Umrhwebi Ulahlekelwa yi-26M yeedola kwiiMpawu ze-EZETH: I-Media Blames User, i-Hacker ibiza i-ERC-20 iimpazamo

• Igama lam ndinguDexaran. Ndingumqweqwedisi, ndiyilwe ndaze ndaphumeza olona hlaselo lukhulu lwenqanaba lemvumelwano kushishino . Ngo-2019 I-DDOS'ed EOS inethiwekhi ye-mainnet kwaye ndayimisa inyanga yonke ngokusebenzisa isiphene kwimodeli yayo yokubonelela ngesivumelwano. I-EOS yayibekwe kwi-top7 ngelo xesha. ( Ingxelo ye- EOSGO , ingxelo yoluntu )

  
  

• Ndingumseki welinye lamaqela aphambili e-Ethereum Classic . ( inqaku leCointelegraph )

  
  

• Ndiyile i -Amendment to Nakamoto consensus , isethi yemithetho exazulula ukuhlaselwa kwe-51% eyayisisibetho soshishino lwee-POW chain.

Ingozi

Umsebenzisi ulahlekelwe yi-26,000,000 yexabiso lamathokheni e-EZETH ngokuwathumela kwi-smart-contract. Kukho amanqaku amaninzi kunye nemisonto ye-twitter ebanga ukuba le nto yayiyimpazamo yomsebenzisi, umzekelo lo nguCoinTelegraph .

Oku akulunganga. Impazamo efanayo yomsebenzisi ayiyi kubangela ukulahlekelwa kwe-Eth, NFT okanye ithokheni ye-ERC-223 . Ukutshintshela kwiidilesi zangaphandle kunye nokudluliselwa kwiikhontrakthi ezihlakaniphile zisebenza ngokwahlukileyo.

Ukuba umsebenzisi uya kuthumela amathokheni kwidilesi engalunganga (engeyiyo i-smart-contract) okanye idilesi engenaye nabani na - oko kuya kuba yimpazamo yomsebenzisi.

Kule meko, nangona kunjalo, umsebenzisi ubeke iithokheni kwi-smart-contract. Iikhontrakthi ze-Smart kufuneka zithintele ezi mpazamo, kwaye ngokuqinisekileyo ziyakwazi ukwenza oko - umzekelo ukuba umsebenzisi uza kufaka i-Etere (okanye nayiphi na enye imali yemveli), i-NFTs (ERC-721) okanye i-ERC-223 iithokheni kwi-smart-contract leyo. yayingenzelwanga ukuba izamkele - ke imiqondiso yayingayi kulahleka. Kuya kubakho impazamo yentengiselwano kwaye ukuhanjiswa kwamathokheni bekungeke kwenzeke.

Ukuphathwa kweempazamo ngomnye wemigaqo esisiseko yokhuseleko lwesoftware. Ukuyila isoftwe ngendlela yokuba kungenzeki ukuphatha kakuhle iimpazamo zesibongozo kuyafana nokusilelayo onlyOwner Isilungisi soMnini somsebenzi wolawulo-inokuba yingxaki yokhuseleko leyo.

Le yingxaki yomgangatho we-ERC-20 — uyilwe ngendlela eyenza ukuba ukusingatha iimpazamo kungenzeki. Kwaye le yingxaki yokhuseleko. Umgangatho we-ERC-20 awukhuselekanga . Ngo-2023, umdali womgangatho we-ERC-20 ngokwakhe uqinisekisile ukuba lo ngumba wokhuseleko lomgangatho .

Ndiye ndabika ngo-2017 apha napha . Kwakhona, ndiyile umgangatho we-ERC-223 ukusombulula le ngxaki ngqo kwi-2017, nantsi intambo ye -EIP-223 yasekuqaleni apho igxininiswe ukuba lo mgangatho uthintela ukulahlekelwa yimali.

Yindlela elula kakhulu kwiinkampani zokhuseleko kunye nabaphuhlisi ukugxeka abasebenzisi ngokwenza impazamo. Nangona kunjalo, lityala lomphuhlisi ukuba bakhe izicelo zabo besebenzisa umgangatho ongakhuselekanga osilelayo ukujongana neempazamo zabasebenzisi ezibangele umonakalo onjalo.

Imbali

Ndiye ndagxininisa ukuba oku kunokubangela umonakalo wemali kubasebenzisi ngelixa ingxelo le Ethereum Foundation. Abazange benze nto. Kwiminyaka eyi-7.

• Kwakukho i-$ 16,000 elahlekileyo ngenxa yalo mbandela kwi-2017.
• Kwakukho i-$ 2,000,000 elahlekileyo kwi-2018
• $60,000,000 ngo 2023
• Ngomhla woku-1 kuNov, 2024 bekukho i-90,000,000 yeedola (ngaphandle kwe-25M elahlekileyo kwikhontrakthi ye-ezETH)
• Ngoku kukho i-115,000,000 yeedola

Iqela lam liphuhlise iscript esibala isixa seethokheni ezilahlekileyo:

https://dexaran.github.io/erc20-losses

• Ngo-2017 omnye umsebenzisi ulahlekelwe yi-130K.
• Ngo-2020 umsebenzisi uphulukene nogcino lobomi bakhe.
• Ngo-2023 umsebenzisi ulahlekelwe yi-$240K kwintengiselwano enye.
• Emva koko i-hacker ye-Poloniex ilahlekelwe yi-$ 2.5M.

Ndicele ukuyeka ukukhuthaza umgangatho we-ERC-20 ngenxa yalo mbandela wokhuseleko kwi-2017, akukho mpendulo https://github.com/ethereum/ethereum-org/issues/755 .

Ndiye ndawunyusa lo mbandela ku-EthereumCatHerders, abo bafana abalawula ii-EIP e-Ethereum.

Ngo-2023 baphendula bathi “asinanto yakwenza nokubhengezwa kokhuseleko, asinankqubo yaloo nto”.

Ingcaciso: Ii-EIPs kunye nee-ERC ziziphakamiso ukuba nabani na angazingenisa kwi-Ethereum. Banokuba yimigangatho okanye uhlengahlengiso olusebenza kwi-devs kwindlela i-Ethereum esebenza ngayo. Ziifayile ezibhaliweyo kwi-github repo yazo.

Umxholo: abanayo inkqubo yokujongana nokuvezwa kokhuseleko kwi-EIPs iminyaka eyi-10 emva kokuqaliswa kweprojekthi ye-Ethereum.

Bendicebisa indlela yokuguqula indlela ii-EIPs ezisebenza ngayo ukuvumela ukubhengezwa kokhuseleko: https://ethereum-magicians.org/t/modification-of-eip-process-to-account-for-security-treatments/16265

Ndicebise ukuba ndongeze isilumkiso kwi-ERC-20 kwaye ndibhale umcimbi kwii-EIPs. Nalu umnxeba wabo, apho bagqibe kwelokuba kufuneka ndihambe ndenze enye i-EIP yolwazi eya kubhengeza ukuba sesichengeni kwi-EIP-20: https://github.com/ethcatherders/EIPIP/issues/257#issuecomment-1693372317

Ndenza oko. Bayikhabile i-EIP yam yokuxela emva koko.

Ndeza nesiphakamiso sokuvuselela ingcamango yam yokuqala endiyichaze kwi-forum ye-EthereumMagicians eya kuvumela ukuvezwa kokhuseleko kwi-"Ingqwalasela yoKhuseleko" kwicandelo le-EIPs kwi-2024 kwakhona.

Nantsi ingxoxo yam nabahleli be-EIP: https://www.youtube.com/watch?v=PKkJNqcozhw&t=744s

Njengesiphumo abahleli be-EIP bandixelele ukuba bazokuvota kulo nto: https://github.com/ethcatherders/EIPIP/issues/349

Isindululo sam siye savotelwa. Akukabikho inkqubo yokujongana nokubhengezwa kokhuseleko kwii-EIPs. Ingxaki ye-ERC-20 ayilungiswanga. Ayixelwanga okanye ibhalwe njengengxaki ukuze abaphumezi baqhubeke beyivelisa ngokuphindaphindiweyo.

Abaphicothi-zincwadi abangalunganga

Mna ngokwam ndichaze lo mbandela kwi-OpenZeppelin, ndicela ukulungiswa kwamaxesha ama-3.

• Ngo-2018 https://github.com/OpenZeppelin/openzeppelin-contracts/issues/729

  
  

• Ngo-2023 https://github.com/OpenZeppelin/openzeppelin-contracts/issues/4451

  
  

• Emva kokuba bekhabe ezi zimbini zangaphambili, ndigqibe kwelokuba ndiyixele ngendlela eza kubonisa ubunzulu balo mba, ndiye ndawungenisa kwi-bug yabo ye-bug kuba ingena “kwi-critical security vulnerability” ngokwemigaqo yabo https:/ /github.com/OpenZeppelin/openzeppelin-contracts/issues/4474#issuecomment-1646901022

I-OpenZeppelin iyala “ngobhengezo loluntu lobuthathaka obungafakwanga” (obuqinisekisa ukuba le yingxaki yokhuseleko ubuncinci).

Kwiintsuku ezimbalwa ezidlulileyo kwi-Devcon7, umbuzo wabuzwa kulo mfo usuka ku-OpenZeppelin ovale umcimbi kwi-github yabo malunga nale ngxaki: https://www.youtube.com/watch?app=desktop&v=DKJYpdXsOwQ&start=406

Iminyaka eyi-6 emva kokuba ixeliwe kwaye emva kokuba ibangele ilahleko ye-115,000,000 yeedola kubasebenzisi bayo.

Impendulo yabo ayiyonyani. Endaweni yokuba nomcimbi ovulekileyo, bavala imiba emi-3 endiyivulileyo kwaye bakhaba naziphi na iingcebiso endizenzileyo.

Ukuqukumbela

1. I-Ethereum Foundation inqanda nayiphi na imizamo yokugqamisa ingxaki, eyabangela ukuba abasebenzisi be-ecosystem balahlekelwe yi-$ 115,000,000. Ingxaki ayichazwanga, ukubhengezwa akusingathwanga ngokufanelekileyo, abaphumezi baqhubeka beyivelisa kwakhona kwiikhontrakthi ezintsha.

   
   

   Ndicinga ukuba bacinga ukuba kuya kuba yingozi kakhulu ukuba isidima sabo siyiveze.

2. Abaphicothi-zincwadi abafana ne-OpenZeppelin abawuvezi umcimbi ngokunjalo, mhlawumbi ngenxa yokuba bangquzulwano lweminqweno njengoko sele bebeke ileyibhile ethi “Khusela” kumakhulu eekhontrakthi ze-ERC-20 abaziphicothile.

   
   

3. I-Devs ithi "Siphumeza umgangatho ngendlela oyiyo."

   
   

4. Umgangatho ulawulwa yinkqubo ye-EIP, inkqubo ye-EIP ayakhiwe ukujongana nokubhengezwa kokhuseleko.

Inkqubo ye-EIP kufuneka itshintshwe. Umba we-ERC-20 mawubhengezwe kwaye ubhalwe ngokufanelekileyo. Ngokufanelekileyo, umgangatho omtsha kufuneka uphunyezwe. Ukusebenzisa iseti yee-"bandaids" kwi-ERC-20 ukunciphisa umonakalo kungcono kunokungenzi nto, kodwa bekungayi kusombulula ingxaki nganye.

Wonke umntu othi "ingxaki ingasonjululwa kwinqanaba le-wallet" akanalo ubuchwephesha bokhuseleko. Kukho umgaqo wokhuseleko ngoyilo kukhuseleko lwesoftware nto leyo ethetha ukuba awukwazi ukwakha isiqwenga sesoftware engakhuselekanga, xelela wonke umntu indlela yokuyisebenzisa ukuze ingabi nampembelelo kubasebenzisi bakho kwaye wenze ngathi ayizukwenza monakalo. Hayi kwishishini lezemali. Loo ndlela inokusebenza kuyilo lwewebhu, umzekelo, apho ixabiso lesiphoso ngumntu ongakwaziyo ukulayisha ifonti efanelekileyo kwiphepha labo lewebhu. Kwishishini lezemali oku kukhokelela ekulahlekeni kwezigidi zeerandi.

Akunakwenzeka ngokupheleleyo ukuqinisekisa ukuba bonke abaphuhlisi be-wallet kwikamva lonke lempucuko yabantu baya kuhlala bephumeza ngokufanelekileyo zonke izilungiso eziyimfuneko.