IMO Disable separate approval transactions and do approve(0) after the swap. This adds pressure to the wallets to do the right thing. Permit creates signature fatigue.
On the other side, attack the problem with ERC-8255 for other wallets and apps that won't implement batching.
@tayvano_@banteg How about:
- Do you think the ERC is good?
- Do you think it should be funded?
If so, then the way I came off is irrelevant. The relevance to this thread is funds are being misallocated, for whatever reason.
@tayvano_@banteg Took no initiative = came up with a solution, wrote 2 implementations, pushed it to all my contacts
Special treatment = asking not to be excluded from next round
It's too easy to see the politics in this space, and it's exhausting
We reached out to @griffgreen from @thedaofund to seek funding for making token approvals safer with ERC-8255. We intended to direct 100% of any funding towards victims of the recent @EkuboProtocol exploit.
It looks like we will not be receiving any support--not even inclusion in current or future quantitative funding rounds. It appears @thedaofund is not focused on solving real security problems under leadership of @griffgreen. The entire conversation is attached.
We will still be pushing to get ERC-8255 as widely adopted as possible. However, I have no faith in @thedaofund's ability to distribute funds faithfully according to their mission. Token approvals are even mentioned specifically in Ethereum Foundation's Trillion Dollar Security initiative: https://t.co/epzPOFvEJ7
If you wish to donate to the development and adoption of this ERC, you can send any tokens or ETH to erc8255.eth. Any funds received will be directed towards reimbursing victims of the recent @EkuboProtocol exploit.
Read the ERC here: https://t.co/0ObJZQ5AKy
Check out our draft implementations:
โข OZ: https://t.co/n467VX2nvC
โข Solady: https://t.co/oaFs366t2i
In block 25081689, 0xD79b paid 28 eth to close out a loan and recover Punk 5032.
3 blocks later, the punk was stolen using an open approval.
How?
1/๐งต
I wrote ERC-8255 one week ago. If USDC immediately adopted it, it would've saved one user $456k already.
The victim did their approve(max) 51 days ago.
If you are writing a token, implement ERC-8255!
https://t.co/lswwrGIekO
๐จ JUST IN:
@Aurellion_Labs was exploited on Arbitrum for ~$456K.
due to uninitialized Diamond proxy / unprotected initialize().
Attacker added a malicious facet, abused existing USDC approvals, and swept funds from usersโ wallets.
Revoke approvals: https://t.co/8712or8PHr
We reached out to @griffgreen from @thedaofund to seek funding for making token approvals safer with ERC-8255. We intended to direct 100% of any funding towards victims of the recent @EkuboProtocol exploit.
It looks like we will not be receiving any support--not even inclusion in current or future quantitative funding rounds. It appears @thedaofund is not focused on solving real security problems under leadership of @griffgreen. The entire conversation is attached.
We will still be pushing to get ERC-8255 as widely adopted as possible. However, I have no faith in @thedaofund's ability to distribute funds faithfully according to their mission. Token approvals are even mentioned specifically in Ethereum Foundation's Trillion Dollar Security initiative: https://t.co/epzPOFvEJ7
If you wish to donate to the development and adoption of this ERC, you can send any tokens or ETH to erc8255.eth. Any funds received will be directed towards reimbursing victims of the recent @EkuboProtocol exploit.
Read the ERC here: https://t.co/0ObJZQ5AKy
Check out our draft implementations:
โข OZ: https://t.co/n467VX2nvC
โข Solady: https://t.co/oaFs366t2i
@trenchobserver@permaOx@griffgreen@thedaofund@EkuboProtocol The post he linked said funds are used for retroactive grants. I also asked to be included in the next round or at least for him not to prevent us from being included and that was apparently the final straw
Agreed and difficulty of review/audit is one of the reasons this happened. We couldn't reuse code from our audited smart contracts to write the huff router.
If we had AI agents reviewing with the same rigor that attackers review we can use low level languages more safely, but it's an arms race and they are currently winning