withdraw funds. Whether these other users who were getting in on this honey pots were White Hats and trying to take some of the funds before the attacker could, or were they maliciously trying to steal for themselves? Nomad has placed an address on their home page asking for any white hats to return funds to a specific address.
Did you see that meme floating around Twitter? It was a bunch of people looting a stoor who were the copycat hackers after the main attacker busted into the store initially.

2) Solana Wallet Hack
What is Solana?
@Huntfrye Solana is an extremely well-funded alternate layer 1 that boasts as one of the main competitors to Ethereum. Most people agree that Solona has sacrificed some of the decentralization and security to provide extremely high throughput.
What happened?
Roughly 9K addresses on the Solana network were compromised, draining more than 6MM worth of various tokens. For perspective, there are more than 25MM addresses on Solana as of this writing.
11PM UTC on August 2nd, 2022, SOL and USDC started mysteriously being transferred from wallets.
A host of wild theories spread across crypto twitter including fro...
1 hr 3 min
July 30, 2022 E8 - Audius Gets Owned - 7/30/2022
https://hackmd.io/@idegen/E8-Audius-Gets-Owned
# 7/29/2022 - I, Degen - E8 - Audius Governance Attacked
:::info
Follow--> [@idegenfm](https://twitter.com/idegenfm)
:::
:::success
Listen---> [https://idegen.fm](https://idegen.fm)
:::
#### Intro
Welcome to I, Degen - Each week, we track down and explore the most exciting crypto stories. Hacks, mysteries, exploits, and anything that feeds our crypto curiosity.
Welcome degens! Come one, come all.
#### Episode Summary
This week we explore the Audius governance attack.
# I, Degen - Weekly
1. [Sky Mavis CEO Trung Nguyen transferred $3 million worth of AXS Gov tokens just before the hack was disclosed, but he says today that claims of insider trading "are baseless and false."](https://decrypt.co/106186/axie-infinity-ceo-moved-3m-in-tokens-before-622m-hack-disclosure-report) - From Decrypt
> funds were transferred from Nguyen’s wallet so that AXS short sellers “would not be able to front-run the news,”
2. [US Senators Push Bill to Make Small Crypto Transactions Tax-Free under $50](https://www.coindesk.com/policy/2022/07/26/us-senators-push-bill-to-make-small-crypto-transactions-tax-free/) - From Coindesk
3. [FBI detects fake crypto apps that scammed $42.7M from 244 victims](https://cryptoslate.com/fbi-detects-fake-crypto-apps-that-scammed-42-7m-from-244-victims/) - From Cryptoslate
4. [South Korean officials conclude week-long raid in Terra-LUNA case](https://cryptoslate.com/south-korean-officials-conclude-week-long-raid-in-terra-luna-case/)
5. [The recent swoon in cryptocurrency valuations “has directly impacted pricing of luxury watches from brands like Rolex and Patek Philippe,”](https://www.bloomberg.com/news/articles/2022-07-29/the-crypto-collapse-has-flooded-the-market-with-rolex-and-patek) - From Bloomberg
# Deep Dive - Audius Governance Attack
**What happened?**
On July 23rd, 2022, Audius, a Web3 music platform, suffered a governance attack for $6M worth of AUDIO, it's native token.
**What is Audius?**
**Before we jump in lets talk about what proxy contracts are and how they work.**
Proxy contracts give the ability to upgrade or change a dapps contract logic, or even deploy clones.
High level, in this case (but not all proxy patterns), they separate the storage and logic layers of the app, where the proxy contract sits in front and handles storage, and another contract sits behind the proxy and handles the application logic.
![](https://hackmd.io/_uploads/ryTGghxT9.png)
source: https://blog.openzeppelin.com/proxy-patterns/
Key Point:
> Whenever a contract A delegates a call to another contract B, it executes the code of contract B in the context of contract A.
> The first contract is a simple wrapper or "proxy" which users interact with directly and is in charge of forwarding transactions to and from the second contract, which contains the logic. - [OpenZepplin Docs](https://docs.openzeppelin.com/upgrades-plugins/1.x/proxies#unstructured-storage-proxies)
Instead of mapping every function one to one, the fallback function is leveraged.
> That is, the logic contract controls the proxy’s state and the logic contract’s state is meaningless. Thus, the proxy doesn’t only forward transactions to and from the logic contract, but also represents the pair’s state. The state is in the proxy and the logic is in the particular implementation that the proxy points to.
Solidity uses slots to store data.
[Storage Collision](
https://docs.openzeppelin.com/upgrades-plugins/1.x/proxies#unstructured-storage-proxies)
> Using this bug, the attacker was able to call the initializer method of deployed Audius contracts that implement Initializable and change storage state that is intended to be set only once in initialization.
In other words:
>the attacker was able to reinitialise governance contracts, delegating a large number of governance tokens to themself and bypassing safeguards meant to limit malicious proposals.
So, storage collision leads to deployment of malicious governance contract, and massive fraudulent token delegation which was used to pass a malcious governance proposal to send AUDIO tokens from the Audius community pool to the attacker.
Quick massive slippage sale of 6.1MM worth of AUDIO on Uniswap for ~1MM USD/704 ETH, ETH into TornadoCash.
Take aways:
- super fast response, vuln mitigated within a few hours of discovery.
- > These contracts were deployed in October 2020 and this vulnerability has been live in the wild since that time. - [audius-governance-takeover-post-mortem](https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22)
- Human angle - why swap 6MM for 1MM? In a hurry?
# Weekly Freestyle
Password Manager Nightmare
# Who tried to own you this week?
Evolving SMS scams, likely from Ledger breach

# References
[Audius Post Mortem](https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22)
[OpenZepplin Audius Contracts Audit](https://blog.openzeppelin.com/audius-contracts-audit/)
[Rekt News Write Up](https://rekt.news/audius-rekt/)
https://kubertu.com/blog/solidity-storage-in-depth/
[Malicious Transaction](https://oko.palkeo.com/0xfefd829e246002a8fd061eede7501bccb6e244a9aacea0ebceaecef5d877a984/)
[OG OZ Article on Proxy Patterns from 2018](https://blog.openzeppelin.com/proxy-patterns/)
50 min
July 21, 2022 E7 - The Return - 7/21/2022
Please checkout the I, Degen episode #7 Zeevo sequence here - https://app.zeevo.co/dashboard/sequences/bfdded05-2c09-4b5d-96da-90f2531409f2 you're feedback would be most appreciated!
57 min
May 06, 2022E6 - Mint Bots Deliver 7hr KO to Solana & Otherside NFTs Push ETH Gas Fees to New Highs
I, Degen - E6: Mint Bots Deliver 7hr KO to Solana & Otherside NFTs Push ETH Gas Fees to Highs - 5/6/22
Listen at: idegen.fm
Contact us: @idegenfm
Intro
Welcome to I, Degen - Each week, we track down and explore the most exciting crypto stories. Hacks, mysteries, exploits, and anything that feeds our crypto curiosity.
Welcome degens! Come one, come all.
I,Degen - Weekly
Binnance and sequoia revealed as investors in backing Elon Musks twitter purchase
Bloomberg reports Argentinian banks are now BANNED from offering to purchase of digital assets to their customers. Making two Argenenian banks backtrack on their current plans.
ENS (Ethereum Name Service) NFT’s have overtaken Bored Apes in daily trading volume
US Court orders Bitmex founders to pay 30 million in fines for illegal trading
Cronos Defi project MM Finance suffers a 2 mil hack through a malicious contract. The company has promised to reimburse all users affected
The Block, formally known as square posted Q1 earnings and processed 1.7 Billion in Btc transaction but looks to have not recently purchased BTC to add to their balance sheet.
Bug exploited the Fuse protocol used by DeFi platforms Rari Capital and Fei Protocol to steal more than $80 million. - Security Affairs

I,Degen - Deep Dive
Solana Blockchain’s 11th outage, 7th of 2022.- Solana Incident Report

What: May, 1st - 4M transactions per second, initiated by NFT minting bots, took down Solana blockchain by preventing nodes from reaching consensus. The bots were targeting the Metaplex Candy Machine.
What is Metaplex?
Allows users to mint and sell NFTs.
On securing the network, from their site:
Security
Prevent bots from interfering with NFT sales with decentralized architecture, Certified Collections, and CAPTCHAS.
Metaplex poses a solution charge a tax/fee on failed TXs.
Based on a Twitter poll on the same thread with the solution, 5k votes total. With 75% no, and 25% yes.
The speculation was that:
“Eth & AVAX maxi’s voting no”
“Bots voting no”
However, the proposed solution looks like an anti-pattern!
There is a chance that a real user could hit one of these cases, especially in # 2 (Trying to mint when there are no items left in the candy machine). But we think these will not be frequent.
This is not a fool proof fix, and it will not completely stop congestion but we belive it has a substantial enough impact to attempt it.
How does Solana Consensus Work?
leewayhertz.com explains

I, Degen - Freestyle Convo
BAYC Otheside Metaverse Land Sale Pushes ETH gas fee to new high.
175M on fees total, many of which failed
The Otherside Metaverse NFT mint spearheaded by Yuga Labs is thus far the largest in blockchain history
55,000 Otherdeeds NFTs were sold for a flat rate of 305 Apeocin, raising $320 million using an APE value of around $19
The mint congested the Ethereum network raising network fees to as high as 8,000 Gwei
Some users paid as much as $7k in fees
Roughly 64k Ethereum in transaction fees was consumed during the mint
The floor price for Otherside NFTs had gone as high as 5 ETH on OpenSea
^^ From Eth World News

UPDATE: They did refund gas fees to failed TX holders

Mental Gymnastics Required to Justify ETH Fees

We do our best to report accurately on the topics we discuss, but we’re not always going to get everything right. Please comment here or reach out to us @idegenfm with corrections or comments!
Full Show Notes:
https://hackmd.io/@idegen/I-DEGEN-E6-Mint-Bots-Deliver-7HR-KO-to-Solana
47 min
May 02, 2022E5 - Moon Gods Permanently Sacrifice 11K ETH - 5/2/2022
I, Degen - E5: Akutars NFT Auction Misfire Locks 11K ETH - 4/30/2022
Listen at: idegen.fm
Contact us: @idegenfm

Intro
Welcome to I, Degen - Each week, we track down and explore the most exciting crypto stories. Hacks, scams, exploits, and anything that feeds our crypto curiosity.
Welcome degens! Come one, come all.
Episode Summary
In this week’s episode, we take a look at the brutal AkuTars auction bugs that permanently sacrificed 11,539 ETH to the burn 🔥_🔥

5/2 - UPDATE - We recorded this on 4/28 and since have come across some new info related to how the Aku team is working with the community to set things right. The community seems to be aligned and supports AkuDreams on the plan.
I,Degen - Weekly
SilkRoads stolen BTC, recovered by US Gov and used to cover Ross Ulbricht’s debt - Beincrypto

From the block New York Lawmakers want to make rug pulling a crime
ERC712R introduces refundable NFTs to help reduce scams, criticism comes fast. Nice discussion on Markets Daily podcast

BAYC holders targeted again. This time hackers owned BAYC’s Insta page, posted a scam claim for BAYC owners were entitled to an airdrop for virtual land. Instead, the link lifted ape and mutant apes, and other NFTS is the victims wallet. From the Defiant - “The hacker stole 91 NFTs in total, including four Bored Apes, and seven Mutant Apes. Just those 11 NFTs are worth $2.6M going by current floor and ETH prices as of Apr. 25.”"
OG Zcash trusted ceremony anon John Dobbertin turns out to be Edward Snowden. From Zcash Media

From Coindesk Panama Legislature Passes Bill Regulating Crypto. Aimed and bringing crypto projects to Panama and other important things.
Massive 15.3 million request-per-second (RPS) volumetric https DDoS attack targets undisclosed crypto launchpad. The attack only lasted 15 seconds but notable for it’s size and use of HTTPS. From HackerNews

Another from Coindesk Ethereum Name Service overtakes Bored Ape Yacht Club in daily trading volume in rush for short digit addresses. Race to grab first 10k numeric ENS addys partly to blame.
I, Degen - Deep Dive

Moment of Slience - $34 million, or 11,539 eth, is permanently locked into the AkuDreams contract forever.
What is Aku?
Aku is a character created by former MLB player turned artist, Micah Johnson, after hearing a young boy ask, “Can astronauts be black?”Aku was released to the world on Feb 21, 2021 as an NFT in the form of an animated video
– Aku.wolrd

Ten chapters in total, with each chapter in it’s own style.
Next, comes the Akutars…new drop, 4/22/22.

What are the Akutars:
Akutars are a collection of 15,000 unique, 3D Aku avatars with partnerships from; Puma, Planes, Vandal, Who Decides War, BBC and, Ice Cream. Each Akutar grants you entry into the ever-expanding Akuverse, where lines are blurred between the digital and physical worlds and owners gain exclusive access to culture-defining experiences, products, and collaborations.
– Akutars on OpenSeaSo this drop was dutch auction with a unique feature that allowed the lowest bid to set the price for all minters. – Tweet
Then, when the auction ends, any bid higher than the lowest bid will receive a refund of the lowest bid, minus gas fees.

This is an interesting and cool mechanism. However, there was some faulty logic in the contract.
First issue: If you bid on the auction from a contract, and that contract didn’t have a fallback function to handle incoming ETH, then the refund loop would fail. This was exploited, however, the attacker was kind enough to build a switch into their contract that would bypass the failure and allow the refund loop to continue.malicious bidder contract's message
There is some mention that this bug was pointed out to the AkuDreams team ahead of time and they ignored it. I wasn’t able to verify that.
Next Issue: Bigger issue. The contract was designed to keep track of the bids, and addresses that made those bids. A simple ++ was used to increment the counter. However, this counter didn’t account for cases where a single address bid on more than one Akutar. AKA, multi-mint in a single transaction. This left the total bid count short. There were 5495 total Auktars to be auctioned, but bid counter only made it to 3669.
During the refund loop, there is a check to confirm:
# this will fail because of the bid counter issue
require(_refundProgress < _bidIndex)
and then, in the claimProjectFunds function:
# This too will fail
require(refundProgress >= totalBids)
Sooo… 11k ETH is permanently stuck.
What’s strange:
AkuDreams Twitter appears unfazed.
not audited?
not tested?
lots of questionable info floating around on twitter (not strange I guess)
links:
Aku, The Moon God, and the new age of Web3 Media
https://www.instagram.com/aku.dreams
Nice twitter write up from 0xInuarashi
Akutars Auction Contract
I, Degen - Freestyle Convo
Musk buys Twitter
[[[Outro]]]
We do our best to report accurately on the topics we discuss but we’re not always going to get everything right. Please comment here or reach out to us @idegenfm with corrections or comments!
34 min
April 22, 2022E4 - Beanstalk Flash Loan Governance Attack & Axie Infinity P2E Model Under Fire - 4/21/22
Episode Summary
In this week’s episode, we take a deep dive in the fascinating flash loan governance attack delivered on the Beanstalk Farms protocol Sunday. Then we dig into trending criticism on Axie Infinity’s play to earn model.
Intro
Welcome to I, Degen - Each week, we track down and explore the most exciting crypto stories. Hacks, scams, exploits, and anything that feeds our crypto curiosity.
Welcome degens! Come one, come all.
It’s been another epic week. We will go deep on the Beanstalk Farms attack and explore some growing criticism of Axie.
But first, let’s jump into our choice-picked weekly Degen headlines.
Degen Weekly
ETH Merge pushed back from targeted June to Q 3 2022 or later. Surprised?
ETH staking post merge will likely be lower than anticipated -Crypto Slate
Defi superstar Andre Cronje (CRON-YE) comes back after his 3rd rage quit and starts beating the crypto needs regulation drum - The Defiant
“Ethan Gach with Kotaku says” Crypto Gaming “Landlords” upset they can’t keep exploiting all the players. Diminishing returns of the play to earn game Axie infinity and showing that the long term model of some of the guilds is unsustainable long term. - Kotaku
New phishing attack that involves google ads… TradeDog on twitter says that over 4.31 MILLION has been exploited in this phishing attack - Tweet
Lazarus group, a North Korean based hacker group has claimed responsibility for the Ronin bridge attack. Last week we heard they might be responsible but this week it seems they are fully taking ownership of this insane hack - Cryptured
US House Democrats Call for Scrutiny on Crypto Mining as Environmental Threat
U.S. Rep. Jared Huffman (D-Calif.), who leads a subcommittee within the House of Representatives’ Natural Resources Committee, has recruited almost two dozen Democratic colleagues to urge federal environmental officials to devote further scrutiny to the consequences of cryptocurrency mining. - Coindesk

Degen Deep Dive
Beanstalk Farms Flash Loan Governance Attack
TLDR: On April 17th, 2022 an attacker used a barrage of flash loans to purchase a majority of BEAN tokens, the native governance token for Beanstalk Farms. Using this temporarily loaned voting power allowed them successfully pass an emergency governance proposal that drained the protocol of 76M in assets, sent 250K of the stolen money to the Ukraine War Fund, and sent the price of the stable BEAN tumbling.
Who:
victim: bean.money aka Beanstalk
Beanstalk is a decentralized and transparent solution to DeFi’s endemic stablecoin supply shortage. It was designed from first principles to be a paradigm-shifting DeFi primitive that makes decentralized, cost-efficient stablecoins available to anyone with an internet connection.Beanstalk was initially launched in August 2021 with just 100 Beans and has never taken traditional funding. Over the last eight months, Beanstalk organically grew to $100M in market cap, attracting $144M in long term-incentivized liquidity.
Beanstalk: The Path Forward
From the whitepaper:
To date, flawed stablecoin implementations sacrifice the main benefits of decentralized computing by requiring trust in a centralized party and limit their potential market capitalization by imposing collateral requirements.A stablecoin that (1) does not compromise on decentralization, (2) does not require collateral, and (3) trends toward more liquidity and stability, will unlock the potential of
DeFi.We propose an Ethereum-native, credit based stablecoin protocol that issues an
ERC-20 Standard token that fulfills these requirements.An on-chain price oracle leverages an existing centralized bridge between the Ethereum blockchain and the rest of the world to create a decentralized, reliable and inexpensive source for the price of a nonEthereum-native value peg.A Decentralized Autonomous Organization (DAO) governed
by a yield generating, inflationary, ERC-20 Standard token simultaneously provides security, encourages consistent liquidity growth, and dampens price volatility.
Attacker:
Anon/unknown
What:
attack details:
Created two malicious governance proposals and submitted them to the governance contract and wait for 24hrs
AAVE FlashLoans sourced from Tornado Cash --> Synapse Protocol Bridge:
350M DAI
500M USDC
150M USDT
Bought 32M BEAN on Uniswap V2
bought 11.6M LUSD?
These tokens were used to add liquidity to Curve pools with BEAN for the governance voting
Voted for and passed, BIP-18 & 19 (malicious proposals)
Pull back liquidity
Repay flash loans
Converted all received funds into 24,800 ETH ($76M)
ETH moved to TornadoCash
– from BEANSTALK - REKT & PeckShield’s step by step
Presumably, to avoid suspicion of an inside job, Publius, the anon behind the protocol, took the decision to reveal their identity as a group of three in a statement published to Discord.
From ^^ rekt

How:
From Beanstalk whitepaper:

6.5 Governance
A robust decentralized governance mechanism must balance the principles of decentralization with resistance to attempted protocol changes, both malicious and ignorant, and the ability to quickly adapt to changing information.In practice, Beanstalk must balance ensuring sufficient time for all
ecosystem participants to consider a Beanstalk Improvement Proposal (BIP), join the Silo and cast their votes, with the ability to be quickly upgraded in cases of emergency.
6.5.2 Voting Period
A Voting Period opens when a BIP is submitted to the Ethereum blockchain and ends at the beginning of the 169th Season after it is submitted, or when it is committed with a supermajority
Doesn’t matter though, as it looks like a super majority of tokens was used to override the 169th season (~7 days).
5 Seasons
Thus, Beanstalk creates a cost-efficient protocol-native timekeeping mechanism
and ensures cost-efficient code execution on the Ethereum blockchain at regular intervals.
Confusing… How about this:
Seasons are the Beanstalk-native timekeeping mechanism. Each Season is ∼1 hour long.
What’s odd:
Variations in reports about how muc...
46 min
April 17, 2022E3 - Coinbase Insider Trading, more DeFi hacks, & Elon's Twitter Drama - 4/15/2022
I, Degen - Episode 3
Suspicious Coinbase Trades, Rug-pull Finder, more DeFi hack
Listen at: idegen.fm
Contact us: @idegenfm
Intro:
Each week we track down and explore the most interesting crypto stories we can find. We examine scams, hacks, defi exploits, and anything that feeds our crypto curiosity. Welcome degens! Come one, come all.This weeks show - evolving format, testing something new. Start with a run down of this weeks most wild and interesting crypto degen stories.

1) Week in review

Crypto, DeFi, & NFT hacking
Elephant Money Flash Loan Attack Nets hacker 22.2 Million USD in various tokens from the treasury - Rekt.news, @BlockSec, Elephant Money

US Officials Tie North Korea’s ‘Lazarus’ Hackers to $625M Ronin Bridge Attack

Tornado Cash Blocks Sanctioned Addresses VIA their UI

Tornado Cash uses
@chainalysis
oracle contract to block OFAC sanctioned addresses from accessing the dapp.Maintaining financial privacy is essential to preserving our freedom, however, it should not come at the cost of non-compliance.
Another Former Bored Ape Holder Suing OpenSean over inactive listing UI bug

General Crypto News
From the New York Times, Wolf of Wall Street is now marketing himself as a crypto guru

From CryptoSlate Russia to legalize crypto as means of payment- "Russia’s Ministry of Finance is working on draft regulations that will legalize crypto as a payment method."
3. Another from CryptoSalte Monero community set to blitz CEXs in coming ‘Monerun’- "Suspicions of CEXs overstating XMR reserves will be put to the test in a coordinated run on Monero."

2) Feature - Coinbase Insider Making Bank?
What
Coinbase drops an article on April, 11th titled:‘transparency for new asset listings on coinbase’: from the article:
Starting immediately and as part of an effort to increase transparency by providing as much information symmetry as possible, Coinbase will be using this blog post as a pilot to communicate assets under consideration for listing in Q2 2022 (April 1st, 2022 to June 30th, 2022).
The article inspired fears of insider trading and caused degens to hit the blockchain to see what they could find. Before we dig in, it’s worth noting that this is not a new issue for Coinbase. The BCH Coinbase insider trading issue was a thing in 2019

Post from Reddit user dragondude4 on r/cryptocurrency

Earlier today Coinbase made a “transparency post” naming about 50 assets that they are planning to list on their exchange. Most of them are illiquid shitcoins that no one can figure out why they are even listing in the first place.
The post goes on to show 4-5 screen shots of tweets [like]((https://twitter.com/AlanStacked/status/1514062386851946499):
Thread blows up…but then:
So, it turns out this wasn’t a Coinbase insider, but instead a clever chart scammer.

What is chart scammer? idk, I just made that up.
Nansen AI, blockchain analytics, and intelligence platform. They do a lot of cool stuff, but in this context, the smart money dashboard lets you track flows of coins going to and from smart trader's accounts.
So the tricked the Nansen.ai into making it look like this coin was pumping:
How?
So, it looks like people gaming Nansen to make it look like honeypot/scam tokens are pumping. clever. But what does this have to do with coinbase? Nothing, so lets look at another:
This one looks legit. Indeed we can see large Pawtocol - UPI tokens being snagged up on Feb 8th before the Feb 11th coinbase announcement

It’s hard to say what this means. It could be legit. It could be insider trading from someone at Coinbase or maybe even just at UPI?
Cobie Tweet:
36 min

About I, Degen

From the publisher's feed

Welcome! I, Degen is a podcast about crypto technology, security, and culture. With a healthy balance of enthusiasm and skepticism, we cut through the misinformation and hype in search of a signal in…

Share I, Degen

Sign up to save your podcasts

I, Degen

I, Degen episodes

About I, Degen