Grey hat tokens to reward vulnerability disclosure

[bones]

@TylerAbeoJordan

I would propose that a simple solution might be to create dummy tokens that can be returned to the protocol creators for a reward

Maybe , but certainly needs more thougt.

@TylerAbeoJordan

In this manner it’s not manipulation of a token that has any street value and so none are harmed.

Surely once the hacker showed they had accees to those tokens it would cause alot of tokens on that protocol to behave erratically, causing " harm ".
Id certainly expect it to.

@TylerAbeoJordan

Would Safe Network benefit from creating a dummy network token?

What reward can we offer?
I dont think theres much pie left to be divied up is there?

[TylerAbeoJordan]

@bones

What reward can we offer?

I imagine that after launch we could create a white-hacker bug-bounty fund, so a payment would be negotiated out of that.

@bones

Surely once the hacker showed they had accees to those tokens it would cause alot of tokens on that protocol to behave erratically

I would expect that white-hat people would talk quietly with devs and not publicly release the info.

[bones]

@TylerAbeoJordan

I would expect that white-hat people would talk quietly with devs and not publicly release the info.

If i were using a protocol and knew such tokens existed on it, id expect id likely have some alerts set up incase any of them moved.
Id expect that same behavior from many using that protocol with wealth at risk.

As i said, needs more thought.

[TylerAbeoJordan]

@bones

id likely have some alerts set up incase any of them moved.

yeah but that’s easy … the devs would have keys for those pots and they just move them in and out of unlisted pots so that it couldn’t be determined if it was the devs or white hats.

the real issue here is whether it’s acceptable to have a system where the only way to allow for white hats is for them to commit a crime.

If we agree that such a world stinks, then finding ways to make it legal for them to test the system and get rewarded seems a no-brainer to me … but maybe I’m missing something.

[bones]

@TylerAbeoJordan

yeah but that’s easy … the devs would have keys for those pots and they just move them in and out of unlisted pots so that it couldn’t be determined if it was the devs or white hats.

In that set up imo youre just adding issues, as it becomes harder to know for sure exactly what was compromised and by whom.
Id think youd want keys destroyed and coins sat on publicly announced address.

[TylerAbeoJordan]

@bones

Id think youd want keys destroyed and coins sat on publicly announced address.

If I’m adding issues, then clarify what all of those issues are.

This is meant as a system for white hats to find bugs … so if a white hat fails to explain a successful hack to devs, they get nothing. meanwhile devs can still see in the pots, so If dummy tokens disappear for random reasons it’s also a clue to devs that there is a problem.

No issues here as far as I can see. If I’m wrong let me know what I’m missing.

[bones]

@TylerAbeoJordan

If I’m adding issues, then clarify what all of those issues are.

I did.

@bones

In that set up imo youre just adding issues, as it becomes harder to know for sure exactly what was compromised and by whom.

Your allowing potentially multiple ppl to access the keys, on potentially multiple machines.
Surely i dont need to point out how this increases the attack surface.

[TylerAbeoJordan]

@bones

Surely i dont need to point out how this increases the attack surface.

Surely I don’t need to point out that it’s meant to be attacked and that the devs have no reason to manipulate this and there are no negative effects even if they did … unless you want to elaborate more.

@bones

I did.

You didn’t … you pointed out ONE issue, which is clearly not an issue, but labeled it as having issues plural.

edit: could one of the mods move this to a new thread maybe: “White-Hat, Dummy token discussion”

cheers

edit2: I misspoke earlier which may be adding to the confusion –

@TylerAbeoJordan

meanwhile devs can still see in the pots

The pots would be public - as I had clarified earlier - but:

@TylerAbeoJordan

the devs would have keys for those pots and they just move them in and out of unlisted pots so that it couldn’t be determined if it was the devs or white hats.

So the point here was to deal with @bones concern that visibly moving tokens would trigger a worry that hackers had figured out how to steal tokens.

So:

• pots are visible
• devs have keys
• devs automate random moving of tokens between visible pots and secret pots and knowledge that devs do so is public

… therefore no reason to suspect anything (by the general public) that a successful hack has occurred.

[bones]

It seems to me , ill admit possibly wrongly, that you dont want to debate at all but push your opinion, so ill leave you to it.

@TylerAbeoJordan

Surely I don’t need to point out that it’s meant to be attacked

Indeed you do not!
It seems you didnt grasp my point.

[TylerAbeoJordan]

@bones

It seems to me , ill admit possibly wrongly, that you dont want to debate at all but push your opinion, so ill leave you to it.

wow! … I was thinking the exact same of you. You are negative in your responses and feels like there’s another agenda under the surface (I hope not).

@bones

It seems you didnt grasp my point.

Then please do explain it in more detail if I missed something. I’m not your enemy - the problem as described in my first post is the enemy - I’m just looking for solutions - surely that’s what we should all be concerned with.

[bones]

Dude, im tired, trying to unwind at the end of the week, ill try and dm over the weekend

[TylerAbeoJordan]

What should be the OP was left out of the move to new thread:

What’s up today? (Part 1)

So a gray-hat hacker stole some funds from a defi protocol and then returned them for a reward and a promise that he wouldn’t be prosecuted. But now the US has arrested him and charged him with manipulation. The worry is (of guy in the video) that this will discourage white hats because even if they were hired to attack the protocol they are still manipulating markets and violated the letter of the law. I would propose that a simple solution might be to create dummy tokens that can be returne…

[jlpell]

Expanding the first quote in the op shows your original post in what’s up today, which is what you just linked.

[TylerAbeoJordan]

cool … didn’t think of that.