Crypto Noir: The Misadventures of hashdive.

1 year ago 59

BOOK THIS SPACE FOR AD

ARTICLE AD

hashdive

The dimly lit room on the 176th floor of a rundown high-rise building in the heart of the city was suffocating with the stench of stale cigarette smoke. I sat there, surrounded by a mess of tangled wires and half-eaten pizza boxes. My name? Call me Detective Banks. Most folks just called me hashdive. I was the kind of jerk who spent his days chasing down bugs and the nights drowning his sorrows in cheap bourbon.

The world of blockchain had turned me into a brooding cynic, always on the lookout for the next big hack. But tonight was different. Tonight, I was the hunted.

As I sat at my cluttered desk, with the neon lights of the city flickering through the smudged windows, I couldn’t escape the feeling that someone was closing in on me. The BlockPolice, those relentless enforcers of crypto law, were hot on my trail. I was being framed for the mother of all DeFi breaches — a digital heist that had cost the crypto world a cool $316,984,083.73. You see, in this game, when you’re framed for a heist of that magnitude, you might as well be straddling the fault lines of an imminent earthquake of chaos.

That’s when the door creaked open, and in walked a pint-sized tornado — my daughter, Sophie. She had her own set of skills, and they were sharper than mine. She glanced at the clutter around the room, shook her head in disapproval, and plugged in her game console.

“Hey, Dad, Ever hear of deodorant?” she said with a smirk, never taking her eyes off the game.

“Sophie,” I groaned, rubbing my temples. “I need your help. BlockPolice are after me, and I’m being framed for that Helix breach.”

She just plugged her headset in and started chatting with her friends, their laughter filling the room. They were all in on the joke — the joke that was my life.

I couldn’t blame her, though. She was a genius with a computer, and at just sixteen, she had already outsmarted most of the crypto world.

Her uncovered vulns included: the ‘Crypto Kitty Caper,’ ‘ICO Inception,’ ‘Scamcoin Saga,’ ‘Pump-and-Dump Pandemonium,’ ‘Shady Shiba Shakeup,’ ‘NFT Nonsense,’ ‘Altcoin Avalanche,’ ‘Ransomware Revelations,’ the ‘Stablecoin Swindle.’ I could go on.

I sighed and took another drag from my cigarette. It was clear I was on my own on this one. I had to clear my name, or else it was game over — game over big time.

As the cigarette smoke spiraled lazily toward the cracked ceiling, I couldn’t shake the heavy feeling of impending doom. It was as if the shadows in the room conspired to keep me in the dark, much like the mysterious circumstances that had led me here.

The Helix breach — that was the code name they had given it in crypto circles. A hack so audacious that it made even seasoned hackers whistle in admiration. It had taken just one well-executed exploit to drain the equivalent of $316,984,083.73 from DeFi protocols, leaving a trail of chaos and confusion in its wake.

But what gnawed at my soul like a rat in a maze was the fact that I was being framed for this grand larceny. They say the best place to hide a lie is between two truths, and in my case, the lie was buried deep within lines of blockchain code. Someone had meticulously woven a digital tapestry of deceit, leaving breadcrumbs that led straight to me, the unsuspecting detective. What did they have against me? And who were they? And why?

And here I was, Detective Banks, hashdive, with nothing but a room that smelled of yesterday’s mistakes. As I stared at the blinking cursor on my outdated terminal, I couldn’t help but feel like a pawn in someone else’s game.

Sophie, still ensconced in her virtual world, interrupted my thoughts with a sardonic comment. “You know, Dad, you might want to invest in a decent antivirus program for your life.”

Sophie’s wit was as sharp as her coding skills. “Sophie,” I sighed, “I need your help. BlockPolice are after me. It’s only a matter of time.”

With the disdain only a teenager could muster, she replied, “Amateur.”

I thought I might as well take a look at tertiary Aave protocols. Even if it was just a single pixel in a digital mosaic. With each line of code I dissected, I could sense the noose tightening around my neck. The countdown had begun, and time was running out faster than a volatile crypto token on a bearish market day.

“You know, Dad, if you got paid for every bug you didn’t find, you’d be rich by now.” Uggh. Annoying. If she’d only help me. I opened up terminal and setup a dummy Foundry project.

curl -L https://foundry.paradigm.xyz | bash
foundryup
forge init --template https://github.com/foundry-rs/forge-template hello_template

And it was off to the races. I decided to look at Alchemix’s StaticAToken.sol …. Alchemix was a future-yield backed synthetic asset platform and community DAO, and its StaticA was a container for Aave’s aToken for investors who wanted to avoid yield. Not sure why they would as the rate kept going up. In any case, I replaced the template’s `contract.t.sol` with:

// SPDX-License-Identifier: Unlicense
pragma solidity ^0.8.13;

import "forge-std/Test.sol";

import "src/Contract.sol";

import "src/external/StaticAToken/submodules/v2-foundry/src/external/aave/StaticAToken.sol";
import "src/external/StaticAToken/submodules/v2-foundry/lib/openzeppelin-contracts/contracts/token/ERC20/IERC20.sol";
import "src/external/StaticAToken/submodules/v2-foundry/src/external/aave/WadRayMath.sol";
import "src/external/StaticAToken/submodules/v2-foundry/src/interfaces/external/IWalletBalanceProvider.sol";

contract TestContract is Test {
StaticAToken public staticAToken; // declare the StaticAToken contract
address public testUser; // declare address of the test user
IERC20 public dai; // declare dai token contract
IERC20 public aDai; // declare aDAI token contract

constructor() {
// Initialize the address of the DAI token contract
dai = IERC20(0x6B175474E89094C44Da98b954EedeAC495271d0F);
aDai = IERC20(0x028171bCA77440897B824Ca71D1c56caC55b68A3); // aDAI address
}

function setUp() public {
staticAToken = StaticAToken(0xcE4a49d7ed99C7c8746B713EE2f0C9aA631688d8); // address of Alchemix StaticAToken contract
testUser = address(this); // Use the contract itself as the test user
deal(address(dai), testUser, 100000); // Set the DAI balance for the testUser
//deal(address(aDai), testUser, 100000); // Set the aDAI balance for the testUser
dai.approve(address(staticAToken), 100000); // Approve StaticAToken to spend DAI
aDai.approve(address(staticAToken), 100000); // Approve StaticAToken to spend aDAI
}

function testDepositAndADaiWithdraw() public {
// Call the rate()
uint256 rateBeforeDepositValue = staticAToken.rate();
console.log("This is the rate:", rateBeforeDepositValue);
// get the balances
console.log('dAI balance before deposit: ', dai.balanceOf(testUser)); // Use aDai instead of dai
console.log('aDAI balance before deposit: ', aDai.balanceOf(testUser)); // Use aDai instead of dai
// Deposit 100 dai
uint256 depositAmount = 100;
uint16 referralCode = 0; // You can set a valid referral code for rewards
bool fromUnderlying = true; // Assuming you are depositing underlying tokens (dai in this case)
// deposit dai to mint static aDai
uint256 staticATokensMinted = staticAToken.deposit(testUser, depositAmount, referralCode, fromUnderlying);
console.log('static aDai minted ', staticATokensMinted);
// Get the balances again
console.log('dai balance after withdrawal ', dai.balanceOf(testUser));
console.log('aDai balance after deposit: ', aDai.balanceOf(testUser)); // Use aDai instead of dai
// Calculate the equivalent amount in aDAI for the staticTokensToWithdraw
uint256 staticTokensToWithdraw = staticAToken.balanceOf(testUser);
// Withdraw staticTokensToWithdraw staticATokens
bool toUnderlying = false; // Assuming you want to withdraw to underlying tokens
(uint256 amountBurnt, uint256 amountWithdrawn) = staticAToken.withdraw(testUser, staticTokensToWithdraw, toUnderlying);
// Get the updated balances
console.log('amount of static aDai Burnt ', amountBurnt);
console.log('amount of aDai Withdrawn ', amountWithdrawn);
console.log('static aDai balance after withdrawal ', staticAToken.balanceOf(testUser));
console.log('Dai balance after withdrawal ', dai.balanceOf(testUser));
console.log('aDai balance after withdrawal: ', aDai.balanceOf(testUser));
}

function testDepositAndDaiWithdraw() public {
// Call the rate()
uint256 rateBeforeDepositValue = staticAToken.rate();
console.log("This is the rate:", rateBeforeDepositValue);
// get the balances
console.log('dAI balance before deposit: ', dai.balanceOf(testUser)); // Use aDai instead of dai
console.log('aDAI balance before deposit: ', aDai.balanceOf(testUser)); // Use aDai instead of dai
// Deposit 100 Ddai
uint256 depositAmount = 100;
uint16 referralCode = 0; // You can set a valid referral code for rewards
bool fromUnderlying = true; // Assuming you are depositing underlying tokens (dai in this case)
// deposit dai to mint static aDai
uint256 staticATokensMinted = staticAToken.deposit(testUser, depositAmount, referralCode, fromUnderlying);
console.log('static aDai minted ', staticATokensMinted);
// Get the balances again
console.log('dai balance after withdrawal ', dai.balanceOf(testUser));
console.log('aDai balance after deposit: ', aDai.balanceOf(testUser)); // Use aDai instead of dai
// Calculate the equivalent amount in aDAI for the staticTokensToWithdraw
uint256 staticTokensToWithdraw = staticAToken.balanceOf(testUser);
// Withdraw staticTokensToWithdraw staticATokens
bool toUnderlying = true; // Assuming you want to withdraw to underlying tokens
(uint256 amountBurnt, uint256 amountWithdrawn) = staticAToken.withdraw(testUser, staticTokensToWithdraw, toUnderlying);
// Get the updated balances
console.log('amount of static aDai Burnt ', amountBurnt);
console.log('amount of aDai Withdrawn ', amountWithdrawn);
console.log('static aDai balance after withdrawal ', staticAToken.balanceOf(testUser));
console.log('Dai balance after withdrawal ', dai.balanceOf(testUser));
console.log('aDai balance after withdrawal: ', aDai.balanceOf(testUser));
}

}

All clear. Two passing tests. Alchemix’s StaticA was as safe as a bank vault encased in concrete; security thicker than a crypto millionaire’s trust fund in the British Virgin Islands.

[PASS] testDepositAndADaiWithdraw() (gas: 403962)
Logs:
This is the rate: 1098911669011541960371454234
dAI balance before deposit: 100000
aDAI balance before deposit: 0
static aDai minted 91
dai balance after withdrawal 99900
aDai balance after deposit: 0
amount of static aDai Burnt 91
amount of aDai Withdrawn 100
static aDai balance after withdrawal 0
Dai balance after withdrawal 99900
aDai balance after withdrawal: 100

[PASS] testDepositAndDaiWithdraw() (gas: 335112)
Logs:
This is the rate: 1098911669011541960371454234
dAI balance before deposit: 100000
aDAI balance before deposit: 0
static aDai minted 91
dai balance after withdrawal 99900
aDai balance after deposit: 0
amount of static aDai Burnt 91
amount of aDai Withdrawn 100
static aDai balance after withdrawal 0
Dai balance after withdrawal 100000
aDai balance after withdrawal: 0

My life was spiraling into complete garbage faster than a crypto cat chasing a meme coin laser pointer. Just as I began to question my very existence in this crypto-crazed world, Sophie, sitting on the bed with her headset on, couldn’t resist chiming in. She leaned into the microphone and announced to her video game friends, “Hey, guys, remember my dad?”

“No,” I heard one of them say.

“He got framed for Helix. Turns out he’s the bug in our family DNA.”

They all erupted in laughter, leaving me to wonder if maybe, just maybe, this was as bad as it was going to get. But it was going to get worse, much worse.

Read Entire Article