Wormhole exploited, Dune raises $69.42mil and more - The Daily Gwei Refuel #307 - Ethereum Updates

Transcript

hello everyone and welcome to another episode of the deadly gray review where recap the latest news in the ethereum ecosystem i'm your host anthony cesano and today's the 3rd of february 2022 all right everyone let's get into it so just a quick announcement here um i i kind of like announced this in the discord channel yesterday but there will be a text-based amo with the ceo and one or two tax lawyers from crypto tax calculator happening in the delhi discord channel uh today basically so third of feb 4 pm pst 1 am gmt friday the the fourth of feb uh and 11 a.m australian eastern daylight time friday the 4th of feb as well so um you can convert that to your time uh your time zone there the announcements in the announcement channel in the discord

channel so if you're interested in asking anything you know about tax you mean you can put the quit your questions in there now if you're not going to be online at that time but you can basically go in there get your questions answered uh and essentially uh i guess learn more about your tax position now obviously this isn't going to be tax advice or anything like that but it's just a way for them for you guys to get your questions answered so very much looking forward to this definitely hop into the discord channel and check this out if you're around at that time all right so the biggest piece of news over the last 24 hours which is probably going to take up most of today's episode because there wasn't actually that much much other news today but i'm sure you all know what i'm talking about the

wormhole exploit so the solana wormhole bridge was a bridge but primarily between ethereum layer one and solana layer one it had a lot of ethernet um it had uh been been used for quite a while now and today it would it got exploited exploited for about 120 000 each or over 300 million dollars worth of eth now this was stolen directly from the contract here through a sophisticated exploit which was detailed by a bunch of security researchers pretty sure samsung's thread here details it if you want to check out everything it'll be linked in this thread which i'll link in the in the youtube description of course but how time how you know good's the timing here on this basically uh i was talking i've been talking about bridges

a lot lately we're talking about the risk involved with these bridges a lot lately uh vitalik had a post a few weeks ago around uh the dangers of bridges and cross chain and all that sort of stuff there now i do want to say that this isn't your typical kind of like bridge expert it was just like this was a smart contract exploit it wasn't an economic exploit or an exploit of the validators or a dos attack or anything on the actual bridge infrastructure but because the wormhole breach was just like a simple smart contract but i think the point of me warning you guys about bridges wasn't so much about the attacks against bridges themselves but if the fact that these bridges are massive honey pots for attackers and and then they they also have downstream effects so i'll go over the honeypot thing first so

these bridges they have billions of dollars in them right they are some of the biggest uh and kind of like most widely used smart contracts these days because of the fact that everyone wants to bridge in and out of places uh and it's just a kind of like uh basically it's a thing of like you lock your asset on ethereum if you're bridging away from ethereum and you get minted these ious on another chain as i've talked about before now because of that the assets just sit there in the smart contract as a as a massive honey pot and these bridge contracts aren't very um battle tested they haven't been around for very long it's not like some of the top defect contracts like maker and uni swap that have been around for a while these things are relatively new now the second part here is the

downstream effects of what happens when there's an exploit in a bridge as i've discussed with you guys before plenty of times the assets that you're issued on another chain so for example if you bridge eighth from ethereum to solana you are not issued real eth on solana because solana doesn't have real eth to issue you solana issues you an iou that basically says well if you want to go back to ethereum you have to bring this iou the smart contract will unlock your funds on ethereum and give you your eighth back now what happened with the exploit is that all the eighth was drained which meant that all of the ethon solana was worth zero there was nothing backing it it was logically worth worth nothing right like no one would would buy it because you can't get real eat for it now because of this it has a lot of

downstream effects on the rest of uh the ecosystem in cylinder specifically the d5 ecosystem i haven't seen any breakdowns of anything kind of like that happened but what could have happened would would be errant liquidations right like if the eighth backing uh the loans is worth zero then these people are going to get liquidated their positions are going to go to zero uh eth in amms right paired with other assets there's going to be a lot of um a lot of volatility going on there's going to be people swapping assets in and out there's going to be you know it's going to be a very big mess obviously um but uh the thing is with the wormhole exploits there's a bunch of kind of like rich benefactors i think jump capital and a few other people that have that have said that they're going to actually

um make up this for this hack and actually add the funds back to the wormhole bridge here which is i mean the fact that they have that much money to do that in the first place is a pretty big deal but also it's i think it's that's a bit of a bad pre precedent because this is a rare occurrence this is not gonna happen for uh most of these bridge exploits or just exploits in general and especially the big ones like what happens when there's a bridge exploit of a billion dollars and it doesn't get returned i know there was one recently i think a few months ago for 800 million dollars but the funds were returned what happens when it's a billion dollar exploit and the funds aren't returned and there's no benefactors out there to make up the shortfall that's a billion dollars of user capital gone like just

gone someone else has it that someone may not be able to ever cash it out but uh they may use it on chain still they may wash it through tornado cash slowly they may you know do other ways to kind of like get that get those funds washed and hidden but if you are holding the iou on another chain then your asset is now worth nothing it's it's it's pretty bad right uh and this is the major reason why i haven't used any of these bridges i've used the layer two bridges which uh mind you it can still happen to these layer two bridges but they're a lot simpler a lot is they're a lot easier to reason about uh and i just feel more comfortable using them and they do have centralized controls in place but from a kind of security perspective i feel more comfortable

using the layer 2 bridges but even then i um you know you guys know that most of my ethers is in eth2 staking i'm comfortable doing that even though i can earn more on my eighth in other places i always take these things into into account these risks into account that's why i always tell you guys to take it into account as well because the thing about security is that everything can seem fine for like a relatively long time maybe even years and then all it takes is that one event to happen for you to lose everything right it's kind of like the um the the turkey fallacy where the turkey believes that life is awesome because it's getting fed you know for it's getting fed it's growing it's it's having an awesome life and then one day ted gets chopped off and it gets served for dinner right it's that

that's what happens right you could for like uh you know two years you could be in these kind of contracts you could be you could be feeling very safe you could be like yeah this is awesome this is fine it's been two years um nothing bad's gonna happen and then one day you wake up and all your funds are gone now i know that's a scary proposition but this is reality guys you have to actually take this into account when playing around with this sort of stuff especially with large sums of money especially with large sums of your portfolio um so that's why like for me personally i have most of my portfolio in staking because i'm i'm and not with rocker pool or anything like that or other service providers with just like vanilla staking not to say that i think rocker pulls insecure

or anything but like there's still added risk on top of just vanilla staking if you do that if you use another service you have centralization risk uh there's there's just always risks involved here so that's why i'm always harping on about this and i know i sound like a broken record but i don't want you guys to lose any money like i don't want you guys to to lose most of your portfolio if you you know you've got like uh maybe maybe you're starting off small you've got like a few thousand dollars you're like okay i'm gonna be a bridge or i'm gonna go bridge to all these different chains and then you lose the money to an exploit maybe it's in the bridge maybe it's on one of these kind of like forks on another chain and that's all your portfolio gone and then you just lose

interest in crypto that's that's the worst thing that could happen right so i think that it's always worth bringing up these sorts of things and there's not always going to be someone there to make you whole like right now i guess like with with wormhole it made sense because it's actually a big part of the solana ecosystem and it will take a lot of ecosystem will take a pretty big hit from this and i think wormhole is raising around right now as well um at a pretty high valuation so it definitely makes sense but uh i'm sure these guys didn't want to have to do this either so i think from that perspective uh i guess as i said it sets a bad precedent but they're going to do what they're going to do um and as i said before i think there were a lot of

bad takes today about this where people said this is why we don't use bridges this is why we don't believe in cross chain this is why this is you know the multi-chain future is actually just ethan l twos that wasn't the right take as i said i'll this could happen to an l2 because the bridge contract could have an exploit in it could have a bug in it yes it may be simpler and easier to reason about and it may be less of a risk but it's still there the risk still exists the same thing could happen and doesn't matter that your funds are validated by ethereum the smart contract having a bug is is on ethereum it'd be the same as a defy smart contract having a bug um just like a bridge one having a bug it'd be the same result in the end your funds

would be lost doesn't matter what what's verifying it now where things get even more complex is these other bridge constructions that are trying to do different things like have their own validator set like like thought chain for example um how like for cross chain swaps uh and then even cross chain swaps have economic exploits with liquidity then there's different tokens and stuff that can be exploited there's so much risk and a lot of this is actually observated from people but no one tells you the risk i mean when wormhole was announced there was a poster saying that it was like super trustless and and trust minimized and secure and it's like well i mean when it was when it first came out you can't even you shouldn't even be claiming that like it you should be saying this is probably not secure this may not be secure because this is

new please be aware of the risks there's these controls in place this and this could happen something like what l2b does for all the l2s right where they have like a full breakdown but there are some ecosystems out there that just don't care about this i mean iom responded to one of carl simani's tweets from a few weeks ago who he's big in the solana ecosystem where he basically said uh he values speed over security and then i i hit back today and i said you still value speed over security and he said yes and i'm like well that's just wrong like i actually i'm pretty disgusted by that reply because why what's the use of having speed if you don't have security and things just keep getting exploited and users keep getting hurt that's why ethereum ecosystem moves slower that's why l2s move slower that's why

a lot of the projects move slower because it's much better to be secure then then to kind of like get to market really quickly and then your your app gets exploited and no one wants to use it anymore and use people you lose money and all that sort of stuff so for me i always value security and as a byproduct of securities decentralization over speed and by speed i mean like speed of shipping thing speed of kind of like getting things to market when you're dealing with people's money especially on a network where you can't reverse the transactions this isn't like the tradify system where they can reverse the transactions you can't reverse stuff that happens here when you're playing in that environment in such an incredibly adversarial environment you can't be speedy you have to be secure first that is the number one priority i think for

every developer building anything in this ecosystem is security yes you can be fast to ship which is fine but we've seen the perils of that right i mean i remember back in default summer andre was referred to as basically a god because he could ship so quickly and it was a meme that he was testing in prod which basically means he was testing his smart contracts on ethereum mainnet and not a test net but then came the eminence finance debacle which resulted in i think half the funds being lost or something like that and then he went quiet for a little bit and researched recently he's been doing a bunch of stuff and then again in the frog nation kind of ecosystem uh there was there was stuff that happened there as well so just i think valuing security over everything else is is very prudent in

the in the crypto environment and i think it's something that everyone should be doing and i'm actually i honestly i am disgusted by people who double down on speed over security like i really don't appreciate that i don't respect people who have that opinion and i really don't believe that it is opinion that um that you guys should have either so uh you know ethereum may move slower but there's a reason why ethereum moves slots because it is trying to be very secure it's trying not to mess anything up i mean could you imagine if we rushed the merge and something went wrong like seriously guys you can see what i mean here anyway i'm ranting a little bit now but i think it's just always good to kind of reflect on these things and reflect on i guess like why we care about decentralization why we care about

security uh because these things happen they happen all the time this isn't something new exploits happen all the time but we can minimize the risk of this by ensuring that we build uh great software and the only way to do that is by taking our time you cannot build great and secure software by going quickly it's just that they're incompatible things because by going quickly you miss something there's things you can i mean the dow bug was actually i believe one line or something like that in in the code that resulted in all those funds being um kind of uh kind of uh exploited and then the chain having splitting off into ethereum and ethereum classic and there being like a regular state transition to get the funds back it was a mess right and these things happen because there's just not proper

care given here so yeah anyway i'm gonna leave my rant at that as i said you can read this tweet from samsung for a technical breakdown of exactly what happened here i'll link it in the youtube description there was also one as well from uh calvin victor i don't have it on hand here he had a really great one it was pretty lengthy as well so you can go give that a read as well all right so on to some more positive news today i just saw this before actually it got lost in all the chaos but peter from the guest team put out a tweet where he said although not really visible from the outside the go ethereum or geth codebase is one major pull request away from being ready for the merge and that pull request itself is also done just needs tests tm

so close guys like i mean holy crap i can't stress to you guys how close the merge actually is at this point i know i know june if it goes ahead in june i know june may seem a little bit far away still because we're only in february but i mean we're in february already like where did january go like you know what i mean i mean where did christmas go where did the holiday period go it's already over before you know it we're going to be merged we're going to be on a full proof of stake ethereum network and i'm not going to have to keep telling you guys um you know updates about the merge anymore we can get back to going about uh uh giving you updates on things like shanghai with all those new aips coming in working on sharding working on these

things that you know users are actually gonna get massive benefits out of especially at the layer two side so that's actually one of the reasons why i'm most excited about the merge not only because we're finally going to be a proof-of-stake network it's just getting it out of the way right because it's something that kind of like is critical needs to be done but it is something that's holding up everything else and obviously people are excited about all these other things coming to the network and especially other things that are user-facing i mean just erp 4488 um making core data cost uh uh less and and giving more five times more scalability to roll-ups that's a that's a thing that's immediately felt by end users we all feel that at layer two we will have cheaper fees immediately just like when armatum optimism uh uh reduced their

fees we all feel that whereas with the merge realistically the end users aren't feeling anything from this i mean to them they're still gonna be doing the same transactions blocks are going to be coming in slightly faster at 12 seconds versus 13 seconds it's probably not going to be noticeable for most users and the fees are still going to be the same as i said to you guys the merge it does not lower gas phase you know it's my pet peeve but from an end user perspective just a regular end user nothing changes right but um for for the other upgrades they do and that's why we care about those other upgrades there so so yeah really really cool to see this from peter as i said two guys like merge is coming along really nicely i'll keep you guys updated with it uh but i didn't even

know about this so i'm glad i saw this tweet just before so superfizz has pulled out a call to action around client diversity here where he says eat steak is looking for a few folks to formally enumerate the scenarios that can happen at client distribution thresholds due to slashing state transition bugs liveness failures and unknowns analyzed from both the angle of network health and the loss of staker funds as a token over appreciation will offer grants ranging from 500 to 2000 usdc as well as an appreciation pop but if you know what's going on you're going to you're just going to do it because successful ethereum depends on your efforts and there's a little bit of a thread here with some links so if you're interested in doing this definitely jump into the eat stake of discord uh kind of like check check it out there get in

contact with superfiz maybe and he can help you out with that uh but yeah i mean i've been talking about client diversity a lot recently as i said there's lots happening on this front right now especially in the background i'm aware of a few different initiatives happening here um if you're a user on prism obviously you have the if you have the ability to do so changing to another client is what you should do actually i just got my staking box set up today uh in in my house then i'm talking about staking in my new house because because i've got incident now finally like i went back to my old place and i looked at it it was still running right still going all well i looked at it i'm like my baby it's finally i can finally take you home and then it's just oh just i just love

watching it chug along i just love watching my validators purr and it's all well and good there but anyway that little tangent there uh just getting contact with the sega community or super fears if this sounds like something that you're interested in doing it can have a big impact on the ethereum staking community here so a rainbow announced today that they have uh initial support for polygon nfts rolling out so some of the most popular polygon nft collections will begin appearing in your wallets if you own them these include things like zed run showtime royale here and 100 thieves which actually dropped today so 100 thieves is a massive kind of like gaming and entertainment kind of like initiative here uh absolutely huge they've got one over one million followers and they announced today that they're actually doing nfts on polygon

uh called the hundred thieves companion companionship ship chain so they're they're free to claim are not intended for resale same carbon impact they're sending two emails because they're on the polygon post chain obviously uh and they're actually even still i think they still said they're gonna cover gas fees too um which is funny because like the gas fees are like negligible and polygon but it's cool that they're doing that uh but yeah that was kind of like something that you guys may know about 100 thieves they've been around for a little while pretty big esports kind of like uh um project as well but i used to loosely follow this stuff when i was more of a gamer uh but rainbow is supporting this as well in their wallet so if you haven't checked out rainbow wallet yet i mean i've talked about them a lot

recently on on the refuel because they had their android release uh last week i believe you should definitely check it out whether you're on ios or android you know it's a good wallet i like i enjoy using it whenever i use member wallets but as you guys know i don't use mobile wallets too frequently i'm desktop maximalist basically because i'm on my computer all the time i don't really get out much especially during covert but uh anyway uh definitely go check that out so dune analytics has announced that they've raised sixty nine thousand four hundred and twenty million dollars in a series b funding round led by koter this values are due analytics at a billion dollars now which is absolutely massive uh i'm sure most of you know what dual analytics is at this point i should actually disclaim here and say i'm a

seed investor in dune they've been around for a while i absolutely love them i use it all the time like pretty much every day i don't build the dashboards myself but i look at other people's dashboards there's so many on there um so yeah i guess congrats to them on this race it makes them a unicorn now which is absolutely amazing for those who don't know unicorn is a company uh that is worth a billion dollars or more uh there's uh there's obviously not like a lot of those in the world so really awesome to kind of like see this and i mean it's just been awesome to see the dune journey like as time has gone on they've obviously um grown a lot since uh their early days but it's funny because i think when i invested in them in their seed round i think it was early 2020 i

believe sorry early 2021 i believe yeah yeah early 2021 um and then they've just come so far since then like less in less than a year they've just gone you know series b massive series b one billion dollar evaluation but also their platform and their app is being used uh by so many people and you know i think crypto analytics data analytics as i've said to you guys before is a massive area i mean nansen recently announced their fundraise as well which valued them i believe it they're around the same uh and then there's a bunch of other kind of like uh uh projects out there or kind of like tools out there that are that are working on on getting data from blockchains and because really blockchain i mean people used to say like data was the new oil but i think that blockchain data is like

worth even more than just normal data because you have financial data in there right there's a lot of insights you can gain from it i mean if you use these tools you can actually gain a lot of trading insights too and you can actually make money off this uh and even investment insights so very very uh uh very very useful tools uh and there's plenty plenty of dashboards as i said to you guys i look at these dashboards all the time there's dashboards for pretty much every project out there anyone can create them um they're pretty simple to create it just uses sql so if you know that you know how to create a dashboard um but uh yeah enough enough of me gushing over them here as i said i am a seed investor so i'm i'm uh i'm pretty happy about this uh uh and then becoming

a unicorn and everything like that but uh great to see this congrats to them on that one uh but yeah i think uh i've got a fair bit of time left here i think i have about like seven or eight minutes left here to talk about something um i think i mean i talked about the bridges stuff a lot and i think related to the to the bridge stuff related to kind of like smart contract exploits and things like that and related to what i spoke about i think yesterday before with regards to the markets i think when looking for new opportunities in crypto to get involved and i wrote about this in the newsletter the other day but when looking for new opportunities to get involved both financially and socially and professionally um there's just so much going on right now i can kind of like give you a bit of

decision paralysis right i know that there's you know a million things going on the nft ecosystem so much even innovation going on in d5 the core protocol has never been more active you know if you want to work there uh and there's just kind of like all types of roles around that as well and the thing is is that you don't have to be a developer at all you can do business development you can do marketing you can do community you can do design you can do legal whatever you want to do there are positions everywhere for you so i mean if you're kind of like stuck and don't know what you want to do i think you just really need to figure out where you're spending most of your time just naturally kind of like see over like the last month say just look back and say

okay where have i spent the most most amount of time like what ecosystem have i spent the most amount of time in in the last month let's say you spent most of it in the nft ecosystem okay did you enjoy it would it be something that you'd like would actually like to do professionally do you think that there's a lot of upside there for you both professionally like in your career or and also financially yes well look at who's hiring right there's plenty of startups hiring i mean you can go work for polygon studios which is polygons nft arm you can work for immutable x you can work for one of the other kind of like nft uh projects out there open c looks rare probably hiring i haven't seen but i'm assuming they are there's so many different kind of like projects out there uh hiring in the nft

ecosystem and you can go to the cryptocurrency jobs website as well and check out all the roles there um but that's that's what kind of like you should do i think that's can help a lot with decision paralysis because sometimes you'll be sitting there and you'll be like oh my god there's so much happening i love nfts i love defy i love uh i love core protocol development but the thing is is that you can't do it all like you can be a generalist and that's fine but a generalist uh i mean you know you can't like work for i mean okay i shouldn't say you can't you can probably work for two or three projects depending like if you're part-time but if you want to go like full-time and give a project your all you i mean really it's only going to be that project right and you're just going

to be working for once you so if you're working for an nft project it's going to be hard for you to keep up with with defy stuff and and things like that i mean take it from me it was very hard for me to keep up with stuff when i was working at set and that's one of the reasons why i stepped down from full-time work because i felt i really needed to devote all my time to keeping up with ethereum and kind of like doing education through the daily wear obviously and athub as well of course uh and everything else that i'm kind of like doing on the sidelines too um but like i think you just got to pick something stick to it and if you end up not liking it you can always change as i said there's so many kind of like roles

going on right now and people hop from team to team all the time and there's no hard feelings here like if you're not feeling it at a team then you shouldn't be there in the beginning with because not only are you kind of like making yourself feel worse but you're potentially bringing the rest of the team down as well because of the fact that you may just may not fit there and this happens right like you're not gonna fit in every team that you join um whether it's a culture thing whether it's a kind of like you're just bored by the work thing whether it's you don't believe in the project anymore thing you know there's plenty of that stuff going on as well there so just a little bit of advice there on like how to get involved um but like if you're maybe month to month you're

changing what you're most kind of like uh interested in it i mean that might make it a little bit harder for you to choose something to kind of like stick to but still i would still try to like rack your brain and say okay what gets me excited what gets me out of bed what actually motivates me to do stuff and outside of money i'm talking take money out of the equation completely are you excited about what you're doing even if you weren't getting paid for it and if you are i mean that's a passion and then you can chase that and kind of like get a get good insight from that uh anyway i'm gonna leave it at that for today so thank you everyone for listening and watching be sure to subscribe to the channel if you haven't yet give that video a thumbs up subscribe to the

newsletter join the discord channel and i'll catch you all tomorrow thanks everyone