All eyes are on Ethereum - we are now less than four days out from the merge. We’ll talk about some possible scenarios the merge might bring and what you can do to stay safe during the merge. We’ll also look into recent updates on the Tornado Cash sanctions, a new report on fraudulent crypto trading volume, and other crypto security-related news.

Show Notes

I, Degen - E14: All Eyes On Ethereum - 9/11/2022

Listen at: idegen.fm

Full show notes with images on HackMD - https://hackmd.io/@idegen/E14-All-Eyes-On-Ethereum

Intro

Welcome to I, Degen - A podcast about crypto technology, security, and culture. With a healthy balance of enthusiasm and skepticism, we dig into a weekly look at crypto, cutting through the misinformation and hype in search of signal in the noise.

Episode Summary

I,Degen - Weekly

Cryptosphere

From August 23rd, SudoRare, a LooksRare clone rugs 820K after just 6 hours of operation Rugged funds likely moved to a KYC’d address on Kraken.
SudoRare, an NFTplatform that forked from SudoSwap and LooksRare, is just the latest crypto project to run off with users’ funds. The project also deleted all of its social media accounts Tuesday morning. -
Coinbase launches Liquid Staked derivative (LSD) cbETH ahead of the merge - [1][2][3]
Earn 1 MIL if you can find a good bug in Ethereum before the merge
August 26th, 2022 - Tailiban Outlaws Crypto in Afganistan and begins arresting sellers that refused to comply Bloomberg article
Password managment first LastPass had it’s developer systems hacked to steal source code
According to Forbes, more than 1/2 of all Bitcoin trades are ‘fake’

The U.S. Commodity Futures Trading Commission defines wash trading as “entering into, or purporting to enter into, transactions to give the appearance that purchases and sales have been made, without incurring market risk or changing the trader’s market position.” The reason why some traders engage in wash trading is to inflate the trading volume of an asset to give the appearance of rising popularity. In some cases trading bots execute these wash trades in tokens, increasing volume, while at the same time insiders reinforce the activity with bullish remarks, driving up the price in what is effectively a pump and dump scheme. Wash trading also benefits exchanges because it allows them to appear to have more volume than they actually do, potentially encouraging more legitimate trading.

“Fraudulent or non-economic”

The biggest problem areas regarding fake volume are firms that tout big volume but operate with little or no regulatory oversight that would make their figures more credible, notably Binance, MEXC Global and Bybit. Altogether, the lesser regulated exchanges in our study account for approximately $89 billion of the true volume (they claim $217 billion).

On Forbes method:

We apply volume discounts based on a proprietary methodology that relies on 10 factors such as an exchange’s home regulator if any and volume metrics based on an exchange’s web traffic and estimated workforce size.

So, private trading firms numbers are being grok’d by proprietary methodology.

Worth note, the Bitwise Study from early 2019 said 95% of BTC trading was fake… so it’s getting better.

In case you’re interested in this topic, here is another nice paper from 2019 that talks about fake BTC trading

spoiler! -New Netflix show on John Mcafee rasies questions about his death - supposedly he called his ex-gf after his ‘death’ to say he faked it.
Australia Establishes Federal Crypto Police

Launched in August, the unit will help combat crypto criminals by targeting their assets and providing investigative tracing capability and insight to other AFP authoritiesThe new crypto unit will operate as part of its Criminal Assets Confiscation Taskforce (CACT), which has been seizing illicit crypto funds since 2018, but without a dedicated standalone teamThe Australian Federal Police have confiscated over AU$600 million (US$408 million) in illicit funds and property since 2020, and though the amount of crypto funds seized were small compared to “traditional” criminal assets, the additional focus helps provide intelligence insights

Solana didn’t go down this week - high TPS spike that might have caused a network outage before, didn’t cause one this time.
September 5th withdrawals frozen at crypto mining firm Poolin because of a lack of liquidity - From theBlock.

Poolin, one of the world’s biggest crypto mining pools, is suspending bitcoin and ether withdrawals from its wallet service due to “liquidity problems.”

And now, from September 9th Bitcoin hash rate cut in half as miners leave

This is significant because 1) Poolin is a China-based mining pool service, operating in China after the mining ban, and 2) the pool was estimated to have roughly 10% of the hash rate before withdrawals were suspended.

Flash Loan used against single NXUSD market on Nerus

At approximately 10:30PM UTC on September 6th, the Nereus team notified the community of an incident through the community discord; this was later picked up by CertiK and other on-chain analysis groups and reported broadly as a flash-loan exploit resulting in a $371k gain.An exploiter was able to deploy a custom smart contract and that leveraged a $51M flash loan to manipulate the AVAX/USDC Trader Joe LP pool price for a single block resulting in the ability for the exploiter to mint 998,000NXUSD against ~$508k worth of collateral.In the hours that followed, Nereus quickly consulted security experts, developed a mitigation plan, and notified law enforcement to support efforts. In response, the Nereus team has mitigated the exploit by liquidating and pausing the exploited JLP market.The team has also paid off the bad debt using NXUSD from the Team’s treasury. No users funds are at risk, and NXUSD continues to be over collateralised.In addition, no part of the lending and borrowing protocol was ever at risk.

Tornado Cash Sanctions Update
- 1. Coinbase Bankrolls Suit Against Treasury Department over Tornado Cash Sanctions - Basis/premise is that OFAC is overstepping because a smart contract is not a person or org.
- This CNBC article is quoting the ‘7B laundered using TC’ which as we’ve discussed is not an accurate number.
- some members of the suit have coins locked in TC
  1. Base Layer Neutrality Sept 8th, from Paradigm
- On August 8, 2022, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) added certain Ethereum addresses associated with Tornado Cash, an open-source privacy protocol on Ethereum, to the Specially Designated Nationals and Blocked Persons List (SDN List).2 Since the announcement, many participants in crypto’s base layer have expressed concern that they could be required to monitor or censor blocks involving SDN List addresses to comply with sanctions, jeopardizing the neutrality of the base layer and compromising its integrity and core functionality. However, we believe that under current OFAC guidance, base layer participants are not required to monitor or censor these addresses as part of a risk-based sanctions compliance program.
- Specifically, while the application of sanctions law to decentralized blockchain systems and smart contracts presents novel legal issues, we believe the Tornado Cash sanctions and blockchain address sanctions imposed to date should not require blockchain technology infrastructure providers including builders, pool operators, relays, searchers, sequencers, and validators to monitor or censor transactions that involve blocked addresses.
  1. Tether will not block Tornado Cash addresses (yet) [1]
  2. [1. Tornado Cash dev Alexey Pertsev alleged links to Russian FSB] [2. - The Actual Report] [3. - US Treasury Press release from 2018]
  3. Digital Security was designated pursuant to E.O. 13694, as amended, for providing material and technological support to the FSB. As of 2015, Digital Security worked on a project that would increase Russia’s offensive cyber capabilities for the Russian Intelligence Services, to include the FSB.
- *Alexy worked at Digital Security in 2017
August 29th, Solana DeFi Exchange Optifi Bricks Itself By Running Solana Shutdown Program Command During Upgrade and Loses 661K

@OptifiLabs

95% of the inaccessible crypto funds were held by a member of the team.
They are returning the remaining funds to customers

I, Degen - Weekly Deep Dive - All Eyes on Ethereum - What need to stay secure during the merge

Respond, Don’t React - It could get crazy, don’t panic.

Should I move my coins to an exchange? No, why would you?

ETHPoW Fork led by Chinese miner Chandler Guo has confirmed it will use a unique chainID, this means replay attacks shouldn’t be an issue.
What is a replay attack?
What about other forks that don’t change their chainID? Don’t interact with them if you want to be safe. If you’re really concerned consider not making any mainnet ETH PoS transactions immediately after the merge as well as those TXs could be replayed on one of these random forked chains. Of course, the worst case would be that your TX from mainnet can be replayed on the random forked chain which wont affect your mainnet/real assets.

Some info from Decrypt on what to expect with NFTs around the merge

General confusion and scams likely - be careful if you’re interacting with an exchange or NFT market place that supports one or more forked ETH chains. Best bet is to stick to reputable exchanges who are unlikely to even support ETHPoW. True PoW heads will likely just stick with ETC right?
Various apps and protocols both centralized and decentralized have said they will pause some or all elements of their protocols around the merge just to be safe. This could cause unexpected issues even if the merge it self goes off with out a hitch.
If you’re a hacker or trader looking for an edge, the merge will likely offer some attractive, once-in-a-lifetime style opportunities.

If you’re not an advanced user willing to take on the high risk, your best is to do nothing.

I, Degen - Other Random Stuff

Reminder, guys, never take yourself too seriously. This is pretty funny…

I, Degen - Personal Hack Attempt of the Week

Email enumeration for Zeevo:

What’s going on here? Either bot building a list for marketing spam or email address enumeration for phishing attack?

What’s not show in the screen shot is email addresses they were sending too. They were not random but instead lined up with accurate shortend verisions of my name. That would imply manual operation behind the probe or that the data was scraped and fed to a bot. I kind of suspect the latter and have a hunch it was from Angel list’s website but that’s just a guess.

[[[Outro]]]

We do our best to report accurately on the topics we discuss but we’re not always going to get everything right. Please comment here or reach out to us @idegenfm with corrections or comments!

Select a repo

What is I, Degen?

Welcome! I, Degen is a podcast about crypto technology, security, and culture. With a healthy balance of enthusiasm and skepticism, we cut through the misinformation and hype in search of a signal in the noise. Our weekly round-up will keep you updated on the latest in crypto hacks and security. With our open-source audio audits, we interview founders and hackers to surface relevant info about how to stay safe in crypto land.

I, Degen

More episodes