Show Notes--->https://wolfdefi.com/i-degen/e22-ethereum-merge-security-with-david-theodore/

E22 - Securing the Merge W/David Theodore From The Ethereum Foundation - 11/15/2022

Full show notes --> https://wolfdefi.com/i-degen/e21-gala-games-gets-owned-by-a-whitehat/

E21 - Gala Games Attacked By A Whitehat & 50K BTC Silkroad Hacker Pleads Guilty

Full show notes --> https://wolfdefi.com/i-degen/e20-team-finance-hacked-profanity-hacks-continue/

E20 - Team Finance, FriesDAO, & Layer2DAO Hacked - Profanity Woes Continue - 11/1/2022

Full Show notes can be found here [https://wolfdefi.com/i-degen/e19-threat-intel-bots-devcon-6/]. 

Be on the lookout for a new I, Degen Sequence on Zeevo [https://app.zeevo.co] in the next few days 😉

Stay up, fren.  

E19 - Alpha Hunting w/Threat Intel Bots & Devcon 6 Security Talk Gem Hunt 1 - 10/21/2022

Full show notes on -->WolfDeFi.com [http://wolfdefi.com/i-degen/e18-patriarch-glossy-manohar/] 💀 

E18 - Patriarch Glossy Manohar, you are being liquidated! - 10/14/2022

---> Full show notes on HackMD [https://hackmd.io/@idegen/E17-OPSEC-at-DEVCON-6]  <---

I, Degen - E17: OPSEC at DEVCON 6 - 10/06/2022

Listen at: idegen.fm [http://idegen.fm]

Contact us: @idegenfm [https://twitter.com/idegenfm]



Intro

Welcome to I, Degen - A podcast about crypto technology, security, and culture. With a healthy balance of enthusiasm and skepticism, we dig into a weekly look at crypto, cutting through the misinformation and hype in search of signal in the noise.



Episode Summary

This week we’ll do our usual weekly review of crypto security-related topics. We’re going to dig into the issue of conference OPSEC, or operational security, as we’re less than a week out from Ethereum’s flagship developer conference, and rumors swirl about security concerns in Bogota.



I,Degen - Weekly Review

 1.  Sunday, October 2nd - Transit Swap Users Rocked for 21M [https://rekt.news/transit-swap-rekt/]
 2.  Transit Swap has lost $21M to a vulnerability which allowed an unknown attacker to drain the wallets of users who had approved the protocol’s swap contracts.
 3.  Leading up to Ethereum’s flagship developer conference being held in Bogota, Columbia next week, a wave of Tweets and some articles surfaced questioning the safety of conference goers. FUD or legit concern? Well dig more into this on deep dive in a few minutes.
 4.  Office of the National Cyber Director Requests Your Insight and Expertise on Cyber Workforce, Training, and Education [https://www.whitehouse.gov/oncd/briefing-room/2022/10/03/office-of-the-national-cyber-director-requests-your-insight-and-expertise-on-cyber-workforce-training-and-education/]
 5.  Our Nation continues to face a significant shortfall in cyber talent, with estimates of approximately 700,000 open positions.
 6.  October 1st, 2022 - No Digital Dollar Act Introduced - From Bitcoin.com [https://news.bitcoin.com/us-senator-introduces-no-digital-dollar-act-to-prohibit-treasury-and-the-fed-from-interfering-with-americans-using-paper-currency/]
 7.  U.S. Senator James Lankford (R-OK) announced Thursday that he has introduced a bill titled “No Digital Dollar Act to prohibit the U.S. Treasury and the Federal Reserve from interfering with Americans using paper currency if a digital currency is adopted and makes certain individuals can maintain privacy over their transactions using cash and coins.”
 8.  October 4th, 2022 From Axios- Why Kim Kardashian got fined and Matt Damon didn’t [https://www.axios.com/2022/10/04/kim-kardashian-crypto-fine-matt-damon]
 9.  Kim Kardashian was fined $1.26 million Monday for touting crypto schemes — even as much more high-profile pitches from the likes of Matt Damon and Larry David have gone unpunished. The seeming double standard is a function of a subtle yet crucial distinction in securities law.
 10. Where Kardashian crossed the line was when she endorsed a crypto asset security.
 11. How it works: If you’re endorsing a company, the only rules that apply are the relatively lax ones from the FTC.
 12. If you’re shilling a security, then disclosing that you were paid — as Kardashian did with an #AD hashtag — is not enough; you also need to disclose how much you were paid.
 13. The bottom line: If you’re going to tout crypto, tout a crypto company, not a coin.

Moving on… Usually, we focus on looking back at crypto security-related events of the previous week. I thought maybe we could also highlight any relevant upcoming events each week.



I, Degen - Looking Forward

 1. Devcon next week - There will be a keynote talk on the Nomad Bridge Hack. I think there will be a live stream if you are not attending.
 2. November 15th, PyChain -

E17 - OPSEC at DEVCON 6 - 10/6/2022

Listen at: idegen.fm [http://idegen.fm]

Contact us: @idegenfm [https://twitter.com/idegenfm]



Intro

Welcome to I, Degen - A podcast about crypto technology, security, and culture. With a healthy balance of enthusiasm and skepticism, we dig into a weekly look at crypto, cutting through the misinformation and hype in search of signal in the noise.



Episode Summary

This week we discuss the draft of the US House’s Stablecoin bill. CFTC’s 250k fine for BzX & the Ooki DAO. We talk about the 0xBAD MEV bot getting owned, and we dig into the recent paper on reversible ERC20 and ERC721 transactions.



I, Degen - Weekly

 1. 9/20/2022 - From CryptoBreifing - US House proposes stablecoin bill that would put a two-year ban on algorithmic stable coins [https://cryptobriefing.com/could-the-new-house-stablecoin-bill-kill-frax-and-dai/]

 * U.S. lawmakers are reportedly drafting a bill to place a two-year ban on certain stablecoins.
 * The House Stablecoin Bill would target “endogenously collateralized stablecoins.”
 * The bill would allow both banks and non-banks to issue stablecoins. However, bank issuers would need approval from federal regulators such as the OCC. As for non-bank issuers, the legislation directs the Federal Reserve to establish a process for making application decisions.
 * The House Stablecoin Bill would make it illegal to issue or create new stablecoins that mimic the functionality and features of TerraUSD

NOTE: This is an early draft, not final so take it for what it is.

 1. 2M in assets seized from Whitby, Ont Man  [https://www.businessinsider.com/self-described-crypto-king-aiden-pleterski-sued-cars-seized-report-2022-9]

 * Aiden Pleterski, who calls himself “Crypto King,” had $2 million of assets seized, Lamborghini, two McLarens, and two BMWs
 * Pleterski was reportedly given $35 million by 140 investors.
 * Now, he’s being sued by former investors in a bankruptcy proceeding and two civil lawsuits.
 * Investors told the publication that at least $35 million given to Pleterski’s company, AP Private Equity Limited, went missing.
 * No criminal charges yet

 1. 9/22/2022 - CFTC Press Release [https://www.cftc.gov/PressRoom/PressReleases/8590-22]
 2. By transferring control to a DAO, bZeroX’s founders touted to bZeroX community members the operations would be enforcement-proof—allowing the Ooki DAO to violate the CEA and CFTC regulations with impunity, as alleged in the federal court action.
     –> CFTC Penalizes Blockchain Protocol $250K, Files Action Against Successor DAO [https://www.coindesk.com/policy/2022/09/22/cftc-penalizes-blockchain-protocol-250k-files-action-against-successor-dao/]
    9/27/2022 - Coindesk The CFTC Served Ooki DAO Papers by Posting Them in an Online Discussion Forum [https://www.coindesk.com/policy/2022/09/28/the-cftc-served-ooki-dao-papers-by-posting-them-in-an-online-discussion-forum/]
    Members of Ooki DAO – which operates a protocol that offers illegal, off-exchange tokenized margin trading and lending services – were notified of the lawsuit when a CFTC paralegal posted the complaint and other documents to an online discussion forum meant for DAO members to discuss governance issues, a CFTC attorney claimed in a court filing. The documents were simultaneously submitted through a help chat box on the DAO’s website.
    
    –>coindesk [https://www.reddit.com/r/defi/comments/xmv8g2/each_of_the_people_who_hold_the_tokens_for_the/]
 3. Terra Luna Saga Continues --> Interpool issues arrest warrant for Do Kwon [https://hackmd.io/2ybkNNavSOydFJzA6DMpow]

E16: Reversible Transactions - 10/1/2022

Listen at: idegen.fm [http://idegen.fm]

Contact us: @idegenfm [https://twitter.com/idegenfm]



Intro

Welcome to I, Degen - A podcast about crypto technology, security, and culture. With a healthy balance of enthusiasm and skepticism, we dig into a weekly look at crypto, cutting through the misinformation and hype in search of signal in the noise.



Episode Summary

In this episode, we hunt for Do Kwon and look at the White House’s comprehensive framework for the responsible development of digital assets. Then we look into Wintermute’s 119M key generation issue. We discuss emerging post-merge Ethereum narratives and the Omni bridge replay attack. We also get into an IRL customs scam for our hack attempt of the week.



I,Degen - Weekly

 1. 9/14/22 - South Korean Court Issues Arrest Warrant for Terra Luna founder Do Kwon [https://thecryptobasic.com/2022/09/14/south-korean-court-issues-arrest-warrant-for-terras-founder-do-kwon/] [2 [https://www.ft.com/content/7a8f63e8-b337-4685-81fb-36054b05f651]]

The wanted crypto developer Do Kwon, who is accused of fraud by investors following the $45 billion (€45 billion) collapse of his cryptocurrencies Luna and TerraUSD, is reportedly trying to evade South Korean authorities.Prosecutors have accused Kwon of financial fraud, arguing that his terraUSD stablecoin was a kind of investment security under South Korea’s capital markets act [2]Kwon moved from South Korea to Singapore, where the now defunct stablecoin issuer Terraform Labs, which he co-founded, has a base. However, Singapore Police Force said on Saturday he is currently not in the city-state.South Korean prosecutors told Bloomberg in a text message on Monday that there has been “circumstantial evidence of escape” since he left Singapore. The media outlet said prosecutors declined to comment on whether the office knows of Kwon’s whereabouts or if it will contact the international police agency Interpol.Last week, Kwon was charged with violating the Capital Markets Act, and an arrest warrant was issued for him and five allegedly connected to the case who were believed to be in Singapore.
 –EuroNews [https://www.euronews.com/next/2022/09/19/arrest-warrant-issued-for-do-kwon-the-man-allegedly-behind-the-45-billion-terra-luna-colla]
 1. White House Releases Comprehensive Framework for Responsible Development of Digital Assets [https://www.whitehouse.gov/briefing-room/statements-releases/2022/09/16/fact-sheet-white-house-releases-first-ever-comprehensive-framework-for-responsible-development-of-digital-assets/]

Over the past six months, agencies across the government have worked together to develop frameworks and policy recommendations that advance the six key priorities identified in the EO: consumer and investor protection; promoting financial stability; countering illicit finance; U.S. leadership in the global financial system and economic competitiveness; financial inclusion; and responsible innovation.The nine reports submitted to the President to date, consistent with the EO’s deadlines, reflect the input and expertise of diverse stakeholders across government, industry, academia, and civil society. Together, they articulate a clear framework for responsible digital asset development and pave the way for further action at home and abroad.

Protecting Consumers

Still sellers commonly mislead consumers about digital assets’ features and expected returns, and non-compliance with applicable laws and regulations remains widespread. One study found that almost a quarter of digital coin offerings had disclosure or transparency problems—like plagiarized documents or false promises of guaranteed returns.The reports encourage regulators like the Securities and Exchange Commission (SEC) and Commodity Futures Trading Com

E15 - Wintermute's 119 Million Dollar Key Generation Lesson - 9/20/2022

I, Degen - E14: All Eyes On Ethereum - 9/11/2022

Listen at: idegen.fm [http://idegen.fm]

Contact us: @idegenfm [https://twitter.com/idegenfm]


Full show notes with images on HackMD - https://hackmd.io/@idegen/E14-All-Eyes-On-Ethereum

Intro

Welcome to I, Degen - A podcast about crypto technology, security, and culture. With a healthy balance of enthusiasm and skepticism, we dig into a weekly look at crypto, cutting through the misinformation and hype in search of signal in the noise.



Episode Summary

All eyes are on Ethereum - we are now less than four days out from the merge. We’ll talk about some possible scenarios the merge might bring and what you can do to stay safe during the merge. We’ll also look into recent updates on the Tornado Cash sanctions, a new report on fraudulent crypto trading volume, and other crypto security-related news.

I,Degen - Weekly



Cryptosphere

 1. From August 23rd, SudoRare, a LooksRare clone rugs 820K after just 6 hours of operation [https://thenewscrypto.com/sudorare-nft-marketplace-executes-rug-pull-hours-after-launch/] Rugged funds likely moved to a KYC’d address on Kraken.
 2. SudoRare, an NFTplatform that forked from SudoSwap and LooksRare, is just the latest crypto project to run off with users’ funds. The project also deleted all of its social media accounts Tuesday morning. - 
 3. Coinbase launches Liquid Staked derivative (LSD) cbETH ahead of the merge - [1 [https://cointelegraph.com/news/coinbase-introduces-wrapped-staked-eth-asset-ahead-of-the-merge]][2 [https://www.reddit.com/r/ethereum/comments/wwp0ka/coinbase_staked_eth_whitepaper/]][3 [https://www.thedefiant.io/coinbase-launches-cbeth]]
 4. Earn 1 MIL if you can find a good bug in Ethereum before the merge [https://decrypt.co/108168/ethereum-bug-before-merge-could-earn-million-dollar-reward]
 5. August 26th, 2022 - Tailiban Outlaws Crypto in Afganistan and begins arresting sellers that refused to comply [https://finbold.com/taliban-outlaws-crypto-in-afghanistan-and-starts-arresting-token-traders/] Bloomberg article [https://www.bloomberg.com/news/articles/2022-08-26/taliban-ban-crypto-in-afghanistan-arrest-digital-coin-dealers]
 6. Password managment first LastPass had it’s developer systems hacked to steal source code [https://www.reddit.com/r/programming/comments/wxx674/password_management_firm_lastpass_was_hacked_two/]
 7. According to Forbes, more than 1/2 of all Bitcoin trades are ‘fake’ [https://www.forbes.com/sites/javierpaz/2022/08/26/more-than-half-of-all-bitcoin-trades-are-fake/?sh=7e993e0a6681]

The U.S. Commodity Futures Trading Commission defines wash trading as “entering into, or purporting to enter into, transactions to give the appearance that purchases and sales have been made, without incurring market risk or changing the trader’s market position.” The reason why some traders engage in wash trading is to inflate the trading volume of an asset to give the appearance of rising popularity. In some cases trading bots execute these wash trades in tokens, increasing volume, while at the same time insiders reinforce the activity with bullish remarks, driving up the price in what is effectively a pump and dump scheme. Wash trading also benefits exchanges because it allows them to appear to have more volume than they actually do, potentially encouraging more legitimate trading.

“Fraudulent or non-economic”

The biggest problem areas regarding fake volume are firms that tout big volume but operate with little or no regulatory oversight that would make their figures more credible, notably Binance, MEXC Global and Bybit. Altogether, the lesser regulated exchanges in our s

E14 - All Eyes On Ethereum - 9/11/2022

I, Degen - Episode 13 - Open Source Audio Audit with Kevin Seagraves & Zach Herring from Niftyapes.money [https://niftyapes.money/]

If you have a moment, please check out episode 13 I, Degen sequence on Zeevo [https://app.zeevo.co/dashboard/sequences/fcd99246-7fc2-4467-802a-d73576bc28c5]. Give your feedback on the show, and we'll mint you a custom token of appreciation 🙏

Listen at: idegen.fm [http://idegen.fm/]

Contact us: @idegenfm [https://twitter.com/idegenfm]



Intro

On this episode of I, Degen we chat with Kevin Seagraves and Zach Herring from Niftyapes [https://www.niftyapes.money/]. They recently came out of stealth mode to launch their NFT lending platform and bravely agreed to an open-source audio audit with us.

Welcome to I, Degen gentleman, and thanks for taking the time to chat with us. Before we jump into the audit, can you tell us a bit about yourselves and what NiftyApes is?



Intros Kevin Seagraves & Zach Herring:

Who are we talking to?
Tell us about your background and how you built an NFT lending platform.

For KS: Can you tell us more about your work with ETHSecurity?

Hunt questions:



Intro NiftyApes:

 1. What is NiftyApes?
    1. How does it work?
    2. Why did you build it?
    3. Who’s gonna use it?
    4. What is HARBERGER AUCTION?
    5. When release?



 1. Let's talk about the “regen” side of Nifty Apes and the 1%? that goes to public goods. Why was it essential for you to do this?



Open Source Audit:

Security audits are expensive and rarely a priority for founders. This is especially dangerous when it comes to Defi apps and protocols, given the natural ability of an attacker to take something of value.

The idea for our Open Source Audit is to help others learn about securing a crypto project by asking some questions about how you’ve approached the security of the Niftyapes.

 1. Can you give us a high overview of the tech stack? How does NiftyApes look from a zoomed-out view? What web2 components are at play, and what web3?
 2. Can you talk a little bit about your overall approach to securing niftyapes?
 3. How have you approached the security in your web2 interface?

KS: we only store tx receipts in DB after a tx has taken place and been confirmed, so the attack surface for us on Web2 is low.

3(b). Have you taken steps to ensure your DNS records are secure?

 1. Contract audits - Can you give us an overview of your process with the contract audits?
    1. How did you find your auditors?
    2. What was the process like?
    3. What did they find?
 2. You guys have gone out of your way to make security a priority for NiftyApes (from the front page):
 3. Does NiftyApes have a bug bounty program? If so, how does it work?
 4. Nocoiners and others have been all over a brewing problem at NFT lending platform, BendDAO [https://www.coindesk.com/business/2022/08/19/many-bored-ape-nfts-are-in-danger-of-getting-liquidated-as-borrowed-money-comes-back-to-bite/]. Specifically,

“The NFT lending platform BendDAO has collateralized almost 3% of the entire Bored Ape collection, and many NFTs have recently entered the “danger zone” of liquidation.”

ZW: Would this kind of thing be a potential problem on Niftyapes too?

 1. Game theoretical bugs are new and emerging class of attacks in DeFi that don’t necessarily exploit bugs in code but instead bugs in the relationship between values of pools, balances, and the connected systems.

E13 - NiftyApes Open Source Audit w/Kevin Seagraves & Zach Herring  - 9/1/2022

Welcome! I, Degen is a podcast about crypto technology, security, and culture. With a healthy balance of enthusiasm and skepticism, we cut through the misinformation and hype in search of a signal in the noise. Our weekly round-up will keep you updated on the latest in crypto hacks and security. With our open-source audio audits, we interview founders and hackers to surface relevant info about how to stay safe in crypto land.

Zak Wolff

Shows