0xc8a65fad…9963sent to0xc8a65fad…9963·#13,056,468·view on Etherscan
NOT AMA, BUT A TOUGH STORY
IT MIGHT BE THE MOST WEIRD EXPERIENCE IN MY LIFE TO COOPERATE WITH A CHINESE TEAM.
I FELT INCONSISTANCE FROM THIS GROUP OF PEOPLE. THEY BUILD THINGS CARELESSLY, BUT THEY CAN FIX THEM QUICKLY. THEY ARE GOOD AT BARGAIN AND BOASTING. THEY KNOW HOW TO TREAT AND HOW TO TRICK. THEY CAN DESIGN SOPHISTICATED CRYPTO PROTOCOLS BUT THEY DON'T KNOW HOW TO APPLY THE SKILL IN REAL WORLD.
I HAVE BEEN TRYING TO COOPERATE WITH THEM THROUGH ETHEREUM WHICH SHOULD BE EFFICIENT AND ELEGANT, BUT IT'S NOT AS SIMPLE AS I EXPECTED. IT TOOK HOURS TO SETUP THE ENCRYPTED CHANNEL FOR INITIAL COMMUNICATION. SINCE THE CHANNEL IS ONLY FOR VULNERABILITY DISCLOSURE, I WILL DECRYPT ALL THE MESSAGES HERE FOR TRANSPARENCY. (SEE THE APPENDIX). NO MORE ENCRYPTION FROM NOW ON.
I JUST WANT TO MAKE THE IT _PERFECT_, SO I _REALLY CARE_ ABOUT RETURNING THE LOCKED USDT. I CAN UNDERSTAND THOSE CHINESE GUYS ARE AFRAID OF BEING SCAMMED, SO I SUGGESTED THAT I CAN RETURN MUCH MORE MONEY THAN THE LOCKED USDT SO THAT THEY WON'T LOSE MORE FOR SURE. THEN I STARTED TRANSFERING EVERYTHING IN BSC & MATIC. HOWEVER, I FELT THAT MY GOODWILL WAS IGNORED COMPLETELY. THEY WERE JUST SITTING THERE AND PUSHING ME. MAYBE THEY WERE TOO NERVOUS UNDER THE PRESSURE FROM THE COMMUNITY. I REALIZED THAT THERE WAS A BETTER WAY TO GET THEM OUT OF THE TROUBLE QUICKLY WHILE KEEPING MY DIGNITY, SO I PROPOSED BUILDING A SHARED MULTISIG WALLET. THAT'S A STRONG PROMISE THAT I WILL NOT BE ABLE TO DO ANYTHING RANDOM TO HURT ANYBODY. --I WAS SURPRISED THAT THEY HAD TROUBLE UNDERSTANDING THE MEANING OF THE SHARED WALLET AND IGNORED MY PROPOSAL FOR HOURS.-- (IT WAS MY FAULT THAT I MISSED THE CORRESPONDING RESPONSE. I DIDN'T NOTICE THAT UNTIL REVIEWING THE CHAT HISTORY TODAY) SOON THEY TRIED TO BRIBE ME WITH THEIR LIMITED BUDGET, WHAT A HILARIOUS SCENE! DID I LOOK LIKE SOME RANSOM GANGSTER? DEAR CHINESE BUSINESSMAN, MONEY IS NOT THE ONLY THING THAT MATTERS.
THE RESPONSE OF THE USDT ISSUE WAS AMBIGUOUS. IT WOULD BE MUCH MORE REASONABLE IF THEY HAD FIXED THE PROBLEM WHILE I WAS RETURNING OTHER ASSETS. NOW UNLOCKING USDT SEEMS RISKY GIVEN THAT THEY ARE THE WINNER WHO SUCCESSFULLY TRICKED THE BAD GUY TO RETURN EVERYTHING. I AM A LITTLE BIT UPSET ABOUT THEIR HYPOCRISY AND INCOMPETENCY, BECAUSE IT'S NEVER HARD TO SOLVE THE TRUSTING ISSUE AS CRYPTO ENTHUSIASTS: I CAN APPROVE THE TRANSACTION OF MY USDT FROM ANY ACCOUNT, WHICH IS A FEATURE OF THE ERC20 TOKENS, THEN THEY CAN DO THE UNBLACKLIST AND TRANSFER IT IN A SINGLE TRANSACTION OF SMART CONTRACT. IT'S A NEAT SOLUTION TO PROVE THAT ALL ASSETS HAVE BEEN TRANSFERED TO THE SECURED WALLET.
MAYBE THE POLY IS REALLY BUSY WORKING ON THE REPAIRING (AND THEY DID IT REALLY FAST). THOUGH THEY ARE JUDGING ME BASED ON THEIR HYPOTHESIS, I STAY OPEN AND HONEST ABOUT THIS INCIDENT, ANSWERING THE RANDOM QUESTIONS TO ALLEVIATE THE DISTRUST. HERE IS THE MOST WEIRD THING: THE HUGE CROWD OF CHINESE REFUGEES ARE GONE! THEY DON'T EVEN SHOW UP IN THE MESSAGE LIST OF THE MULTISIG WALLET! IT'S REALLY A STRANGE FEELING SINCE I WAS PREPARING FOR COVERING THE UNEXPECTED LOSS OF THOSE GUYS AND WAITING FOR THEIR CLAIMS AND IDEAS ABOUT THIS PROJECT. BUT THE POLY TEAM TOLD ME THAT THERE WERE THOUSANDS OF PEOPLE WHO WERE STILL WORRYING ABOUT THE POTENTIAL LOSS. NOW I BECOME A REAL JOKER: DOING GOOD THINGS IN MY OWN WAY BUT BEING HUMILIATED BY THE CROWD.
I AM KIND OF CONFUSED ABOUT WHAT A MORAL LEADER SHOULD DO, PERHAPS I SHOULD NOT HAVE TAKEN IT SERIOUSLY. ANYWAY, THINGS ARE GETTING BETTER. THE REPAIRING IS SUPRISINGLY FAST. I AM MORE THAN HAPPY TO SEE THE RETURNED STABLE COINS FUNCTIONING IN THE CROSS CHAIN BRIDGE. AND I AGREE THAT THE LIQUIDITY PLAYS A KEY ROLE IN THE RECOVERING PHASE. I AM NOT READY TO PUBLISH THE FINAL KEY IN THIS WEEK THOUGH, I CAN PROVIDE ENOUGH LIQUIDITY OF WBTC & ETH TO START THE ENGINE. GETTING TIRED OF THE MESS. IT'S REALLY A WILD AND WEIRD JOURNEY.
APPENDIX:
_TBH I DID NOT RAED SOME CRITICAL MESSAGES IN TIME, SORRY_
CONVERSATION BETWEEN THE POLY AND ME:
TX 0x64eb495eba8b2000181498910748614dbd2c4bd7d6997af20cdb92c2518b2bce: "PING ME BACK IF YOU CAN HEAR ME." (MAYBE INCORRECT)
TX 0x69534e330c5f8529759272b86e90bbacf7a5c4082683064c471e5539eacf53ba: "OR LIKE THIS" (MAYBE INCORRECT)
TX 0xea4b6061c3e42c255b9cb5e78ff7ff9211b54423ff6d95c22f48df033cc011c8: "Would you please connect with us through e9g6xdbo@poly.network"
TX 0x62d376fbb95367ba95d046c0c041531e320e93526fc282da5a1a65dacc885f47: "NO EMAIL. SORRY. THE ETHEREUM MEMORIZE. I MAY OR MAY NOT PUBLISH OUR CHAT LOG. YOU CAN CHOOSE TO BE TRANSPARENT AND TO SYNC WITH THE PUBLIC."
TX 0x4d6490b47a82e548236b4448713a973d833e439ad9fff76513d38ad2f7cb4fa5: "NEXT MOVE: UNLOCK MY USDT THEN I TRANSFER IT TO YOU"
TX 0x7a924cf530150ba0d0d8b063f33a812ccf7564d347c193d03ad3b728c5fc6ab2: "we will inform Tether as soon as you return all the asset in Polygon"
TX 0x339bee245002f1c41eff7469fe51424d48d6ef856cc81e81d66135e40968f53f: "Is this mailbox yours negotiations@cock.li"
TX 0x588732ed9ec2861e6300710a9a3dcad20d8da591e7e93da3b556d351da697477: "Please confirm your email is polyhacker@yandex.com, not negotiations@cock.li, too many fake emails."
TX 0x98b6316d3004be81c5d1b06c27472bef8097c9c922345876cd36111495ccf32a: ALREADY DECRYPTED
TX 0xdef85ff964015bbb4634f414b1f52228569912657932fa7db5c3365609befb10: "SOME TIPS: AS YOU MAY ALREADY KNOW, I TRIGGERED A NATIVE CONTRACT ON ONTOLOGY WHICH CALLED CROSS CHAIN FUNCTIONS ON THE FOUR CHAINS. THE RELAYERS SHOULD IGNORE MY TRANSACTION SINCE IT'S NOT DEFINED IN THE CONFIG. THEN I NOTICED THE INVOCATION IS ALREADY RECORDED AND PROVED BY THE POLY CHAIN, SO I CAN QUERY THE LOGS AND REPLAY THEM ON THE DEST CHAINS"
TX 0x2f47a23f49ea52a21d44e41937362a55d8addcbe2dbe13f1536da2e16fc41448: "YOU GUYS SHOULD HAVE ENOUGH FUND AND CREDIT TO START THE RECOVERING PHASE. FOR THE REST OF ASSETS, I'M CONSIDERING BUILDING A MULTISIG WALLET SHARED BETWEEN US. I WILL TRANSFER THE REMAININGS TO THAT WALLET. I WILL PROVIDE THE FINAL KEY AFTER IT'S SETTLED. YOU CAN CLAIM THAT YOU HAVE COLLECTED THE ASSETS EARLY. LET THE CRYPTO TALKS. (I MAY DISCLOSE THIS MESSAGE LATER)"
TX 0x05f90618be1e7f64230618476912dccb0091f6eb011dd983f4ac7239e846d422: ALREADY DECRYPTED
TX 0x6c2bbca8ddc9b5ff6ffb1adc0000d909646321de35a4569a3d9c6087cd733f32: "we are working on solutions based on your request"
TX 0x76c8bb50b66b9c21655c2379ebd023100aec3df551dffbb8c33ee11764b10544: I MISSED THIS ONE. "We have prepared 160 ETH of bug bounty at 0x583E25dE879e90cF5fC637F8Dc16Db8F10D91C17, and we will transfer it to a designated address after receiving all the remaining assets.)
There are two options for the receiving address of user assets:
1. Transfer to the multi-sig address on Ethereum that we provided: 0x71Fb9dB587F6d47Ac8192Cd76110E05B8fd2142f. This solution is helpful for users to quickly restore control of their assets.
2. We prepare a 2-2 multi-sig address together. You will be one of the co-signers, and the other co-signer is our multi-sig address: 0x71Fb9dB587F6d47Ac8192Cd76110E05B8fd2142f. This solution requires you to sign and return the assets later.
At the same time, we expect to upgrade Poly Network and to fix the vulnerabilities tomorrow. We hope that we can receive the remaining assets today, so that Poly Network and the related projects can be resumed as soon as possible. We wish we can continue to have your assistance regarding security after this incident is resolved."
TX 0x64c237d37a39662c8386a6f4893c5852486c3d1bbc68605465c603061ddf7d13: "N FROM YOU, 2 FROM ME, MAKE A N+2/N+1 WALLET. 1 KEY WILL BE PUBLISHED, 1 KEY IS THE BACKUP. USE ADDRESSES: 0xDbfa1dC4c1F2bd322b067b8160830F478823059D AND 0x114A38E1f18504BfCc8e4cbfEfff879d2607cE62. TEST IT BEFORE USING IT."
TX 0x80606664c4cc699c76678842eb13f14ea1e1c85ada8ecf621ee210a7be545d2c: "https://gnosis-safe.io/app/#/safes/0x34D6B21D7B773225A102b382815e00Ad876E23C2/transactions, please sign it"
TX 0x8e1f8292201459f372eb1246e5fac4b0814d9a45f9fc30fd7af599fd0d09d040: "We have received all the assets and we expect to restart Poly Network as soon as possible this week. Therefore, to restore all assets according to the original ratio, we hope that you can provide us with the private key of one of the multi-sig addresses .)
We've also noticed that you disclosed that we offered a security bounty. Regarding your contribution to the Poly Network, we still hope to provide you with our bounty reward, and hope that you can send us an address. Of course, we hope to invite you to become the Chief White Hat of Poly Network in the future and contribute to the development of the blockchain world with us."
TX 0x6c4dbf770b84d97fef3a1088cfa92f1af724dabfdbd43839b82bc9bc80b7f1c4: I MISSED THIS ONE "We are discussing with Tether team about the locked USDT."
TX 0x88cc92a023105802dbd4172f451663c6d67f8990da69f0867b3f045e26e11328: "In order to ensure the safe recovery of Poly Network's systems, we expect the following work to consist of five phases:)
1. Vulnerability fix: We will complete vulnerability fix in collaboration with multiple security agencies; will start a global Bounty program and invite more security agencies and white hat organizations to participate in the security review.
2. Mainnet upgrade: After conducting audit together with multiple security audit companies, we will update the mainnet and enable the cross-chain functions as soon as possible. We will postpone the launch of other advanced functions.
3. Putting projects back online: After completing assessment by the security agencies, we will gradually restore the cross-chain services of some projects that use Poly Network.
4. Asset recovery: After receiving the authorization with your private key, we will perform asset recovery as soon as possible to make preparations for users to freely withdraw their assets.
5. Restart of all services: After all assets are fully recovered, we will fully restore all the functions of the Poly Network and will return the control of the assets to the users."
TX 0x96cf55c87fd9eddced690c4dc05dcc37247910bd8873bef52b55a977f345330d: "This is the PR to fix vulnerability, https://github.com/polynetwork/eth-contracts/pull/12/files"
TX 0xa53f6bb54b3dfa4fcca5b307a8a0b56c3a683dc6cfee5ed7415c57a5a1aff3b7: I MISSED THIS ONE "We will update the mainnet and enable the cross-chain functions tomorrow. In addition to the 160 ETH Bounty (converted from $500k at then) we previously promised, we will release a new $500k Bounty Program for global security agencies. Before that we also expect to get your comments on this Hotfix PR."
TX 0x393cec648733d3fd1448ae5620700f505c357e6b684e5bcc0d584ca3b0ede5bd: "Today the Poly Network mainnet has been relaunched, and the cross-chain transfer has been enabled for some projects . Thank you very much for your support and assistance. We have carefully reviewed your suggestions to everyone. As you mentioned yesterday, "SINCE PROTECTING THE ASSETS IS ALWAYS MY FIRST PRIORITY", we hope to restore the ability to use and make cross-chain transfers of major assets to our users as soon as possible. We would like to know in which way you plan to transfer your private key to us. This will speed up the process of giving the control of assets back to users."
SOME ENCRYPTED TEXTS (FROM A TRUE INSIDER):
TX 0x578da109df18e8bc472ea2461b4977420ef0585d3f8fec252ecb8e5d681cb0ea: "TBH I THINK THE POLY NETWORK IS A MASTERPIECE. IT'S MORE CAREFULLY DESIGNED THAN OTHER CROSS CHAIN PROJECT. HOWEVER, IT'S HARDER TO REVIEW DUE TO ITS COMPLEXITY. I TRIED TO CONVINCE THE COMMUNITY THAT IT HAD THE POTENTIAL TO BE THE MOST SUCCESSFUL CROSS CHAIN PROJECT AS IT USED TO BE, BUT I FELT THAT SOME SECURITY TEAMS WERE DOWNPLAYING THE QUALITY OF THIS PROJECT TO BOAST THEIR CAPABILITY OF QUICK POSTMORTEM. I HAVE NEVER THOUGHT OF HURTING THE DEVS WHO REALLY DEVOTED TO THEIR PROJECT, BUT I CAN NOT CONTROL THE WHOLE MEDIA. AS YOU KNOW, THE POLY CHAIN IS A NETWORK REQUIRES REGISTRATION, WHICH IS THE _CENTRALIZED_ PART WHICH I AM NOT ALLOWED ACCESS AND I CAN NOT TRUST, SO I HAD TO CONTINUE BLOWING UP THE _OBVIOUS_ PART OF THE EXPLOITATION CHAIN SO THAT THE REAL ASSETS COULD BE SAVED BEFORE ANY CAPABLE INSIDER FIGURING OUT THE POTENTIAL ATTACK VECTOR. FOR THE _CENTRALIZED_ POLY CHAIN, I THINK IT'S STILL A BIG LOOPHOLE OF A BILLION PROJECT, NO MATTER IF THE CONTRACTS ARE PERFECTLY IMPLEMENTED. YOU ARE FREE TO SHARE OR PUBLISH THIS MESSAGE. BTW I HAVE BEEN TOLD THAT THIS PROJECT IS HEAVILY USED BY ASIAN OR CHINESE DEFI USERS, BUT I DID NOT FIND MANY VOICES IN PUBLIC. DO YOU HAVE ANY SOURCES OF THE OPINIONS FROM COMMUNITY?"
TX 0x5ca0c6d1380fbbea5152ac35d6c876c5accc91d6a7d960f75ed534ed5bdfa1e5/0xb0f349dada561574d1dde4850dc42c8de4ee0fcc10d0075f6304e4b0d80122a3: NOT APPROPRIATE FOR DISCLOSURE DUE TO PRIVACY CONCERNS
TX 0x29939d068232548715cdf2f7069bd42f5146b3200bbfbef8f1e8d565786c83af: "I GOT TONS OF CHINESE COMMENTS ON MY BSC ADDERSS. SOME RANDOM STUFF IS FUN. BUT WHY ARE THEY ASSUMING HACKERS ARE BLACK PEOPLE? ISNT THAT WEIRD?"
TX 0x38ad10b88d9f1f49d91f54297d5802073e724854920c703a39ad71574827d49c: "Q: BUT WHY ARE THEY ASSUMING HACKERS ARE BLACK PEOPLE?
A: THEY ARE JUST IMAGING WHAT THEY WILL DO IF THEY CAN TAKE SUCH AMOUNT OF MONEY. IF SOMEDAY THEY HEARD A BUG OF SOME PROJECT, THEY WILL STEAL THE MONEY EVEN IF THEY NEVER KNOW HOW TO HIDE THEMSELVES.
> 1: IT'S A SERIES OF HARD QUESTIONGS. I DON'T KNOW. AND I HAVE A FEELING THAT YOU KNOW THE POLY MUCH BETTER THAN ME, WHY NOT ANSWERING IT FOR ME?
LOL FOR THIS
"