BDFL of Quilibrium, Eng @ Farcaster, ex-Coinbase, always opinionated, never hydrated

/quilibrium

cookin' @askgina.eth https://askgina.ai, @consensys class '17

MPC in the head was one of the more contentious issues of the protocol, serving as a zkp which essentially runs the entire MPC exchange "in the head" of the prover, creating a transcript of the work to sufficiently convince a verifier that the result is correct.

For the token application, this is fine, as token interactions are all-or-nothing, so transcripts can be pruned. But a clever attacker could generate extremely laborious proofs to do very little to impact data, but stacks sufficiently that the state growth becomes large enough that it could limit the issuance curve, with a runaway effect if they did it in bulk, making the issuance rate for tokens effectively stop for the current generation.

out of curiosity how was this discovered?

good catch though, toughie

Cyber Security Student, 5 Year of Exp in Web3. Ex Opera Crypto Moderator. Sticker Artist. Farcaster OG #596.
X @thaspy007

The nice part is, the fix is better than where the problem came from. Arguably I should have done this from the start. Good thing the modular architecture made swapping this in straightforward.

I was like what nooo and then okay we are good and goodluck to the team 🫡

I hope this get fixed without any other complications or creating a new loophole

Not at all, just needing to address this prior to rollout

Yes, this is more a denial of service (or denial of future earned tokens) attack, not letting that happen 🙂

NFT Collector | Crypto Trader | OGs Holder

Alhamdulillah 

There was no risk of invalid fund creation. The risk was preventing new funds from being legitimately issued

Thank you for the update.
It's good to know that the risk of invalid fund creation has been mitigated. We appreciate the efforts being made to address the issue and look forward to hearing more about the alternative integration and updated ETA. Please keep us posted on further developments.

Always appreciate you letting people know what’s up ASAP

Keep up the work Cassie👌🏾

These dying minute problems can't stop you💜

I was wondering why there was no update after your cast the other day, glad it was realized

Is this MPC-in-the-head proposer meant to increase security?

It’s massive, you were able to figure this out
The team is working on 10 toes

i don’t fully understand, so we hold off on interacting?
can you simplify a bit

Crypto still deploying money tech like a video game I see.

Glad it was discovered in time,
ETA for upgrade?

You sure everything is as it should be now?

Oh damn!
Kudos to you for detecting and putting a stop to this