cyph3rPunk@infosec.pub

cyph3rPunk@infosec.pub

There is only one person with liquidity on Spectrum. To have them not lose their ERGs in liquidity they need to withdraw before we send refund ERGs. Furthermore, anyone with hodlErgs in contracts might be problematic.

From Bruno Woltzenlogel Paleo (@Ceilican)

Hi everyone. We (@kushti_ru @Pulsarzz @ceilican) spent the last several hours investigating what happened. We have discovered how the vulnerability found its way to the contract. We have implemented a fix. And we have implemented tests to ensure that the fix works.

To know more, please read on.

From the start, we worked hard to try to ensure that the contract was vulnerability-free. This is visible in our commit history. Almost every commit there makes the code simpler and easier to understand, so that it would be easier for us or anybody else to reason about the code, instead of simply having to trust that it does what we claim it does.

It is visible in our commit history that we did our best to ensure that:

refactoring/simplification commits did not change the logic of the code
commits that did change the logic of the code were carefully considered by all of us and made the code more correct.

This commit likely fixed a vulnerability, as discussed in the code comment there.

Unfortunately it also introduced a vulnerability. It turned reserveDelta to what it should be, but a different part of the code was expecting it to be something else. That different part of the code was a condition that, due to this commit, become tautological (i.e. always true, and therefore unnecessary) and, consequently, was removed in [this commit] (https://github.com/pulsarz/hodlcoin-contracts/commit/a8fbc5bb14f966770ec197bb7279a92653fc21db).

The problem has been fixed in this commit.

A test to ensure that the vulnerability does not occur anymore was implemented here.

We are immensely thankful to Krasavice Blasen, who found this vulnerability and who decided to drain the ERGs from the contract and return them to the users, instead of exploiting the vulnerability for his own personal gain.

Before re-deploying the project, we will:

write more “negative” tests (of transactions that ought to be rejected by the contract)
review the code over and over again, once again.
keep our code and its history available to the community for further inspection. The latest version, with the fix, is available here.

We invite the entire community to review the latest version of the contract as well and contribute with commits that improve the code and fix any other eventual potential vulnerability.

Where did HodlCoin come from?

Was some demand in the community for some degen finance. Kushti wrote up this concept

But then Bruno from Djed (Worked at IOG during the design - not COTI) shared an idea with him and he connected him with Pulsarzz to get it up and running.

Yes. It dates back to 2020, actually. :-). I was trying to simplify the design of Djed/SigmaUSD, to try to come up with a stablecoin protocol that would need no reservecoin and no oracle. 😄 And then I ended up with hodlCoin. But I dismissed it back then as something crazy (which it is, if your goal is to create a stablecoin, since hodlERG’s price only increases :-D)… 🙂 Then, in summer/autumn of 2022, I shared this idea with @kushti_ru and, in Spring of 2023, he convinced me that this would be an interesting DegenFi product. The collaboration with @pulsarzz started then and I am still amazed by how fast it all went from there. Ergo’s capacity for innovation is incredible.

With great timing, the paper was been published in eprint this morning heh https://eprint.iacr.org/2023/1029

Welcome to Ergo!

Ergo is a type of secure blockchain based on decentralized finance (DeFi) functionalities. Its purpose is to combine the best features of Ethereum with those that Bitcoin has to offer.

The project is outfitted with a proof of work (PoW) similar to the consensus protocol that Bitcoin uses to ensure its network is secure and smart contracts are available to accommodate DeFi. The security features were taken from Bitcoin, while the smart contracts and decentralized features came from Ethereum. If you want to mine Ergo tokens, this platform uses a protocol referred to as “Autolykos,” which is a substantially modified version of the Bitcoin mining protocol.

Ergo Basic Principles

In this section, we define the main principles that should be followed to create ergonomic money.

This might be referred to as “Ergo’s Social Contract”.

In case of intentional violation of any of these principles, the resulting protocol should not be called Ergo.

Decentralization First Ergo should be as decentralized as possible. Always strive to spread and grow. Any party’s social leaders, software developers, hardware manufacturers, miners, and funds need to avoid central points of failure. All actors whose absence will disrupt the system’s function need to have contingency plans in the event of a disruption. Decentralization is born from education and adoption. The tools we build need documentation; the community must participate and grow actively. Teach others to use and adapt the tools. The internet is a powerful driver of decentralization and can be a powerful tool to teach. Decentralization is born from education, both on the development and user sides.

Malicious behavior that may affect the security of the network should be avoided. If any of these parties appear during Ergo’s lifetime, the community should consider ways to decrease their impact level. There will always be those who seek to disrupt, take advantage of, misuse and abuse their power. What is the answer? Education. Educating users to protect themselves, identify malicious actors, avoid them, and work together to minimize their influence. I would encourage all community members to continually seek to learn, adopt tooling, assist and teach in one way or another. A strong community is born through strong cooperation.

Open Permissionless and Secure Ergo protocol does not restrict or limit any categories of usage. This is necessary to remain resilient. We can advocate cooperation, trade, and human values; however, we do not enforce them, which would require a central power. Developers are free to implement any logic they want, taking full responsibility for the ethics and legality of their application.

All code for the core protocol must remain fully open and transparent. Every line should be fully auditable and transparent, preventing manipulation and building decentralized resiliency. Ergo is fully committed to being open source to remain trusted, and that trust must remain fully verifiable.

Anyone can join the network and participate in the protocol without permission. Unlike the traditional financial system, no bailouts, blacklists, or other forms of discrimination should be possible on the core level of Ergo protocol, and insider advantage should be minimized.

Ergo is committed to supporting privacy tools for those wishing to use them. This must remain a voluntary choice if a user wants to use mechanisms to disrupt the public availability of their data entirely within the scope of their power. They must take full responsibility for the ethics and legality of these actions.

Ergo is committed to best security practices. This is a continual commitment to prevent network attacks, preserve privacy and protect on-chain value.

Created for Regular People Ergo is committed to being a tool for Regular People. Ergo is a platform for ordinary people, and their interests should not be infringed upon in favor of big parties. In particular, this means that the centralization of mining should be prevented. Regular people should be able to participate in the protocol by running a full node and mining blocks. Post Autolykos V1 Ergo will work to provide a hash rate distribution of pools.

Ergo is committed to building an ecosystem that offers tools designed to assist regular people. Peer-to-peer exchange is continually threatened by peer-to-central power exchange, and Ergo aims to encourage tooling and community education to empower ordinary people.

A Platform for Contractual Money Ergo is the base layer to applications built on top of it. It is suitable for several applications, but its main focus is to provide an efficient, secure and easy way to implement financial contracts. Ergo is committed to building a solid foundation network that continually updates and innovates. The goal with contractual money is to create a system that is not overrun by high user costs and fees. For money to be Ergonomic, it must remain cost-competitive. Ergo will assist with frameworks and tooling for people to build and implement to maximize the use and utility or contractual money.

Hodlcoin update

Hodlcoin update

Where did HodlCoin come from?