ETH Devcon: Amazing Developments are COMING to Ethereum

Boxmining

20.3K views 441 8 months ago

Description

The first day of ETH Devcon 2024 has been absolutely exciting. There were many developers from all around the world, and I had the opportunity to meet an ethical hacker from Hacken who shared his stor...

The first day of ETH Devcon 2024 has been absolutely exciting. There were many developers from all around the world, and I had the opportunity to meet an ethical hacker from Hacken who shared his story of exploiting a DeFi protocol's smart contract to extract $1.1 million in assets (on a mainnet ledger copy) and ultimately helped secure the platform. Stay tuned for more as we continue to explore the vibrant world of Devcon! 🌼 GET $30,000 in rewards on Bybit: https://partner.bybit.com/b/boxyt BingX Sign-up Bonus: https://bingx.com/invite/QP0XYB Subscribe to AlphaDrop for Actionable Airdrop Insights: https://www.youtube.com/@UChHUzponDWS6jIyOiMJ71bA ●▬▬▬▬▬▬▬Chapters▬▬▬▬▬▬▬● 0:00 Intro 1:00 Nouns DAO 2:11 Crypto Singh 5:14 Hacken 11:18 Outro ●▬▬▬▬▬▬▬DePIN Products▬▬▬▬▬▬▬● XForge DePIN Phone (5% Off): https://xprotocol.org/xforge/preorder?refCode=boxmining Xardian Node Sale (5% Off): https://xprotocol.org/node-sales?refCode=boxmining Soarchain Mini Purchase: https://shop.soarchain.com/discount/BOXMINING?ref=rqnzwqwy ●▬▬▬▬▬▬▬Recommendations▬▬▬▬▬▬▬● 📲Binance Exchange: https://accounts.binance.com/register?ref=BUNSJWBO 📖 Guides, tutorials and insights: https://boxmining.com/ 🔒Hardware Wallet: https://shop.ledger.com/?r=428b ●▬▬▬▬▬▬▬▬▬▬Community▬▬▬▬▬▬▬▬▬● Boxmining clips: https://www.youtube.com/channel/UCjFy3VBgOZanySOLhQu6GaQ Boxmining News Website: https://www.boxmining.com/ Telegram Group: https://t.me/BoxminingFam ●▬▬▬▬▬▬▬▬▬▬▬Social▬▬▬▬▬▬▬▬▬▬▬● Twitter: https://twitter.com/boxmining Discord: https://discord.gg/9qCpqpZm8G Facebook: https://www.facebook.com/boxmining ●▬▬▬▬▬▬▬▬▬▬DISCLAIMER▬▬▬▬▬▬▬▬● Boxmining, including its employees, are not affiliated with and do not endorse or sponsor any token sales, initial coin offerings, initial exchange offerings and/or airdrops (the “token sales”) unless clearly disclosed. The contents of these videos are for information purposes only. Boxmining and its employees do not provide investment advice and do not take one’s personal circumstances into consideration when providing information about token sales and cryptocurrency exchanges or platforms. In light of the above, Boxmining and its employees may hold the cryptocurrencies mentioned in the videos. Please note that there are legal requirements in various countries that may restrict token sales, and furthermore, the access to, and products and services provided by any of the cryptocurrency exchanges or platforms mentioned in these videos. Consequently, the contents of this video are not directed at or intended to be accessible by persons in any jurisdiction where the extension of the availability of the materials to which you are seeking access would breach any applicable law or regulation. Decisions to participate in token sales or to buy, sell or hold cryptocurrencies, as well as the access to and use of any cryptocurrency exchange or platform involves risk. You are also responsible for informing yourself about and observing any restrictions and/or requirements imposed with respect to any such token sale, or the access to and use of any cryptocurrency exchange or platform. You must use your own judgment or consult a professional for advice on such matters.

AI Analysis

The first day of ETH Devcon 2024 was buzzing with energy, completely different from past conferences, feeling much more like a gathering of builders and innovators rather than just a business event. It's clear the crypto space is in a new, exciting phase, with a strong sense of community and a focus on practical development and collaboration. The conversations highlighted the ongoing advancements in Ethereum, the importance of robust security, and exciting opportunities in the market.

Here's a breakdown of the key discussions and insights from the day:

* The Devcon Vibe: The atmosphere at Devcon was incredibly exciting, full of developers, and distinctly different from previous conferences, especially the last one in Prague three years ago. There's a palpable sense that people have made a lot of money and the markets are amazing, contributing to a very positive and energetic environment. It felt less like a business conference and more like a gathering of builders eager to share ideas and collaborate on projects.

* Nouns DAO's Impactful Work: I caught up with someone from Nouns DAO, and it’s super cool what they're doing. They auction off one NFT daily and have been doing this consistently since 2021. The funds generated are used for public goods and critical Ethereum infrastructure projects, like Agora, which is used for governance by big names like Optimism, Arbitrum, and Gitcoin. Beyond digital infrastructure, they're also involved in real-world initiatives, like rebuilding schools in Uganda and even running cafes in places like Melbourne, Venice, California, and Malaysia. Nouns DAO is open to anyone with a meaningful or impactful idea, regardless of whether you hold a Nouns NFT, inviting proposals that could get funded and contribute to the ecosystem or even generate profit.

* Crypto Singh's Market Outlook: Chatting with Crypto Singh, he echoed the sentiment about Devcon being a "builders' vibe," a stark contrast to conferences like Token2049, which felt more business and marketer-focused. He loves the friendly and diverse culture of Ethereum, where people embrace each other's backgrounds. From an investment perspective, he's a strong advocate for DeFi and projects with solid fundamentals. He believes now is the absolute best time to accumulate altcoins, especially Ethereum and other good projects that are still down, because Bitcoin dominance has gone up significantly and he thinks it's likely near its peak. He feels that projects doing serious work for the community and ecosystem, especially those with good tokenomics and unlock schedules, are worth accumulating before it's too late. The key, he stressed, is to look for projects that are cooperative and share good vibes, as these are the ones that will ultimately win.

* Hacken's Ethical Hacker Story and Security Insights: The most mind-blowing conversation was with Bartaj, an ethical hacker from Hacken. He shared an insane story about how he "stole" $1.1 million from a lending protocol. He found a protocol offering 80% returns, suspected it might be a scam, and decided to audit its public source code. He discovered two low-severity issues that, when combined, created a critical vulnerability, giving him a 5% advantage on every deposit. After 1,000 transactions, he could have drained the entire protocol. Crucially, he did all of this on a local testnet copy of the mainnet ledger, not the actual mainnet. He then ethically disclosed the bug to the project team and helped them fix it, refusing to exploit a small startup. This highlights a big issue in Ethereum: complex smart contracts can have small, seemingly minor bugs that combine into major exploits. It’s particularly challenging with complex logic like flash loans or interactions between multiple smart contracts, making it easy to make mistakes.

Bartaj believes there are fewer hacks overall in the blockchain space than there used to be, and tools are improving to prevent or even stop attacks in progress. However, hacks still occur because projects are becoming increasingly complex. He expressed concern about Layer 2 protocols, predicting that we'll likely see some huge hacks or issues there sooner rather than later. This is because many Layer 2 projects, especially those receiving grants or accelerator funding, sometimes attract teams without deep blockchain or cybersecurity experience, leading to mistakes. Often, these projects just copy ideas without fully understanding the underlying mechanics.

His actionable advice for users is crucial:
* Always check if a project has been audited.
* Verify which company performed the audit and what was included in its scope.
* Look for projects with a bug bounty program, which indicates they are proactive about security.
* Analyze the project's analytics, such as locked volume and user base, though he admitted this isn't always simple and can take time for less popular projects.

The first day was packed, but it was incredibly rewarding to meet so many industry people and see the collective enthusiasm. It truly feels like the start of something new, and the crypto space is here to stay and continue evolving.

Transcript

Alright, just arrived at the venue for DEF CON heading over to registration. It's actually quite exciting. You see so many people and it's definitely a different vibe. A lot more DEFs. I mean, you know, obviously DEF CON, right? And I see a lot of difference as well between, I guess, like now and... I think the last DEF CON I was playing was in Prague like three years ago. And yeah, it's a very different vibe now because, I mean, obviously a lot of people made a lot of money and the markets are...

Alright, just arrived at the venue for DEF CON heading over to registration. It's actually quite exciting. You see so many people and it's definitely a different vibe. A lot more DEFs. I mean, you know, obviously DEF CON, right? And I see a lot of difference as well between, I guess, like now and... I think the last DEF CON I was playing was in Prague like three years ago. And yeah, it's a very different vibe now because, I mean, obviously a lot of people made a lot of money and the markets are freaking amazing right now. So let's register and see what's going on. Inside. So good to see you. Hey, how's it going? How's it going? How's it going, man? Big fan. Hey, can you want to come on camera and say why you're dressed up in a frog outfit? Oh, I'm not dressed up in a frog outfit. You're not dressed. Okay. I got Nouns. Okay. Oh, nice. Nice. Nice. Yeah. I'm a Nouns Now contributor. Nouns Now. Oh, yeah. Nouns. Are you familiar with Nouns Now? Yeah. We got to indoctrinate you to the cult. Okay. Okay. How do you indoctrinate you? So we auctioned one NFT daily. Yeah. And you've been doing that for years, right? Since 2021. Okay. How's it going now? It's great. We've funded hundreds of ETH worth of public goods or Ethereum infrastructure projects. Important infrastructure like Agora. Yeah. So you do quite a lot with it then. Yeah. A lot of meaningful stuff. Agora is used for governance by Optimism, Arbitrum, Gitcoin. But we also do stuff in real life like rebuild schools in Uganda. Oh, nice. We have a cafe in Melbourne. We have a cafe in Venice, California. One in Malaysia. But I do. I do. I know you have a massive audience. I want to send an open invite for anyone building anything meaningful to come to Nouns. You don't need to be a Nouns holder to submit a proposal. Right. If it's impactful, cool, meaningful, interesting enough, or has enough upside to create profit, then just submit a proposal and hopefully you get funded by us. Cool. Awesome. Awesome. Good to see you. And I hope it works out. Yeah. Perfect. Thanks. Hey. Hi. Hi. So we're here with CryptoSing. How's it going? It's going good. I'm really enjoying the vibe here. The vibe is amazing. Yes. Yes. It's a very, very different vibe. You know, it's my first ever DevCon, right? Yes. Although I've been into this space since past eight years. But, you know, it's my first DevCon. It's a very different vibe. I came from Tolkien. My last conference was Tolkien. And that's like, that was like a lot of like... Business vibe, you know? I mean, most of the marketers I could see over there, most of the projects I could see. But I think most of the builders that we can find here. Yeah, exactly. And then like they're talking about like building like villages, meetups, and all of the engineers that want to share ideas on how to build better. It's just, it's actually really cool. Exactly. I mean, when I have come here, what I can see is that, okay, if I'm building one project, how can I integrate the other project? And it's so easy to connect with them. And, you know, there's so many connects that we are going to work after this DevCon. Exactly. Exactly. Exactly. And I feel like there's a lot of friendliness. It's a very friendly environment. Yes. I mean, I would say Ethereum is the most diverse culture that we could ever see on earth, right? Right? Because most of the people are usually divided by the communal, you know, hatred. But here is something that we see that togetherness that we can see that people embrace each other's culture as well. Yeah, exactly. Exactly. What do you think of the, so, you know, the markets are moving up. What narratives are you looking at right now? Like, are you like investing in projects, looking at narratives? Or is there anything like you're doing that's like, you know, you want to share with us? Yeah. I mean, I would say that I have always been advocate of DeFi and the projects with good fundamentals. I think now is the best time to accumulate, especially when Bitcoin has given its very good return. Yes. Obviously, it's not coming back now. But if you look upon Ethereum and other projects, which are still very down, the Bitcoin dominance has gone a lot of up. And probably it's almost top, according to me. Bitcoin dominance would go as much as max up to 64%. It's around 60% right now, right? So what I feel is this is the best time to accumulate all, especially with good fundamentals. You look upon if, like, whatever good projects we look here, who are doing some serious work, who are doing some good work for the community, for the overall ecosystem. I think their tokens are worth accumulating right now. Yeah. So the ones that share good vibes and the ones that do work and have, like, a cooperative nature, they're going to be the winners. Exactly. Exactly. So, I mean, Ethereum, all the layer twos, all the good DeFi-based projects, which are doing some good work. I mean, obviously, we should look upon their tokenomics and look upon their token unlock fundamentals as well. But eventually, overall, this is the best time to get into the market. Otherwise, we're going to be very late. Exactly. Exactly. Well, I hope to see you soon. And I really want to see you on Twitter a lot as well. For sure. It's cryptosync.eth. Just search me on simply site, cryptosync. There is only one cryptosync everywhere. Perfect. Perfect. Perfect. So I'm here with Bartaj. How's it going, Bartaj? It's going great. I really enjoyed the event. Yeah? So you're a hacker, I've been told. Yes. Yes, we can say that. You just talked about how to steal how many million? $1.5 million? $1.1 million from lending protocol. Oh, how did you do it? How does that work? A few months ago, I found very interesting lending protocol. They were offering 80% returns. I was thinking it's a scam or it's a very good offer. So I decided to check their source code. It was public. So I checked the project. It took me a few hours and everything was right from this. It wasn't a scam. But I noticed some issues, some low severity issues. And I started to dig deeper if I can do something with them. And I managed to combine two small severity issues into one critical issue, which gave me a small advantage, like 5% when I was borrowing and lending money. So I was able to abuse it to get 5% more from every deposit I made. And after doing 1,000 transactions, I was able to extract everything from the protocol. Oh, my God. But of course, I didn't do it on the mainnet. I did it on my local testnet. I just copied the protocol database and I was running everything locally. So after I proved that the bug exists, if I wanted, I could steal everything from them, I contacted the guys and we solved the issue together. That's insane. Because you could have just stolen that. You could have just taken that on the mainnet and just called it a day. No, I wouldn't do it. I mean... You're a good guy. So you're good. You're actually a good guy. Yeah. Let's say yes. I'm good, but I wouldn't be able to steal from the project, from the small startup, which is just basically doing its first project. So I helped them. Nice. In this case. Nice. Yeah. So it's always about... So I think that's kind of the issue right now in Ethereum, where it's still a lot of code and it's possible to combine small errors or small bugs together to become one big bug, right? That's the biggest issue. Yeah, that's right. Especially when you have some complex logic like flash loan, lending, or actions between multiple smart contracts. Yes, it's very easy to make mistakes because you don't have any tools which are able to detect such behaviors because you really need to think about a lot of things. But that's why the auditing company exists and, you know, auditors have something to do because... Yeah. And I think that's the issue where code is law, technically, right? So where, you know, there's no repercussion to a hacker. We've seen a lot of hacks and the number of hacks are actually going up. And the amount being stolen is going up as, you know, as the industry grows. So I think that's the essence. You really need to be wary. And even if they don't want to be scamming, they can still have bugs. I think that's the key message here. Yeah, I mean, that's right. I mean, but I think there's less hacks than it used to be. I mean, maybe not exactly on Ethereum, but in the blockchains as a whole. From my perspective, I think there are less hacks and we are pretty... And we are getting betting at preventing them. There are a lot of tools which can even stop an attack which is going on chain. Like Extractor from the hacker. I guess so. So I think we still have hacks mostly because the projects are getting more complex. So, you know, with every level of complexity is easier to make a mistake because... Yeah. Do you think it will be even harder when... Because we have many layers now, right? So layer one, layer two. Does that impact the security at all? Or do you think it was having multiple layers on Ethereum, does that impact security? I think that, you know, on Ethereum itself as the layer one, it doesn't. But, you know, if one of the layer two's get hacked or gonna have some issues, it will impact the ecosystem. And I think sooner or rather sooner than later we'll see some, you know, huge hacks or issues in layer two protocols. So, probably after that, you know, the design of them and the security approach will be reconsidered. Because there are so many projects right now and usually such projects attract... Especially if they have grants or accelerators, they often attract the people who don't really have experience with the blockchain and cybersecurity. And it's easy for them to make a mistake. This is at least what I've seen. That, yeah, mostly the project which has, you know, copied some other idea just for a given layer two or given protocol. Don't really understand it and make mistakes which... So, we, as users, we have to be really careful out there. And obviously check for audits and projects really have to just get that audit done. TLDR. Yeah, for sure. You know, there are some things to look for, especially the audit and what company did the audit. What was in the scope. To check if the project has a back bounty. This is quite important. And, of course, some analytics. What's going on in the project. How many volumes are locked. How many people are actually using it. I know it's not so simple and usually it takes a lot of time to verify the project. But, to be honest, there's no easier way right now if the project is not very popular already. Exactly, exactly. Good advice, good advice. Thank you so much. Thank you. Cool. And that is it for the first day. My God, the first day was just so cramped, packed with stuff. I met so many different people and did so many different things. As you can see, I was exhausted. But, it was so good to meet people from the industry. Like, it's very, very clear that this is the start of something new. Like, you can tell by the scale that crypto is just beyond here to stay. Anyways, stay tuned for day two. We're going to pack all the videos together and it's going to, you're going to see, you're going to be amazed by what we see there. See you there.