RoboSats trying to find how hacker stole ~5M sats from its onchain swaps feature \ stacker news ~bitcoin

RoboSats trying to find how hacker stole ~5M sats from its onchain swaps feature nitter.at/RoboSats/status/1635432123648622593

3066 sats \ 17 comments \ @P2P_bitcoin 14 Mar bitcoin

35 sats \ 1 reply \ @tomlaies 15 Mar

This is exactly why Bitcoin is built on simplicity and elegant cryptography with decades of real world usage instead of the newest and shiniest complicated zk-proofs.

@DarthCoin insert Moon sexdoll meme here pls

25 sats \ 0 replies \ @DarthCoin 15 Mar

Why that meme? Is it related?

25 sats \ 0 replies \ @KingZing 14 Mar

oh man, hope it doesn't hurt them too bad.

20 sats \ 0 replies \ @P2P_bitcoin OP 14 Mar

The link for this post uses a read-only front-end for Twitter, which can be easier to read for viewing a full Twitter thread. The Tweet that kicked off the thread is:

Swaps are momentarily turned OFF to squash a bug ... apologies in advance ...

To the user that took advantage of this bug, we would greatly appreciate if you share how this trick was done 😁

FYI if you come across a bug, please be an honest user and notify the public TG group!

https://twitter.com/RoboSats/status/1635432123648622593 [Nitter]

Here's where the amount and the destination bitcoin address are discussed:

Swaps are OFF guys. We cannot have nice things. Someone has deliberately to stolen ~5 million Sats using some bug on the RoboSats codebase.

https://t.me/s/robosats/19161

Not to deliverately expose anyone. This is the onchain address bc1qgm3gfntdzra8c6zt32lnwleky5juvautwja8ey if you are involved with this, I would very highly appreciate input on what was the procedure to get the trick done (I knew it was not too solid, but still...)

https://t.me/s/robosats/19164

25 sats \ 0 replies \ @Entrep 15 Mar

Is the way they joke on they wanting to know how user did it. Platforms that learn from their bugs grow faster

25 sats \ 0 replies \ @lunanto 15 Mar

More security procedures should be used on sats protocols and platforms

25 sats \ 1 reply \ @Busybe3z 14 Mar

They will find the wallet, but prob not the identity of the culprit(s)

25 sats \ 0 replies \ @13atoms 15 Mar freebie

The culprit really should take this route & claim a possible reward:

"the user that took advantage of this bug, we would greatly appreciate if you share how this trick was done 😁"

<<This is the way>>

25 sats \ 0 replies \ @crybaby 14 Mar

oof didn't robosats just get some big push recently? don't remember if it was something released but they made a few headlines last week. I know they've been around awhile I'm just curious if this is an attack in response to that not that it matters

25 sats \ 1 reply \ @TonyGiorgio 14 Mar

Can someone point me to their swap specific code?

414 sats \ 0 replies \ @ekzyis 14 Mar

This is the PR for the fix: https://github.com/Reckless-Satoshi/robosats/pull/388

From https://nitter.net/shyfire131/status/1635630834551259136

25 sats \ 5 replies \ @TheBTCManual 14 Mar

Oef, that's the trouble with building someones always going to be testing your security, and I guess that's the cost of building tools that become anti-fragile over time

27 sats \ 4 replies \ @fiatjaf 14 Mar

They don't become antifragile. That statement makes no sense. I believe you wanted to say they are antifragile since the beginning, which is wrong anyway.

35 sats \ 3 replies \ @xz 14 Mar

fiatjaf, why diesn't that make sense?

Antifragility is a property of systems in which they increase in capability to thrive as a result of stressors, shocks, volatility, noise, mistakes, faults, attacks, or failures.

Never read Antifragile by Taleb. Just seems to make sense.

25 sats \ 2 replies \ @gandlaf21 15 Mar

The system doesn't become stronger by itself. It literally needs devs to fix the bugs, or the system would die.

35 sats \ 1 reply \ @xz 15 Mar

Sure, I can see that nuance.

I guess I was working with the premise that devs fixing bugs on a project is a system of sorts.

1 sat \ 0 replies \ @gandlaf21 16 Mar

I think you could look at it that way, counting the devs as part of the system. But if you do that, they become the weakness. Attack the devs that fix the bugs & take down the system.

Devs are the white blood cells, fixing the system when it needs fixing, but there is nothing antifragile about that.